|
|
Post by dshadoff on Feb 2, 2019 21:21:40 GMT
I went through my whole American HuCard collection and ripped, bit-flipped, and de-region-checked them all... and I learned a few things in the process. Exception CardsThere are only a few American HuCards which still ran on Japanese hardware (where others fail due to the region check): - Ghost Manor - Gunboat - Klax- Night Creatures - American Super System Card 3.0 Of these, Gunboat and Klax still have the region check code... but instead of running the standard "runaway state" code, they implemented NOPs, so the "Japanese hardware" branch falls through to the "American hardware" code path, and they run OK. Detection MechanismThe code which detects an American production unit checks a bit on the joystick port ($1000): LDA #$FF TAM #$01 LDA $1000 AND #$40 BEQ <American machine> This bit, #$40 on $FF:$1000. is set to 0 on a Japanese machine, but set to 1 on an American machine. Patching - and On-the-Fly Patching on Everdrive (and potentially elsewhere)The above code - at least the portion starting from "LDA $1000" - is a pretty brief sequnece, and is ALWAYS the same on every game. The hexadecimal sequence for it is: AD 00 10 29 40 F0 <xx> In order to 'force' the code to go to the "properly execute" branch, one needs to change the conditional branch (BEQ <American machine>/F0 <xx>), we simply need to change it to an unconditional branch (BRA <American machine>/80 <xx>). This is all it takes to make the games run on Japanese machines - a one byte change. In fact, I noticed that the Turbo Everdrive auto-patches games, in-transit from SD Card to the memory where it resides. It's simply looking at the byte stream, and if it recognizes the region-check code identified above, it alters that single byte in the byte stream. But I wondered whether this blind change might cause any troubles - for example, does this sequence exist anywhere else for any other purpose ? Could it be hidden in graphic data ? Music ? Japanese games for any reason ? So I wrote a program to search for the 6-byte sequence above... and it didn't exist in any of the official HuCards or Caravan/Special Version HuCards either. However, I can't guarantee that it doesn't exist in any Homebrew. Runaway State CodeSo, what does the region-check code do if it detects Japanese hardware ? It appears to go into an infitie loop, so I was expecting to see code like: .HERE: BRA .HERE
...But that wasn't what I found. Instead, I found this: LDA #$90 TAM #$04
JMP $4000
JSR $454E ; doesn't appear to reach here, so maybe it's not useful ?
TMA #$20
<American Branch here>
...This isn't code to deliberately jam up a Japanese machine; it's mapping some memory into Bank #$90, and jumping to it. I'm not sure what kind of hardware it is, but it's probably some sort of debugging system monitor program. In other words, they used a special "debugging ROM" HuCard on a Japanese system (most likely Hu7D) in order to do debugging, and never removed the code when they went to produce the final HuCards (except for Klax and Gunboat). Dave |
|
Deleted
Deleted Member
Posts: 0
|
Post by Deleted on Feb 2, 2019 21:47:07 GMT
Makes you wonder if the "Region Detect" code is meant to block execution on a Japanese system, or simply an easy way to enable some kind of ICE debugging unit since presumably they would all be based on/incorporate Japanese units. That would explain why Gunboat/Klax simply disables the debugger jump with NOPs (they didn't have the units or had third party ones?).
|
|
|
|
Post by dshadoff on Feb 2, 2019 22:18:14 GMT
After looking at this, I think that the region lockout wasn't intentional - but that they didn't care, since they didn't intend to target the Japanese platform.
There was probably a more elegant way to check whether the code was executing on a developer machine, but the guy in charge of it went for quick-and-dirty instead.
Dave
|
|
|
|
Post by elmer on Feb 3, 2019 1:46:02 GMT
After looking at this, I think that the region lockout wasn't intentional - but that they didn't care, since they didn't intend to target the Japanese platform. Nope, I'm absolutely sure that it was intentional. See this, from Hudson's official developer documentation ...  From my POV, I see this as an NEC USA protection against unauthorized publishers releasing cartridges, which as you will remember, was a manufacturer's concern in those days (and still is), because console manufacturers charge publishers royalties for every game that they sell for the console. By requiring that all games need to include a piece of Hudson/NEC copyrighted code in them in order to physically work, a hardware manufacturer could get an injunction against any unauthorized publishers for copyright infringement since they need to include that copyrighted code. The code would definitely make sense if the TG16 had included a ROM at bank $90, say as part of a plan to include a built-in game that they could ship the system with ... and the same method of using copyrighted-code as protection is built into all PCE/TG16 CD games as part of the IPL boot code. As we know now, NEC USA never did build a BOOT ROM into the TG16, and they chose to use the reversed-data-bus on the HuCard to provide basic region-protection. Perhaps they decided that the whole proprietary nature of HuCard manufacturing was enough to deter unauthorized publishers? Perhaps they decided that the CD-ROM was where they were going to make their money, and decided that the extra cost of a BOOT ROM on the TG16 just didn't make any sense? We may never know ... but authorized-developers were told to put the protection code into their games, and so they did. |
|
|
|
Post by dshadoff on Feb 3, 2019 4:52:06 GMT
Hmm... I see what you mean, but it still doesn't make sense.
1) The whole mapping of a ROM at bank $90 is only actually performed if the machine is NOT a TG-16, so... huh ? And it's not even a JSR, so it doesn't appear as though it could be setting anything up... just a dead-end.
2) This code actually doesn't *do* anything except check one bit on a piece of hardware. Unless, when they decided not to include the ROM, they also decided to reverse-sense that bit. But even then, why did the fall-through execute the actual game ? One would expect that "fail" should go into an infinite loop or something.
3) In any case, Gunboat and Klax used that code, but put NOPs in-between the branch and the NO_PROTECT label. So, no "NEC" string either, so no appearance of copyright. And no protection either.
Given the cost dynamics of Japanese versus American systems, they would have been trying to protect things so that American machines couldn't play the much-cheaper Japanese games, but the Japanese games had nothing in them to stop them from playing. I think somebody was simply taking too many drugs or something.
Dave
|
|
gilbot
Punkic Cyborg
Posts: 138
|
Post by gilbot on Feb 3, 2019 6:30:06 GMT
I remember reading somewhere(couldn't recall where, maybe wikipedia, so it could be just BS) that the region lock was done to prevent Japanese consoles to play US games as they were usually inferior in quality(censorship, cut content, etc.) to avoid Japanese players having a negative impression on the system.
At least they didn't care with CD games and imposed no region lock on them.
|
|
TailChao
Gun-headed
I Must Eat Muffin Gear.
Posts: 68
Fave PCE Game Overall: Bonk's Adventure
|
Post by TailChao on Feb 3, 2019 14:53:55 GMT
The code would definitely make sense if the TG16 had included a ROM at bank $90, say as part of a plan to include a built-in game that they could ship the system with ... and the same method of using copyrighted-code as protection is built into all PCE/TG16 CD games as part of the IPL boot code. As we know now, NEC USA never did build a BOOT ROM into the TG16, and they chose to use the reversed-data-bus on the HuCard to provide basic region-protection Huh, I never read through all of Hudson's documents - that scan is pretty interesting. I do agree with Dave that the check doesn't really make sense since it'd start executing whatever lived in Bank $90 on a Japanese console. Maybe there were plans to include this ROM in later revs of all the hardware. Big thing is that we don't know what the TurboGrafx Boot ROM (IC107) would have done since it was never included in the hardware. But its pinout is somewhat telling... IC107
_____ _____
VCC | 1 v 32 | VCC
OEn | 2 31 | R139 *
GND | 3 30 | GND
GND | 4 29 | GND
** IC108,18 | 5 2 28 | GND
** IC108,19 | 6 3 27 | IC108,17 **
** IC108,20 | 7 C 26 | IC108,16 **
** IC108,21 | 8 1 25 | GND
** IC108,22 | 9 0 24 | GND
A2 | 10 0 23 | GND
A1 | 11 0 22 | IC108,15 **
A0 | 12 E 21 | D7
D0 | 13 20 | D6
D1 | 14 19 | D5
D2 | 15 18 | D4
GND | 16 17 | D3
|___________|
* R139 isn't populated, so this is NC'd.
Looks like it was just supposed to be a pullup.
** IC108 isn't populated, so these are NC'd.The number of grounded address lines here only yields 1KB of space, assuming a 23C1000 compatible ROM was actually going to be installed there. So I'm somewhat convinced it'd just be an instruction screen like the Master System (bla bla "SOFTWARE ERROR"), possibly with a superior version of Snail Maze. |
|
|
|
Post by elmer on Feb 18, 2019 6:07:42 GMT
I did my own test to see where the region code is located in each of the HuCards, and confirmed that Dave's 10-byte sequence ONLY occurs in US-released TurboGrafx HuCards, and only once in those ROMs.
<edit> It's only a 6-byte sequence, as shown in the command lines.
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Aero Blasters (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Air Zonk (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Alien Crush (USA).pce"
==== 0x0000006f (0x00000060-0x00000080) ====
0x00000060: 4c27fa4c 41ef4ca2 ec7854a9 ff5301ad L'.L A.L. .xT. .S..
^-
0x00000070: 00102940 f00ca990 53044c00 40204e45 ..)@ .... S.L. @.NE
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Ballistix (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Battle Royale (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Blazing Lazers (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Bloody Wolf (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Bomberman '93 (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Bomberman (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Bonk III - Bonk's Big Adventure (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Bonk's Adventure (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Bonk's Revenge (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Boxyboy (USA).pce"
==== 0x000003cc (0x000003c0-0x000003e0) ====
0x000003c0: 1a53104c 00407854 a9ff5301 ad001029 .S.L .@xT ..S. ...)
^-
0x000003d0: 40f00ca9 9053044c 0040204e 45432078 @... .S.L .@.N EC.x
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Bravoman (USA).pce"
==== 0x00000fab (0x00000fa0-0x00000fc0) ====
0x00000fa0: d0ed68aa 607854a9 ff5301ad 00102940 ..h. `xT. .S.. ..)@
^-
0x00000fb0: f00ca990 53044c00 40204e45 4320eaea .... S.L. @.NE C...
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Bug Hunt.pce"
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Cadash (USA).pce"
==== 0x00000086 (0x00000080-0x00000090) ====
0x00000080: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Champions Forever Boxing (USA).pce"
==== 0x0000000a (0x00000000-0x00000010) ====
0x00000000: 78eaeaea 7854a9ff 5301ad00 102940f0 x... xT.. S... .)@.
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Chew Man Fu (USA).pce"
==== 0x00001caf (0x00001ca0-0x00001cc0) ====
0x00001ca0: 1e8dc328 a91a4c2f 837854a9 ff5301ad ...( ..L/ .xT. .S..
0x00001cb0: 00102940 f00ca990 53044c00 40204e45 ..)@ .... S.L. @.NE
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/China Warrior (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Cratermaze (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/A-C/Cyber Core (USA).pce"
==== 0x0000004d (0x00000040-0x00000060) ====
0x00000040: 2032303a 31360078 54a9ff53 01ad0010 .20: 16.x T..S ....
^-
0x00000050: 2940f00c a9905304 4c004020 4e454320 )@.. ..S. L.@. NEC.
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Darkwing Duck (USA).pce"
==== 0x0000004b (0x00000040-0x00000060) ====
0x00000040: 8d031440 407854a9 ff5301ad 00102940 ...@ @xT. .S.. ..)@
^-
0x00000050: f00ca990 53044c00 40204e45 4320d4d8 .... S.L. @.NE C...
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Davis Cup Tennis (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Dead Moon (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Deep Blue (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Devil's Crush - Naxat Pinball (USA).pce"
==== 0x0000000c (0x00000000-0x00000020) ====
0x00000000: 4c06e04c 79e17854 a9ff5301 ad001029 L..L y.xT ..S. ...)
^-
0x00000010: 40f00ca9 9053044c 0040204e 454320ea @... .S.L .@.N EC..
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Double Dungeons - W (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Dragon Spirit (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Dragon's Curse (USA).pce"
==== 0x00000158 (0x00000150-0x00000160) ====
0x00000150: 68407854 a9ff5301 ad001029 40f00ca9 h@xT ..S. ...) @...
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Drop.Off (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Dungeon Explorer (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Falcon (USA).pce"
==== 0x00000007 (0x00000000-0x00000010) ====
0x00000000: ea7854a9 ff5301ad 00102940 f00ca990 .xT. .S.. ..)@ ....
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Fantasy Zone (USA).pce"
==== 0x0000017c (0x00000170-0x00000190) ====
0x00000170: c269d969 00007854 a9ff5301 ad001029 .i.i ..xT ..S. ...)
^-
0x00000180: 40f00ca9 9053044c 0040204e 454320d4 @... .S.L .@.N EC..
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/D-F/Final Lap Twin (USA).pce"
==== 0x00000048 (0x00000040-0x00000050) ====
0x00000040: ade07854 a9ff5301 ad001029 40f00ca9 ..xT ..S. ...) @...
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/G-I/Galaga '90 (USA).pce"
==== 0x00000066 (0x00000060-0x00000070) ====
0x00000060: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/G-I/Gunboat (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ceaeaea xT.. S... .)@. ....
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/G-I/Hit the Ice - VHL the Official Video Hockey League (USA).pce"
==== 0x00000ca5 (0x00000ca0-0x00000cb0) ====
0x00000ca0: 54a9ff53 01ad0010 2940f00c a9905304 T..S .... )@.. ..S.
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/G-I/Impossamole (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/J.J. & Jeff (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/Jack Nicklaus' Turbo Golf (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/Jackie Chan's Action Kung Fu (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/Keith Courage in Alpha Zones (USA).pce"
==== 0x00000970 (0x00000970-0x00000980) ====
0x00000970: ad001029 40f00ca9 9053044c 0040204e ...) @... .S.L .@.N
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/King of Casino (USA).pce"
==== 0x00000009 (0x00000000-0x00000010) ====
0x00000000: eaeaea78 54a9ff53 01ad0010 2940f00c ...x T..S .... )@..
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/Klax (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/Legend of Hero Tonma (USA).pce"
==== 0x00001f06 (0x00001f00-0x00001f10) ====
0x00001f00: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/Legendary Axe II, The (USA).pce"
==== 0x0000000b (0x00000000-0x00000020) ====
0x00000000: 408d0314 407854a9 ff5301ad 00102940 @... @xT. .S.. ..)@
^-
0x00000010: f00ca990 53044c00 40204e45 4320ead4 .... S.L. @.NE C...
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/J-L/Legendary Axe, The (USA).pce"
==== 0x0000000b (0x00000000-0x00000020) ====
0x00000000: 409c0314 407854a9 ff5301ad 00102940 @... @xT. .S.. ..)@
^-
0x00000010: f00ca990 53044c00 40204e45 4320d478 .... S.L. @.NE C..x
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/Magical Chase (USA).pce"
==== 0x00000012 (0x00000010-0x00000020) ====
0x00000010: 5301ad00 102940f0 0ca99053 044c0040 S... .)@. ...S .L.@
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/Military Madness (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/Moto Roader (USA).pce"
==== 0x0000005d (0x00000050-0x00000070) ====
0x00000050: 39204e43 532e3e78 54a9ff53 01ad0010 9.NC S.>x T..S ....
^-
0x00000060: 2940f00c a9905304 4c004020 4e454320 )@.. ..S. L.@. NEC.
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/Neutopia (USA).pce"
==== 0x00000120 (0x00000120-0x00000130) ====
0x00000120: ad001029 40f00ca9 9053044c 0040204e ...) @... .S.L .@.N
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/Neutopia II (USA).pce"
==== 0x000000c0 (0x000000c0-0x000000d0) ====
0x000000c0: ad001029 40f00ca9 9053044c 0040204e ...) @... .S.L .@.N
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/New Adventure Island (USA).pce"
==== 0x00000463 (0x00000460-0x00000470) ====
0x00000460: ff5301ad 00102940 f00ca990 53044c00 .S.. ..)@ .... S.L.
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/Ninja Spirit (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/Order of the Griffon (USA).pce"
==== 0x00000391 (0x00000390-0x000003a0) ====
0x00000390: 01ad0010 2940f00c a9905304 4c004020 .... )@.. ..S. L.@.
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/M-O/Ordyne (USA).pce"
==== 0x00000077 (0x00000070-0x00000080) ====
0x00000070: 207854a9 ff5301ad 00102940 f00ca990 .xT. .S.. ..)@ ....
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/P-R/Pac-Land (USA).pce"
==== 0x00000047 (0x00000040-0x00000050) ====
0x00000040: 207854a9 ff5301ad 00102940 f00ca990 .xT. .S.. ..)@ ....
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/P-R/Panza Kick Boxing (USA).pce"
==== 0x00001894 (0x00001890-0x000018a0) ====
0x00001890: a9ff5301 ad001029 40f00ca9 9053044c ..S. ...) @... .S.L
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/P-R/Parasol Stars - The Story of Bubble Bobble III (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/P-R/Power Golf (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/P-R/Psychosis (USA).pce"
==== 0x0000197e (0x00001970-0x00001990) ====
0x00001970: d0034cfd 684c3ff9 7854a9ff 5301ad00 ..L. hL?. xT.. S...
^-
0x00001980: 102940f0 0ca99053 044c0040 204e4543 .)@. ...S .L.@ .NEC
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/P-R/R-Type (USA).pce"
==== 0x00000030 (0x00000030-0x00000040) ====
0x00000030: ad001029 40f00ca9 9053044c 0040204e ...) @... .S.L .@.N
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/P-R/Raiden (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Samurai-Ghost (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Shockman (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/SideArms - Hyper Dyne (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Silent Debuggers (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Sinistron (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Soldier Blade (USA).pce"
==== 0x0000003c (0x00000030-0x00000050) ====
0x00000030: 1f094085 48607854 a9ff5301 ad001029 ..@. H`xT ..S. ...)
^-
0x00000040: 40f00ca9 9053044c 0040204e 45432078 @... .S.L .@.N EC.x
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Somer Assault (USA).pce"
==== 0x00000469 (0x00000460-0x00000470) ====
0x00000460: 06070878 54a9ff53 01ad0010 2940f00c ...x T..S .... )@..
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Sonic Spike - World Championship Beach Volleyball (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Space Harrier (USA).pce"
==== 0x000001eb (0x000001e0-0x00000200) ====
0x000001e0: ad21b000 117854a9 ff5301ad 00102940 .!.. .xT. .S.. ..)@
^-
0x000001f0: f00ca990 53044c00 40204e45 4320ead4 .... S.L. @.NE C...
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Splatterhouse (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Super Star Soldier (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Super Volleyball (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Taito Chase H.Q. (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Takin' It to the Hoop (USA).pce"
==== 0x0000000b (0x00000000-0x00000020) ====
0x00000000: 409c0314 407854a9 ff5301ad 00102940 @... @xT. .S.. ..)@
^-
0x00000010: f00ca990 53044c00 40204e45 4320d478 .... S.L. @.NE C..x
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/TaleSpin (USA).pce"
==== 0x000007f1 (0x000007f0-0x00000800) ====
0x000007f0: 01ad0010 2940f00c a9905304 4c004020 .... )@.. ..S. L.@.
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Tiger Road (USA).pce"
==== 0x000007a9 (0x000007a0-0x000007b0) ====
0x000007a0: fa684078 54a9ff53 01ad0010 2940f00c .h@x T..S .... )@..
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Time Cruise (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Timeball (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Tricky Kick (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/Turrican (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/TV Sports Basketball (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/TV Sports Football (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/S-U/TV Sports Hockey (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/USA 2.0.pce"
==== 0x000000f9 (0x000000f0-0x00000100) ====
0x000000f0: 4cf4fd78 54a9ff53 01ad0010 2940f00c L..x T..S .... )@..
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/V-Z/Veigues - Tactical Gladiator (USA).pce"
==== 0x00000b1b (0x00000b10-0x00000b30) ====
0x00000b10: 022099e5 607854a9 ff5301ad 00102940 .... `xT. .S.. ..)@
^-
0x00000b20: f00ca990 53044c00 40204e45 4320d478 .... S.L. @.NE C..x
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/V-Z/Victory Run (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/V-Z/Vigilante (USA).pce"
==== 0x00000527 (0x00000520-0x00000530) ====
0x00000520: 607854a9 ff5301ad 00102940 f00ca990 `xT. .S.. ..)@ ....
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/V-Z/World Class Baseball (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/V-Z/World Court Tennis (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/V-Z/World Sports Competition (USA).pce"
==== 0x00000006 (0x00000000-0x00000010) ====
0x00000000: 7854a9ff 5301ad00 102940f0 0ca99053 xT.. S... .)@. ...S
^-
====
bgrep.exe -x AD00102940F0 "./ROMS/USA/V-Z/Yo, Bro (USA).pce"
==== 0x00000008 (0x00000000-0x00000010) ====
0x00000000: 00007854 a9ff5301 ad001029 40f00ca9 ..xT ..S. ...) @...
^-
|
|
|
|
Post by dshadoff on Feb 18, 2019 7:46:52 GMT
I'm not sure why you are searching for a 10-byte sequence; 6 bytes is sufficient (as I mentioned in the first post), and I had already checked all of the existing HuCards in both regions for this 6-byte sequence.
...But I noticed that the TurboEverdrive looks for a 19-byte sequence, and does the patching if it finds the more specific instance.
So I checked again - but this time, to see how many cards require patching, but would not be caught using the TurboEverdrive's sequence.
As it turns out, the only USA ROMs which don't have the full 19 bytes are:
Ghost Manor
Gunboat
Night Creatures
System Card
...And all of these basically didn't have a protection mechanism in place anyway.
|
|
|
|
Post by elmer on Feb 18, 2019 9:44:01 GMT
I'm not sure why you are searching for a 10-byte sequence; 6 bytes is sufficient (as I mentioned in the first post), and I had already checked all of the existing HuCards in both regions for this 6-byte sequence. That was a silly typo, yep, I was only checking for the 6-byte sequence (you can see that in the command-lines). What I was doing is to confirm your work, and to find out some extra information that you didn't specify ... I wanted to know where those region-checks are in the HuCards. They're all in the first bank (not surprising, but it's good to have that confirmed). It also shows that the tests are not in all 32 pages of the bank, so it opens-up the possibility of optimizing the search/removal. Now, I'm not going to claim that writing this was anything other than a total waste of time, but here's a piece of code to search/remove the region protection that is about 3x as fast as the code in the TED2. Absolutely pointless, since the TED2's code executes in less than 1/30s (175,000 cycles), and so isn't noticeable, but it was an interesting brain-tease to work on. <edit> Made the code shorter and more readable with only a small cost in cycles. ; ***************************************************************************
; ***************************************************************************
;
; patch_region - Search for and patch the TurboGrafx region test.
;
; Takes approx 62,000 cycles if the code is not found, less if it is.
;
patch_region: lda #$4F ; Map in TED2 512KB bank 4.
sta TED_BASE_ADDR + TED_REG_MAP
lda #$40 ; Select bank 0 of the HuCard
tam3 ; image in TED2 memory.
cly
lda #<(.page_numbers - 1) ; Initialize the list of
sta <__si + 0 ; pages in bank 0 to search.
lda #>(.page_numbers - 1)
sta <__si + 1
stz <__bp + 0 ; Search $6000..$7FFF.
.next_page: inc <__si + 0 ; Continue searching next
lda [__si] ; page.
sta <__bp + 1
bmi .finished
.find_start: lda [__bp],y ; Get the next byte to test.
.test_start: cmp #$AD ; 1st byte of region code?
beq .test_next
iny
bne .find_start
bra .next_page
.test_next: clx
.test_loop: iny ; No TurboGrafx region test
beq .next_page ; crosses a page, find next.
lda [__bp],y ; Check for the rest of the
cmp .sequence,x ; code sequence.
bne .test_start
inx
cpx #5
bne .test_loop
.patch: lda #$80 ; Patch in BRA instruction.
sta [__bp],y
.finished: rts
.sequence: db $00,$10,$29,$40,$F0
.page_numbers: db $60,$61,$63,$64,$65,$67,$69,$6B
db $6C,$6F,$78,$79,$7C,$7F,$FF
|
|
|
|
Post by dshadoff on Feb 18, 2019 15:26:39 GMT
Very interesting. Now I see why you were doing this.
|
|
|
|
Post by elmer on Feb 19, 2019 2:26:10 GMT
Very interesting. Now I see why you were doing this. Yes, I'm nearly ready to try loading and running a HuCard on my TED, so it's time to think of this stuff.  Anyway, the original code that I posted was *far* too convoluted, so I simplified it and made it much more readable, with only a small cost in additional cycles. I've updated my previous post with the new code. Assembly-language programmers might be interested to compare it with a slightly-cleaned-up version of the code that the TED2 uses ... ; ***************************************************************************
; ***************************************************************************
;
; ted2_patch_code -
;
; Takes approx 175,000 cycles if the code is not found, less if it is.
;
patch_slow: lda #$4F ; Map in TED2 512KB bank 4.
sta TED_BASE_ADDR + TED_REG_MAP
lda #$40 ; Select bank 0 of the HuCard
tam3 ; image in TED2 memory.
stz <__bp + 0 ; Search $6000..$7FFF.
lda #$60
sta <__bp + 1
.find_start: lda [__bp] ; 1st byte of region code?
cmp #$AD
beq .test_string
.find_next: inc <__bp + 0
bne .find_start
inc <__bp + 1
bpl .find_start
rts ; Stop search at $8000.
.test_string: ldy #$01 ; Check for the rest of the
.test_loop: lda [__bp],y ; code sequence.
cmp .sequence - 1,y
bne .find_next
iny
cpy #6
bne .test_loop
dey ; Patch in BRA instruction.
lda #$80
sta [__bp],y
rts
.sequence: db $00,$10,$29,$40,$F0
|
|
|
|
Post by dshadoff on Feb 19, 2019 5:33:04 GMT
Very interesting. Now I see why you were doing this. Yes, I'm nearly ready to try loading and running a HuCard on my TED, so it's time to think of this stuff. Anyway, the original code that I posted was *far* too convoluted, so I simplified it and made it much more readable, with only a small cost in additional cycles. I've updated my previous post with the new code. Assembly-language programmers might be interested to compare it with a slightly-cleaned-up version of the code that the TED2 uses ... If you're that far along, I should perhaps reconsider adding Tennokoe Bank functionality to the TED os.pce; it seems that your system would be *MUCH* easier to add it to (and I'll bet you've already thought about how you're going to do it). The disassembly is very hard to digest, and made worse by the fact that I can't just run it on a debugging emulator (too much isn't emulated). |
|
|
|
Post by elmer on Feb 21, 2019 21:46:07 GMT
If you're that far along, I should perhaps reconsider adding Tennokoe Bank functionality to the TED os.pce; it seems that your system would be *MUCH* easier to add it to (and I'll bet you've already thought about how you're going to do it). I wanted to wait until I got some more stuff working before responding, but sure, I'd be happy to work with you to add that functionality to a new TED OS. I am now able to load and run HuCard images, so I'm finally confident that there isn't anything weird that's going to bring the whole concept crashing down. It's still early-days, and there is no UI work done beyond simple debugging output, but it's time to start cleaning things up so that it can be shared. As for Tennokoe Bank functionality ... your disassembly shows that KRIKzz is enforcing a minimum cluster size of 8 sectors (i.e. 4KB). While generic file creation functions on FAT32 would be a nasty mess to write, it should be pretty easy to write something that would create a few single-cluster files (i.e. up to 4KB long) in a directory that you *know* is almost-empty ... like the "TBED" directory. The directory only contains 4 entries right now (including "." and ".."), so there's enough room in there to add another 8 files, say "BACKUP_0.SAV" ... "BACKUP_7.SAV", inside the first sector of the directory. It seems like you'd probably want to keep each file as 2KB-long in order to match the PCE's built-in Backup RAM, and to make it easy to copy and share the files. Is that the sort of system that you're thinking about? |
|
|
|
Post by ginoscope on Feb 21, 2019 22:31:15 GMT
Very interesting stuff guys and thanks for sharing all this. I do development for a living but my assembly is very basic but I can follow along with the code.
I like knowing the inner workings of the pc engine. Elmer are you thinking of an alternative os for the TE? Adding the Tennokoe bank would be such a great feature and it would make me update my TED v1 to the newer v2.
|
|
