|
DU: Gals are still panicking
#378620 - 09/17/18 10:15 PM
|
|
|
Nomax dumped Gals Panic 4 Euro
|
|
|
|
Re: DU: Gals are still panicking
[Re: Smitdogg]
#378621 - 09/18/18 02:51 AM
|
|
|
> Nomax dumped Gals Panic 4 Euro
Weren't these games heavily protected? I remember reading somewhere they had MCUs that have not yet been figured out.
|
"Note to Noobs:
We are glad to help you but simply posting that something does not work is not going to lead to you getting help. The more information you can supply defining your problem, the less likely it will be that you will get smart-alec replies.
C.D.~"
|
|
|
Re: DU: Gals are still panicking
[Re: Master O]
#378622 - 09/18/18 05:53 AM
|
|
|
> Weren't these games heavily protected? I remember reading somewhere they had MCUs
> that have not yet been figured out.
Gals Panic 4 runs on the Super Kaneko Nova system, which appears to be unprotected except for some PLD-based region locking. A lot of earlier Kaneko games make use of various NEC µPD78324 MCUs with internal mask programs. (The µPD78324 belongs to the 78K/III family, which MAME currently doesn't even have an emulation core for.) Of these MCUs, "Toybox" and "Calc-3" are currently simulated in MAME, while "Pisces," which is unique to Gals Panic 2, is not.
|
|
|
|
Re: DU: Gals are still panicking
[Re: AJR Hacker]
#378629 - 09/18/18 07:18 PM
|
|
|
> > Weren't these games heavily protected? I remember reading somewhere they had MCUs
> > that have not yet been figured out.
>
> Gals Panic 4 runs on the Super Kaneko Nova system, which appears to be unprotected
> except for some PLD-based region locking. A lot of earlier Kaneko games make use of
> various NEC µPD78324 MCUs with internal mask programs. (The µPD78324 belongs to the
> 78K/III family, which MAME currently doesn't even have an emulation core for.) Of
> these MCUs, "Toybox" and "Calc-3" are currently simulated in MAME, while "Pisces,"
> which is unique to Gals Panic 2, is not.
there's a calc style thing there, although I've never studied the extent to which the games use it; that part of the suprnova implementation was given to me and I haven't really touched it (unlike the rest which is almost entirely my code at this point). Apparently it's quite similar to the 3d bounding box collision stuff that brap boys etc. have (which might really be separate from the rest of the protection even there, we'll see once we get an internal rom, assuming we ever do)
that said, no, protection isn't a big deal for any of these.
|
|
|
|
Re: DU: Gals are still panicking
[Re: AJR Hacker]
#378646 - 09/20/18 02:50 PM
|
|
|
> > Weren't these games heavily protected? I remember reading somewhere they had MCUs
> > that have not yet been figured out.
>
> Gals Panic 4 runs on the Super Kaneko Nova system, which appears to be unprotected
> except for some PLD-based region locking. A lot of earlier Kaneko games make use of
> various NEC µPD78324 MCUs with internal mask programs. (The µPD78324 belongs to the
> 78K/III family, which MAME currently doesn't even have an emulation core for.) Of
> these MCUs, "Toybox" and "Calc-3" are currently simulated in MAME, while "Pisces,"
> which is unique to Gals Panic 2, is not.
Would decapping help with the MCUs that are currently simulated?
|
"Note to Noobs:
We are glad to help you but simply posting that something does not work is not going to lead to you getting help. The more information you can supply defining your problem, the less likely it will be that you will get smart-alec replies.
C.D.~"
|
|
|
Re: DU: Gals are still panicking
[Re: Master O]
#378648 - 09/20/18 05:24 PM
|
|
|
> Would decapping help with the MCUs that are currently simulated?
Quite likely, but Caps0ff hasn't gotten around to any of them yet. The Kaneko CALC3, PISCES and TBSOP01 MCUs are all waiting for that.
|
|
|
|
Re: DU: Gals are still panicking
[Re: Haze]
#378649 - 09/20/18 05:30 PM
|
|
|
> there's a calc style thing there, although I've never studied the extent to which the
> games use it; that part of the suprnova implementation was given to me and I haven't
> really touched it (unlike the rest which is almost entirely my code at this point).
> Apparently it's quite similar to the 3d bounding box collision stuff that brap boys
> etc. have (which might really be separate from the rest of the protection even there,
> we'll see once we get an internal rom, assuming we ever do)
I rather suspect that one of the Super Nova system's custom-named ICs is some sort of MCU that channels the board I/O through shared RAM rather than the direct mapping the driver currently provides.
|
|
|
|
Re: DU: Gals are still panicking
[Re: AJR Hacker]
#378652 - 09/21/18 09:36 AM
|
|
|
> > there's a calc style thing there, although I've never studied the extent to which
> the
> > games use it; that part of the suprnova implementation was given to me and I
> haven't
> > really touched it (unlike the rest which is almost entirely my code at this point).
> > Apparently it's quite similar to the 3d bounding box collision stuff that brap boys
> > etc. have (which might really be separate from the rest of the protection even
> there,
> > we'll see once we get an internal rom, assuming we ever do)
>
> I rather suspect that one of the Super Nova system's custom-named ICs is some sort of
> MCU that channels the board I/O through shared RAM rather than the direct mapping the
> driver currently provides.
400000-40000f looks like a somewhat usual in/ou mux to me, what makes you think that?
OG.
|
|
|
|
Re: DU: Gals are still panicking
[Re: Haze]
#378653 - 09/21/18 09:39 AM
|
|
|
> there's a calc style thing there, although I've never studied the extent to which the
> games use it; that part of the suprnova implementation was given to me and I haven't
> really touched it (unlike the rest which is almost entirely my code at this point).
> Apparently it's quite similar to the 3d bounding box collision stuff that brap boys
> etc. have (which might really be separate from the rest of the protection even there,
> we'll see once we get an internal rom, assuming we ever do)
Well, that hit check function is supposed to be in the memory controller, so I doubt it's a mcu. Plus the functionality matches well with what can be done efficiently in hardware.
OG.
|
|
|
|
Re: DU: Gals are still panicking
[Re: Olivier Galibert]
#378656 - 09/21/18 05:20 PM
|
|
|
> > I rather suspect that one of the Super Nova system's custom-named ICs is some sort
> of
> > MCU that channels the board I/O through shared RAM rather than the direct mapping
> the
> > driver currently provides.
>
> 400000-40000f looks like a somewhat usual in/ou mux to me, what makes you think that?
>
> OG.
It's the analog "paddle" stuff, which is mapped to some oddly nonconsecutive bytes. What's even more odd about that is that the ADC on the board is a MSM6253, which has a microprocessor bus-compatible serial readout.
|
|
|
|
Re: DU: Gals are still panicking
[Re: AJR Hacker]
#378658 - 09/21/18 06:41 PM
|
|
|
> > > I rather suspect that one of the Super Nova system's custom-named ICs is some
> sort
> > of
> > > MCU that channels the board I/O through shared RAM rather than the direct mapping
> > the
> > > driver currently provides.
> >
> > 400000-40000f looks like a somewhat usual in/ou mux to me, what makes you think
> that?
> >
> > OG.
>
> It's the analog "paddle" stuff, which is mapped to some oddly nonconsecutive bytes.
> What's even more odd about that is that the ADC on the board is a MSM6253, which has
> a microprocessor bus-compatible serial readout.
I vaguely recall the SH2 has some kind of serial interface, sure it isn't hooked up to that, and the current hookup is just skipping that part?
|
|
|
|
Re: DU: Gals are still panicking
[Re: Olivier Galibert]
#378659 - 09/21/18 07:21 PM
|
|
|
> > there's a calc style thing there, although I've never studied the extent to which
> the
> > games use it; that part of the suprnova implementation was given to me and I
> haven't
> > really touched it (unlike the rest which is almost entirely my code at this point).
> > Apparently it's quite similar to the 3d bounding box collision stuff that brap boys
> > etc. have (which might really be separate from the rest of the protection even
> there,
> > we'll see once we get an internal rom, assuming we ever do)
>
> Well, that hit check function is supposed to be in the memory controller, so I doubt
> it's a mcu. Plus the functionality matches well with what can be done efficiently in
> hardware.
>
> OG.
and from what I remember the CALC1 (original Gals Panic) was found to be an ASIC of some kind, not an MCU, that's why I wonder if that part of the protection even on the later 'CALC3' games is only being called by the protection MCU (like the EEPROM stuff) rather than being in the MCU code.
|
|
|
|
Re: DU: Gals are still panicking
[Re: Haze]
#378660 - 09/21/18 07:37 PM
|
|
|
> > It's the analog "paddle" stuff, which is mapped to some oddly nonconsecutive bytes.
> > What's even more odd about that is that the ADC on the board is a MSM6253, which
> has
> > a microprocessor bus-compatible serial readout.
>
> I vaguely recall the SH2 has some kind of serial interface, sure it isn't hooked up
> to that, and the current hookup is just skipping that part?
While at least some SuperH models have an on-chip SCI peripheral, I don't recall the code configuring anything like that. It wouldn't make sense from a hardware standpoint, seeing as the SH-2 is way over on the opposite corner of the PCB from the MSM6253.
I do recall SCI or something like it being used in the Saturn for communication between the SCSP and the SH-1.
|
|
|
|
Re: DU: Gals are still panicking
[Re: AJR Hacker]
#378661 - 09/21/18 07:56 PM
|
|
|
> > > It's the analog "paddle" stuff, which is mapped to some oddly nonconsecutive
> bytes.
> > > What's even more odd about that is that the ADC on the board is a MSM6253, which
> > has
> > > a microprocessor bus-compatible serial readout.
> >
> > I vaguely recall the SH2 has some kind of serial interface, sure it isn't hooked up
> > to that, and the current hookup is just skipping that part?
>
> While at least some SuperH models have an on-chip SCI peripheral, I don't recall the
> code configuring anything like that. It wouldn't make sense from a hardware
> standpoint, seeing as the SH-2 is way over on the opposite corner of the PCB from the
> MSM6253.
>
> I do recall SCI or something like it being used in the Saturn for communication
> between the SCSP and the SH-1.
that might be what I was thinking of then, yeah, or possible SH3 (the touchscreen on the Mahjong game?)
|
|
|
|
Re: DU: Gals are still panicking
[Re: AJR Hacker]
#378663 - 09/22/18 10:11 AM
|
|
|
> > > I rather suspect that one of the Super Nova system's custom-named ICs is some
> sort
> > of
> > > MCU that channels the board I/O through shared RAM rather than the direct mapping
> > the
> > > driver currently provides.
> >
> > 400000-40000f looks like a somewhat usual in/ou mux to me, what makes you think
> that?
> >
> > OG.
>
> It's the analog "paddle" stuff, which is mapped to some oddly nonconsecutive bytes.
> What's even more odd about that is that the ADC on the board is a MSM6253, which has
> a microprocessor bus-compatible serial readout.
Interesting. It looks a lot like back-compatibility given the structure though.
0-3 is readonly, digital (controls, coin, test)
4-6 is readonly, three 8-bits adcs
7 is readonly, one byte of dips
As-is, you can run a complete game on that subpart. Then you have:
8 is coin lock/counter
9 is analog select between optical and voltage
10-11 is two generic, unassigned 8-bit outputs
So a 4-byte write-only block that seems a little aftertought-ish
Then:
12-13 is two generic, unassigned 8-bits input ports
14 is outputs to the interrupt controller to clear interrupts, and it's clear-on-write-0-bit to boot, which doesn't jive well with a shared/dual port ram
15 is the 4th analog input port
Frankly, that smells a lot like "ok, we forgot the coin counters, let's add them, but we have more address decoding now, what should we do with it?".
The serial aspect is interesting, but I don't see any particular problem for an asic to handle it, it's just a rotating scanning I guess.
OG.
|
|
|
Index 
Threaded 
DU: Gals are still panicking
Reply
[Re: 