Forums

is it possible to hack the mapper on other codemasters games, like you did with MicroMachines ?

if yes... do you have any idea how ?
it is quite interesting the idea.. i gotta say..

did you get to test the hack on a real sms ?

--Shaka
http://shaka.deep-ice.com

Quote

> is it possible to hack the mapper on other codemasters games, like you did with MicroMachines ?

> if yes... do you have any idea how ?
> it is quite interesting the idea.. i gotta say..

It's possible to hack the mapper on all the Codemasters games dumped so far, just by replacing the byte sequence $32 $00 $80 [LD ($8000), A] with $32 $FF $FF [LD ($FFFF), A] wherever it occurs. Works fine on a real SMS (w/dev cart) too.

Mike

SMSReader Project

Quote

> is it possible to hack the mapper on other codemasters games, like you did with MicroMachines ?

Yes it is possible to do that with all Codemasters games since their mapper works a way very similar to the default Sega mapper.

I did hacks of some other games a while ago (Cosmic Spacehead, Fantastic Dizzy..) but usually mapper is the simpliest problem when it comes to making those games works, even on a real system :-)

Quote

> I did hacks of some other games a while ago (Cosmic Spacehead, Fantastic Dizzy..) but usually mapper is the simpliest problem when it comes to making those games works, even on a real system :-)

I just gave it a go... CS interestingly only has 4 occurences of 32 00 80, which I presume means it has the asm equivalent of a wrapping function for mapping. FD on the other hand has 142... most of which I think must be other data, so a proper mapper hack might be trickier here. Unless SMS Examine is the solution... anyway, both worked fine as far as I could tell playing each for 5 minutes or so.

Maxim

Quote

> is it possible to hack the mapper on other codemasters games, like you did with MicroMachines ?

Yes
Before MicroMachine I did another one (not released yet)
and it worked on Meka. At this time Meka didn't support codemasters mapper without notification in Meka.nam.
I did that for see if the dump was correct,
because I don't know how to make CRC for Meka.nam.
I pretty sure this mapper hack will work on standard dev cart too.

Quote

> if yes... do you have any idea how ?
> it is quite interesting the idea.. i gotta say..

Read Mike G

Quote

> did you get to test the hack on a real sms ?

No, but it seem Mike did it and it works
(That's just what I want to know and I'm not surprised)

Quote

> --Shaka
> http://shaka.deep-ice.com

Quote

> I did that for see if the dump was correct,
> because I don't know how to make CRC for Meka.nam.

I seem to remember Bock will give you the checksum tool if you ask nicely; it's secret to keep meka.nam "pure". You're an SMS Power member so you're probably trustable :P

I don't know if applies to GG games since they're supposed to have Squinky Tennis instead of the checksumming routine, but all SMS mode Codemasters games dumped so far (that I know of) have a proprietary checksum which you can check by holding buttons 1 and 2 at startup. My header reader can check the Codemasters checksum for you (the screenshot shows it doing just that for MM), and the readme contains the details on how it works.

Maxim

Quote

> I don't know if applies to GG games since they're supposed to have Squinky Tennis instead of the checksumming routine, but all SMS mode Codemasters games dumped so far (that I know of) have a proprietary checksum which you can check by holding buttons 1 and 2 at startup.

It smell bad !

nop
nop

Quote

> > I don't know if applies to GG games since they're supposed to have Squinky Tennis instead of the checksumming routine, but all SMS mode Codemasters games dumped so far (that I know of) have a proprietary checksum which you can check by holding buttons 1 and 2 at startup.

> It smell bad !

>

Just to state the obvious, the mapper hack is bound to show that, you need to use the original with a meka.nam entry so it will use the Codemasters mapper. If that's what you did then, well, you must have a bad dump. If you're still waiting for the meka.nam entry then use my header reader on the original to check it. Hmm, you probably already knew that.

Maxim

Quote

> Just to state the obvious, the mapper hack is bound to show that, you need to use the original with a meka.nam entry so it will use the Codemasters mapper.

Meka doesn't need a Meka.nam entry to use codemaster mappers, it is now autodetected on loading if it's not in Meka.nam (i've tested the detection routine on all Sega 8-bit ROMs to confirm it couldn't create any problem even if deleting meka.nam)

Quote

> If that's what you did then, well, you must have a bad dump. If you're still waiting for the meka.nam entry then use my header reader on the original to check it. Hmm, you probably already knew that.

I worked on it and figured out it was a little bug in Codemaster mapper emulation that screwed the checksum (but only the checksum). I fixed it 'as a test' but I'm pretty sure I added the code that's causing the bug in early developement stage and it may be needed. So I'll have to do some testing on all games to verify it isn't screwing anything else.

Quote

> Meka doesn't need a Meka.nam entry to use codemaster mappers, it is now autodetected on loading if it's not in Meka.nam (i've tested the detection routine on all Sega 8-bit ROMs to confirm it couldn't create any problem even if deleting meka.nam)

Fair enough, I'd forgotten that :) I gave it a go and it does seem to work fine. Are you autodetecting the mapper usage by looking for the right byte sequence in the start of the rom indicating its use, or by checking for the Codemasters header? (just out of interest)

Quote

> I worked on it and figured out it was a little bug in Codemaster mapper emulation that screwed the checksum (but only the checksum).

Works for me, in all the CM roms I've got, in Meka 0.57b, except for the Excellent Dizzy prototype which looks like it doesn't have the code there. Out of interest I non-intelligently hacked the mapper and tried it on an SRAM cart in my SMS2, which strangely also changes the behaviour, but it's not important since it still appears to have no working checksum checking code.

Maxim

Quote

> > It smell bad !

> Just to state the obvious, the mapper hack is bound to show that, you need to use the original with a meka.nam entry so it will use the Codemasters mapper. If that's what you did then, well, you must have a bad dump.

It's probably bad. I found a suspicious tile in it (image for the number 1 seem to be bad). Correct that don't solve the problem and I don't have the cartridge anymore. So, Zoop/Bock/.. may make a better dump.

Quote

> If you're still waiting for the meka.nam entry then use my header reader on the original to check it. Hmm, you probably already knew that.

Like Zoop tell you, it's no more needed. Beside that, it's already in meka.nam (now) !

I've just try Dave's Dega. It run codemaster mapper too.
I can't make picture, but the smiley is happy and the code is E62F. So, the tile of number 1 have to look strange. It's probably some kind of bug that dont affect the game.

(I know you worked on it Zoop, but) It's strange that meka get a green smiley with micromachine and not with this one. Dega get 2 green smiley. Of course all the mapper hack give red smiley with the two emu (do I have to hack the Codemasters checksum routine to get green smiley ? Nevermind).

There is no link with this story, but I'm on my way to look all the GG rom image that I have to try to identify bad dump and alternate version (It's on good way). Maxim, you can expect a long message on the forum (this forum or the other one ?) that point what I've found in comparaison with your GG Checker.

nop
nop

Quote

> Unless SMS Examine is the solution...

Not yet because some code was consider like data.

nop
nop

Sorry nop nop, the bug in MEKA is extremely stupid, so it shouldn't have been existed at all :P
I'll release a new version with some fixes ASAP.

Quote

> do I have to hack the Codemasters checksum routine to get green smiley ? Nevermind

:) too late now... copy and paste:

=====================================
How the Codemasters header works
=====================================

Offset Type Meaning
$7FE0 Byte Number of rom pages over which to calculate the checksum
$7FE1 Byte Day
$7FE2 Byte Month
$7FE3 Byte Year
$7FE4 Byte Hour
$7FE5 Byte Minute
$7FE6 Word Checksum
$7FE8 Word $10000 - checksum
$7FEA-$7FEF are all zero.

$7FE0 is $10 for a 256KB rom and $20 for a 512KB rom.

The date and time bytes are BCD. For Cosmic Spacehead they are
31 08 93 10 59
for 31/8/93, 10:59 am.

The checksum is found by summing words over the entire file to a 16-bit accumulator, except for the Sega header at $7ff0 to $7fff. The checksum word and the word after it sum to zero, allowing the checksum to be added to the file without changing the resulting checksum.

So, if you really wanted, you could patch in the right checksum. As ever, my header reader will calculate it for you - you want 1B3B for your MM hack, for example.

Hmm, I just tried it and the mapper hacks seem to somewhat destroy the checksumming code, they don't page into frame 2 at all when activated... so maybe that won't work.

Quote

> There is no link with this story, but I'm on my way to look all the GG rom image that I have to try to identify bad dump and alternate version (It's on good way). Maxim, you can expect a long message on the forum (this forum or the other one ?) that point what I've found in comparaison with your GG Checker.

OK... bear in mind GG Checker is based on meka.nam, and I admit I'm perhaps a little too ready to mark an unknown dump as bad if there's already one thought to be good. My logic is, if I add data to fix a few bytes and it turns out the original was correct then I can just as easily add data to patch it back again. It's better than having [A], [B], [C] versions knowing that only one is actually correct.

Maxim

Quote

>> Meka doesn't need a Meka.nam entry to use codemaster mappers, it is now autodetected on loading if it's not in Meka.nam (i've tested the detection routine on all Sega 8-bit ROMs to confirm it couldn't create any problem even if deleting meka.nam)
> Fair enough, I'd forgotten that :) I gave it a go and it does seem to work fine. Are you autodetecting the mapper usage by looking for the right byte sequence in the start of the rom indicating its use, or by checking for the Codemasters header? (just out of interest)

I'm detecting opcodes accessing the mapper inside of the code area.

Quote

>> I worked on it and figured out it was a little bug in Codemaster mapper emulation that screwed the checksum (but only the checksum).
> Works for me, in all the CM roms I've got, in Meka 0.57b, except for the Excellent Dizzy prototype which looks like it doesn't have the code there. Out of interest I non-intelligently hacked the mapper and tried it on an SRAM cart in my SMS2, which strangely also changes the behaviour, but it's not important since it still appears to have no working checksum checking code.

Sorry, but I don't understand your paragraph :( Can you rephrase it ?

Quote

> >> I worked on it and figured out it was a little bug in Codemaster mapper emulation that screwed the checksum (but only the checksum).
> > Works for me, in all the CM roms I've got, in Meka 0.57b, except for the Excellent Dizzy prototype which looks like it doesn't have the code there. Out of interest I non-intelligently hacked the mapper and tried it on an SRAM cart in my SMS2, which strangely also changes the behaviour, but it's not important since it still appears to have no working checksum checking code.

> Sorry, but I don't understand your paragraph :( Can you rephrase it ?

OK. For all the Codemasters roms that I have, the checksums work fine in Meka 0.57b; except for the SMS Excellent Dizzy prototype, which appears to not have the checkum routine. I've since guessed that the problem only manifested itself with Dropzone anyway, which makes my post pointless.

I then went off on a tangent, seeing what a mapper-hacked Excellent Dizzy does when asked to checksum itself on a real SMS, but it's not important.

Maxim

Quote

> ~~It's probably bad. I found a suspicious tile in it (image for the number 1 seem to be bad).~~
> the tile of number 1 have to look strange. It's probably some kind of bug that dont affect the game.

It affect the game. Look at the 1 in the picture I posted some time ago !

Quote

> I'm on my way to look all the GG rom image that I have to try to identify bad dump and alternate version (It's on good way).

Of course, I cannot be very efficient since glitch not denote bad dump !

AND THE GREEN SMILEY STORY ?

Quote

> I'm detecting opcodes accessing the mapper inside of the code area. [Zoop]

Yes, so if there is no entry in Meka.nam the first access to the mapper register (or the firsts opcode in the rom ?) determine the type of mapper that's going to be emulated. Perhaps it's more fair than Dega method. With it the two mappers are emulated all the time !

So this new mapper hack with green smiley in Dega may or may not have a green smiley within a real SMS (I think it's OK because the checksum routine access to the mapper have to be hacked too). Unfortunately, I've not made Dev-cart yet... If someone can try for me (or I'm the only stupid guy who wast he's time with sutch a stupid thing).

Quote

> my header reader will calculate it for you - you want 1B3B for your MM hack, for example. [Maxim]

To late, I already see that in a Dega's big DirectDraw Overlay (with red background). Thanks anyway, without your rom header reader documentation, I haven't figured the inverted checksum (E4C5) !

Quote

> Hmm, I just tried it and the mapper hacks seem to somewhat destroy the checksumming code, they don't page into frame 2 at all when activated... so maybe that won't work. [Maxim]

Or maybe that works with the next meka ! (Try it with Dega in the waiting time). Is it the same than mine ?

Quote

> I'll release a new version with some fixes ASAP. [Zoop]

Can I suggest some improvement in the debugger ? The most useful one for me is : break at read (/ write) data from xxxx.
My younger son ask me to suggest autoload savestate with line command (not with GUI, there's a lot of batch behind he's simple mouse click) because half the time he hit F8 !

nop
nop

Quote

> So this new mapper hack with green smiley in Dega may or may not have a green smiley within a real SMS (I think it's OK because the checksum routine access to the mapper have to be hacked too).

The checksum routine must be using another method of accessing the mapper that doesn't do the LD ($8000),A (or whatever it was, I forget exactly). Here's what you get on an SMS, using a devcart:

Here's what Meka shows:

Woo-hoo! Meka is the world's most accurate emulator as ever.

Maxim

Quote

> The checksum routine must be using another method of accessing the mapper that doesn't do the LD ($8000),A (or whatever it was, I forget exactly). Here's what you get on an SMS, using a devcart:

Thanks anyway ! (I will retry soon)

Quote

> Woo-hoo! Meka is the world's most accurate emulator as ever.

I already know Meka is great !

nop
nop

Quote

> > Unless SMS Examine is the solution...

> Not yet because some code was consider like data.

The newest version can almost perfectly disassemble MicroMachines. There are only some minor problems, but it should be good enough to do a patch.

Quote

> > > Unless SMS Examine is the solution...

> > Not yet because some code was consider like data.

> The newest version can almost perfectly disassemble MicroMachines. There are only some minor problems, but it should be good enough to do a patch.

where I can found the newest version ? (I have R1 from S8-Dev)

nop
nop

Here is the return of the green smiley

OK, I hadn't mutch time to do it...

Today is a great day : My third child is born at 11:55 in France.
Is cute (and heavy : 4.05 Kg)

But I have some time to waste in the evening and I was bitten by that story !

I can't imagine that mess when I start with this hack. But I have good tools now : Meka.dump.ram (when I said I used it, actualy it was essentail) and MesaDX's breakpoint at memory read or write (more than useful).

So I found the misshacked opcode in RAM. It was put here by some code located in memory too. And the data for building that opcode come from RAM and ROM. But I think I have sail up the program flow and it probably works now on a Dev-cart.

Let me know (Maxim ?)

nop
nop

Quote

> Today is a great day : My third child is born at 11:55 in France.
> Is cute (and heavy : 4.05 Kg)

Congratulations! I have no idea how heavy that is... 8.9 pounds, still I have no idea. You've got three, I'll believe you when you say it's heavy...

Quote

> So I found the misshacked opcode in RAM. It was put here by some code located in memory too. And the data for building that opcode come from RAM and ROM. But I think I have sail up the program flow and it probably works now on a Dev-cart.

(cropped this time)

It seems odd to have such a mess. It makes me think it's definitely better for emulators to emulate the mapper than the rely on hacks (as was once suggested). After all, the mapper emulation seems simple compared to the video mode emulation...

Maxim

Quote

> Congratulations! I have no idea how heavy that is... 8.9 pounds, still I have no idea. You've got three, I'll believe you when you say it's heavy...

1 Kg = weight of 1 litre of water
1 Pound = 453.8 g
4.05 Kg = 8.928571428571 Pounds (you've got it)

Quote

> It seems odd to have such a mess. It makes me think it's definitely better for emulators to emulate the mapper than the rely on hacks (as was once suggested). After all, the mapper emulation seems simple compared to the video mode emulation...

I think, the interest of sutch a hack is just to run the game on a dev cart (and the fun of make it).
And the interest of getting the green smiley is ridiculous (except the fun) !

nop
nop

Quote

>> ~~It's probably bad. I found a suspicious tile in it (image for the number 1 seem to be bad).~~
>> the tile of number 1 have to look strange. It's probably some kind of bug that dont affect the game.
> It affect the game. Look at the 1 in the picture I posted some time ago !
>

I checked the game and the blue dot seems to appears on a real machine, although it is a bit blurry due to the GG screen.
Strangely enough, the game does not work on my TV Game Gear, so I can't verify with a clean display.

If you modify the dot to make it use the usual color, checksum becomes bad.

Quote

> where I can found the newest version ? (I have R1 from S8-Dev)

Sorry, you can't. It's on my hard drive only. I've still some things to do before the next public release. But anyone can get the current one, if he writes me an email asking about it.

Author	Message
Shaka Guest	Hey nop.nop.. Posted: Thu Jul 19, 2001 3:46 am
Shaka Guest	is it possible to hack the mapper on other codemasters games, like you did with MicroMachines ? if yes... do you have any idea how ? it is quite interesting the idea.. i gotta say.. did you get to test the hack on a real sms ? --Shaka http://shaka.deep-ice.com

Mike G Joined: 21 Apr 2000 Posts: 598 Location: Newcastle upon Tyne, England	Mapper hack Posted: Thu Jul 19, 2001 8:17 am
	Quote > is it possible to hack the mapper on other codemasters games, like you did with MicroMachines ? > if yes... do you have any idea how ? > it is quite interesting the idea.. i gotta say.. It's possible to hack the mapper on all the Codemasters games dumped so far, just by replacing the byte sequence $32 $00 $80 [LD ($8000), A] with $32 $FF $FF [LD ($FFFF), A] wherever it occurs. Works fine on a real SMS (w/dev cart) too. Mike SMSReader Project

Bock Site Admin Joined: 08 Jul 2001 Posts: 8657 Location: Paris, France	Posted: Thu Jul 19, 2001 9:13 pm
	Quote > is it possible to hack the mapper on other codemasters games, like you did with MicroMachines ? Yes it is possible to do that with all Codemasters games since their mapper works a way very similar to the default Sega mapper. I did hacks of some other games a while ago (Cosmic Spacehead, Fantastic Dizzy..) but usually mapper is the simpliest problem when it comes to making those games works, even on a real system :-)

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14749 Location: London	Cosmic Spacehead and Fantastic Dizzy mapper hacks Posted: Thu Jul 19, 2001 9:49 pm
	Quote > I did hacks of some other games a while ago (Cosmic Spacehead, Fantastic Dizzy..) but usually mapper is the simpliest problem when it comes to making those games works, even on a real system :-) I just gave it a go... CS interestingly only has 4 occurences of 32 00 80, which I presume means it has the asm equivalent of a wrapping function for mapping. FD on the other hand has 142... most of which I think must be other data, so a proper mapper hack might be trickier here. Unless SMS Examine is the solution... anyway, both worked fine as far as I could tell playing each for 5 minutes or so. Maxim

nop.nop Guest	Posted: Fri Jul 20, 2001 1:48 am
nop.nop Guest	Quote > is it possible to hack the mapper on other codemasters games, like you did with MicroMachines ? Yes Before MicroMachine I did another one (not released yet) and it worked on Meka. At this time Meka didn't support codemasters mapper without notification in Meka.nam. I did that for see if the dump was correct, because I don't know how to make CRC for Meka.nam. I pretty sure this mapper hack will work on standard dev cart too. Quote > if yes... do you have any idea how ? > it is quite interesting the idea.. i gotta say.. Read Mike G Quote > did you get to test the hack on a real sms ? No, but it seem Mike did it and it works (That's just what I want to know and I'm not surprised) Quote > --Shaka > http://shaka.deep-ice.com

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14749 Location: London	Codemasters dump checking Posted: Fri Jul 20, 2001 10:09 am
	Quote > I did that for see if the dump was correct, > because I don't know how to make CRC for Meka.nam. I seem to remember Bock will give you the checksum tool if you ask nicely; it's secret to keep meka.nam "pure". You're an SMS Power member so you're probably trustable :P I don't know if applies to GG games since they're supposed to have Squinky Tennis instead of the checksumming routine, but all SMS mode Codemasters games dumped so far (that I know of) have a proprietary checksum which you can check by holding buttons 1 and 2 at startup. My header reader can check the Codemasters checksum for you (the screenshot shows it doing just that for MM), and the readme contains the details on how it works. Maxim

nop.nop Guest	Re: Codemasters dump checking Posted: Fri Jul 20, 2001 11:45 pm
nop.nop Guest	Quote > I don't know if applies to GG games since they're supposed to have Squinky Tennis instead of the checksumming routine, but all SMS mode Codemasters games dumped so far (that I know of) have a proprietary checksum which you can check by holding buttons 1 and 2 at startup. It smell bad ! nop nop

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14749 Location: London	Re: Codemasters dump checking Posted: Sat Jul 21, 2001 9:34 am
	Quote > > I don't know if applies to GG games since they're supposed to have Squinky Tennis instead of the checksumming routine, but all SMS mode Codemasters games dumped so far (that I know of) have a proprietary checksum which you can check by holding buttons 1 and 2 at startup. > It smell bad ! > Just to state the obvious, the mapper hack is bound to show that, you need to use the original with a meka.nam entry so it will use the Codemasters mapper. If that's what you did then, well, you must have a bad dump. If you're still waiting for the meka.nam entry then use my header reader on the original to check it. Hmm, you probably already knew that. Maxim

Bock Site Admin Joined: 08 Jul 2001 Posts: 8657 Location: Paris, France	Re: Codemasters dump checking Posted: Sat Jul 21, 2001 5:32 pm
	Quote > Just to state the obvious, the mapper hack is bound to show that, you need to use the original with a meka.nam entry so it will use the Codemasters mapper. Meka doesn't need a Meka.nam entry to use codemaster mappers, it is now autodetected on loading if it's not in Meka.nam (i've tested the detection routine on all Sega 8-bit ROMs to confirm it couldn't create any problem even if deleting meka.nam) Quote > If that's what you did then, well, you must have a bad dump. If you're still waiting for the meka.nam entry then use my header reader on the original to check it. Hmm, you probably already knew that. I worked on it and figured out it was a little bug in Codemaster mapper emulation that screwed the checksum (but only the checksum). I fixed it 'as a test' but I'm pretty sure I added the code that's causing the bug in early developement stage and it may be needed. So I'll have to do some testing on all games to verify it isn't screwing anything else.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14749 Location: London	Re: Codemasters dump checking Posted: Sat Jul 21, 2001 8:21 pm
	Quote > Meka doesn't need a Meka.nam entry to use codemaster mappers, it is now autodetected on loading if it's not in Meka.nam (i've tested the detection routine on all Sega 8-bit ROMs to confirm it couldn't create any problem even if deleting meka.nam) Fair enough, I'd forgotten that :) I gave it a go and it does seem to work fine. Are you autodetecting the mapper usage by looking for the right byte sequence in the start of the rom indicating its use, or by checking for the Codemasters header? (just out of interest) Quote > I worked on it and figured out it was a little bug in Codemaster mapper emulation that screwed the checksum (but only the checksum). Works for me, in all the CM roms I've got, in Meka 0.57b, except for the Excellent Dizzy prototype which looks like it doesn't have the code there. Out of interest I non-intelligently hacked the mapper and tried it on an SRAM cart in my SMS2, which strangely also changes the behaviour, but it's not important since it still appears to have no working checksum checking code. Maxim

nop.nop Guest	Re: Codemasters dump checking Posted: Sun Jul 22, 2001 12:32 am
nop.nop Guest	Quote > > It smell bad ! > Just to state the obvious, the mapper hack is bound to show that, you need to use the original with a meka.nam entry so it will use the Codemasters mapper. If that's what you did then, well, you must have a bad dump. It's probably bad. I found a suspicious tile in it (image for the number 1 seem to be bad). Correct that don't solve the problem and I don't have the cartridge anymore. So, Zoop/Bock/.. may make a better dump. Quote > If you're still waiting for the meka.nam entry then use my header reader on the original to check it. Hmm, you probably already knew that. Like Zoop tell you, it's no more needed. Beside that, it's already in meka.nam (now) ! I've just try Dave's Dega. It run codemaster mapper too. I can't make picture, but the smiley is happy and the code is E62F. So, the tile of number 1 have to look strange. It's probably some kind of bug that dont affect the game. (I know you worked on it Zoop, but) It's strange that meka get a green smiley with micromachine and not with this one. Dega get 2 green smiley. Of course all the mapper hack give red smiley with the two emu (do I have to hack the Codemasters checksum routine to get green smiley ? Nevermind). There is no link with this story, but I'm on my way to look all the GG rom image that I have to try to identify bad dump and alternate version (It's on good way). Maxim, you can expect a long message on the forum (this forum or the other one ?) that point what I've found in comparaison with your GG Checker. nop nop

nop.nop Guest	Re: Cosmic Spacehead and Fantastic Dizzy mapper hacks Posted: Sun Jul 22, 2001 12:46 am
nop.nop Guest	Quote > Unless SMS Examine is the solution... Not yet because some code was consider like data. nop nop

Bock Site Admin Joined: 08 Jul 2001 Posts: 8657 Location: Paris, France	Re: Codemasters dump checking Posted: Sun Jul 22, 2001 11:57 am
	Sorry nop nop, the bug in MEKA is extremely stupid, so it shouldn't have been existed at all :P I'll release a new version with some fixes ASAP.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14749 Location: London	Re: Codemasters checksum, GG Checker Posted: Sun Jul 22, 2001 11:58 am
	Quote > do I have to hack the Codemasters checksum routine to get green smiley ? Nevermind :) too late now... copy and paste: ===================================== How the Codemasters header works ===================================== Offset Type Meaning $7FE0 Byte Number of rom pages over which to calculate the checksum $7FE1 Byte Day $7FE2 Byte Month $7FE3 Byte Year $7FE4 Byte Hour $7FE5 Byte Minute $7FE6 Word Checksum $7FE8 Word $10000 - checksum $7FEA-$7FEF are all zero. $7FE0 is $10 for a 256KB rom and $20 for a 512KB rom. The date and time bytes are BCD. For Cosmic Spacehead they are 31 08 93 10 59 for 31/8/93, 10:59 am. The checksum is found by summing words over the entire file to a 16-bit accumulator, except for the Sega header at $7ff0 to $7fff. The checksum word and the word after it sum to zero, allowing the checksum to be added to the file without changing the resulting checksum. So, if you really wanted, you could patch in the right checksum. As ever, my header reader will calculate it for you - you want 1B3B for your MM hack, for example. Hmm, I just tried it and the mapper hacks seem to somewhat destroy the checksumming code, they don't page into frame 2 at all when activated... so maybe that won't work. Quote > There is no link with this story, but I'm on my way to look all the GG rom image that I have to try to identify bad dump and alternate version (It's on good way). Maxim, you can expect a long message on the forum (this forum or the other one ?) that point what I've found in comparaison with your GG Checker. OK... bear in mind GG Checker is based on meka.nam, and I admit I'm perhaps a little too ready to mark an unknown dump as bad if there's already one thought to be good. My logic is, if I add data to fix a few bytes and it turns out the original was correct then I can just as easily add data to patch it back again. It's better than having [A], [B], [C] versions knowing that only one is actually correct. Maxim

Bock Site Admin Joined: 08 Jul 2001 Posts: 8657 Location: Paris, France	Re: Codemasters dump checking Posted: Sun Jul 22, 2001 11:59 am
	Quote >> Meka doesn't need a Meka.nam entry to use codemaster mappers, it is now autodetected on loading if it's not in Meka.nam (i've tested the detection routine on all Sega 8-bit ROMs to confirm it couldn't create any problem even if deleting meka.nam) > Fair enough, I'd forgotten that :) I gave it a go and it does seem to work fine. Are you autodetecting the mapper usage by looking for the right byte sequence in the start of the rom indicating its use, or by checking for the Codemasters header? (just out of interest) I'm detecting opcodes accessing the mapper inside of the code area. Quote >> I worked on it and figured out it was a little bug in Codemaster mapper emulation that screwed the checksum (but only the checksum). > Works for me, in all the CM roms I've got, in Meka 0.57b, except for the Excellent Dizzy prototype which looks like it doesn't have the code there. Out of interest I non-intelligently hacked the mapper and tried it on an SRAM cart in my SMS2, which strangely also changes the behaviour, but it's not important since it still appears to have no working checksum checking code. Sorry, but I don't understand your paragraph :( Can you rephrase it ?

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14749 Location: London	OK :) Posted: Sun Jul 22, 2001 12:48 pm
	Quote > >> I worked on it and figured out it was a little bug in Codemaster mapper emulation that screwed the checksum (but only the checksum). > > Works for me, in all the CM roms I've got, in Meka 0.57b, except for the Excellent Dizzy prototype which looks like it doesn't have the code there. Out of interest I non-intelligently hacked the mapper and tried it on an SRAM cart in my SMS2, which strangely also changes the behaviour, but it's not important since it still appears to have no working checksum checking code. > Sorry, but I don't understand your paragraph :( Can you rephrase it ? OK. For all the Codemasters roms that I have, the checksums work fine in Meka 0.57b; except for the SMS Excellent Dizzy prototype, which appears to not have the checkum routine. I've since guessed that the problem only manifested itself with Dropzone anyway, which makes my post pointless. I then went off on a tangent, seeing what a mapper-hacked Excellent Dizzy does when asked to checksum itself on a real SMS, but it's not important. Maxim

nop.nop Guest	Never mind the green smiley ? Posted: Sun Jul 22, 2001 4:03 pm
nop.nop Guest	Quote > ~~It's probably bad. I found a suspicious tile in it (image for the number 1 seem to be bad).~~ > the tile of number 1 have to look strange. It's probably some kind of bug that dont affect the game. It affect the game. Look at the 1 in the picture I posted some time ago ! Quote > I'm on my way to look all the GG rom image that I have to try to identify bad dump and alternate version (It's on good way). Of course, I cannot be very efficient since glitch not denote bad dump ! AND THE GREEN SMILEY STORY ? Quote > I'm detecting opcodes accessing the mapper inside of the code area. [Zoop] Yes, so if there is no entry in Meka.nam the first access to the mapper register (or the firsts opcode in the rom ?) determine the type of mapper that's going to be emulated. Perhaps it's more fair than Dega method. With it the two mappers are emulated all the time ! So this new mapper hack with green smiley in Dega may or may not have a green smiley within a real SMS (I think it's OK because the checksum routine access to the mapper have to be hacked too). Unfortunately, I've not made Dev-cart yet... If someone can try for me (or I'm the only stupid guy who wast he's time with sutch a stupid thing). Quote > my header reader will calculate it for you - you want 1B3B for your MM hack, for example. [Maxim] To late, I already see that in a Dega's big DirectDraw Overlay (with red background). Thanks anyway, without your rom header reader documentation, I haven't figured the inverted checksum (E4C5) ! Quote > Hmm, I just tried it and the mapper hacks seem to somewhat destroy the checksumming code, they don't page into frame 2 at all when activated... so maybe that won't work. [Maxim] Or maybe that works with the next meka ! (Try it with Dega in the waiting time). Is it the same than mine ? Quote > I'll release a new version with some fixes ASAP. [Zoop] Can I suggest some improvement in the debugger ? The most useful one for me is : break at read (/ write) data from xxxx. My younger son ask me to suggest autoload savestate with line command (not with GUI, there's a lot of batch behind he's simple mouse click) because half the time he hit F8 ! nop nop

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14749 Location: London	Re: Never mind the green smiley ? Posted: Sun Jul 22, 2001 6:28 pm
	Quote > So this new mapper hack with green smiley in Dega may or may not have a green smiley within a real SMS (I think it's OK because the checksum routine access to the mapper have to be hacked too). The checksum routine must be using another method of accessing the mapper that doesn't do the LD ($8000),A (or whatever it was, I forget exactly). Here's what you get on an SMS, using a devcart: Here's what Meka shows: Woo-hoo! Meka is the world's most accurate emulator as ever. Maxim

nop.nop Guest	hicups Posted: Mon Jul 23, 2001 2:51 am
nop.nop Guest	Quote > The checksum routine must be using another method of accessing the mapper that doesn't do the LD ($8000),A (or whatever it was, I forget exactly). Here's what you get on an SMS, using a devcart: Thanks anyway ! (I will retry soon) Quote > Woo-hoo! Meka is the world's most accurate emulator as ever. I already know Meka is great ! nop nop

Martin Guest	Re: Cosmic Spacehead and Fantastic Dizzy mapper hacks Posted: Mon Jul 23, 2001 1:08 pm
Martin Guest	Quote > > Unless SMS Examine is the solution... > Not yet because some code was consider like data. The newest version can almost perfectly disassemble MicroMachines. There are only some minor problems, but it should be good enough to do a patch.

nop.nop Guest	Where it is ? Posted: Mon Jul 23, 2001 9:54 pm
nop.nop Guest	Quote > > > Unless SMS Examine is the solution... > > Not yet because some code was consider like data. > The newest version can almost perfectly disassemble MicroMachines. There are only some minor problems, but it should be good enough to do a patch. where I can found the newest version ? (I have R1 from S8-Dev) nop nop

nop.nop Guest	Return of the green smiley Posted: Mon Jul 23, 2001 10:22 pm
nop.nop Guest	Here is the return of the green smiley OK, I hadn't mutch time to do it... Today is a great day : My third child is born at 11:55 in France. Is cute (and heavy : 4.05 Kg) But I have some time to waste in the evening and I was bitten by that story ! I can't imagine that mess when I start with this hack. But I have good tools now : Meka.dump.ram (when I said I used it, actualy it was essentail) and MesaDX's breakpoint at memory read or write (more than useful). So I found the misshacked opcode in RAM. It was put here by some code located in memory too. And the data for building that opcode come from RAM and ROM. But I think I have sail up the program flow and it probably works now on a Dev-cart. Let me know (Maxim ?) nop nop

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14749 Location: London	Yes indeedy, and congratulations Posted: Mon Jul 23, 2001 10:48 pm
	Quote > Today is a great day : My third child is born at 11:55 in France. > Is cute (and heavy : 4.05 Kg) Congratulations! I have no idea how heavy that is... 8.9 pounds, still I have no idea. You've got three, I'll believe you when you say it's heavy... Quote > So I found the misshacked opcode in RAM. It was put here by some code located in memory too. And the data for building that opcode come from RAM and ROM. But I think I have sail up the program flow and it probably works now on a Dev-cart. (cropped this time) It seems odd to have such a mess. It makes me think it's definitely better for emulators to emulate the mapper than the rely on hacks (as was once suggested). After all, the mapper emulation seems simple compared to the video mode emulation... Maxim

nop.nop Guest	Re: Yes indeedy, and congratulations Posted: Mon Jul 23, 2001 11:45 pm
nop.nop Guest	Quote > Congratulations! I have no idea how heavy that is... 8.9 pounds, still I have no idea. You've got three, I'll believe you when you say it's heavy... 1 Kg = weight of 1 litre of water 1 Pound = 453.8 g 4.05 Kg = 8.928571428571 Pounds (you've got it) Quote > It seems odd to have such a mess. It makes me think it's definitely better for emulators to emulate the mapper than the rely on hacks (as was once suggested). After all, the mapper emulation seems simple compared to the video mode emulation... I think, the interest of sutch a hack is just to run the game on a dev cart (and the fun of make it). And the interest of getting the green smiley is ridiculous (except the fun) ! nop nop

Bock Site Admin Joined: 08 Jul 2001 Posts: 8657 Location: Paris, France	About the '1' blue dot Posted: Tue Jul 24, 2001 9:46 pm
	Quote >> ~~It's probably bad. I found a suspicious tile in it (image for the number 1 seem to be bad).~~ >> the tile of number 1 have to look strange. It's probably some kind of bug that dont affect the game. > It affect the game. Look at the 1 in the picture I posted some time ago ! > I checked the game and the blue dot seems to appears on a real machine, although it is a bit blurry due to the GG screen. Strangely enough, the game does not work on my TV Game Gear, so I can't verify with a clean display.

Bock Site Admin Joined: 08 Jul 2001 Posts: 8657 Location: Paris, France	Also.. Posted: Tue Jul 24, 2001 9:54 pm
	If you modify the dot to make it use the usual color, checksum becomes bad.

Martin Guest	Re: Where it is ? Posted: Wed Jul 25, 2001 9:45 am
Martin Guest	Quote > where I can found the newest version ? (I have R1 from S8-Dev) Sorry, you can't. It's on my hard drive only. I've still some things to do before the next public release. But anyone can get the current one, if he writes me an email asking about it.

Forums

View topic - Hey nop.nop..