About me

My photo
Vanløse, Copenhagen, Denmark
Mathematician. Working programmer/system developer. Nerd. Married. Father of 3.

28.3.13

Taito Bubble Bobble Bootleg Repair Log & REDUX

About a month ago, my dear friend porchy made this post on his blog. Now it is 'common knowledge' in the arcade society, that bootlegs of Taitos Bubble Bobble doesn't play like the original. The reason why, is that the original board has a custom chip (know as the PS4...the one featuring a picture of Bub from the game on the silk screen) that shares the SRAM with the main CPU (a Z80). The PS4 is a 6800-based CPU also containing some memory in the form of ROM. Every now and then, the PS4 changes some bits and pieces in the SRAM, so that certain events occur in the game. The things that most people notice as wrong is enemy movements and that the sequence of the EXTEND-letters is not randomized.
The bootleggers back in the days, were not able to extract the program data from the PS4, so they tried to deduce the data by the use of a technique known as 'blackboxing'. You throw a lot of different input at the chip and then record the output. You then analyze both the input and output and try to make your own program do the same as the chip. They did that by exploiting some unused interrupt cycles of the main CPU to execute this PS4-emulation. However they didn't get it quite right.
But recently MAMEDev succeeded in reading the program from a PS4 by using a technique known as decapping. In short, you cut off the top of the IC, look at the silicon plate under a strong microscope, and manually read every single bit. This way they made it possible to make a perfect emulation of the original game in MAME.
Now this is where joaoljr, a brazilian member on the arcadeotaku forum, got the idea that it might be possible to make all those old bootlegs play correctly! He took the 6800 assembler-code extracted from the PS4 via decap, rewrote it to Z80 assembler, and excecuted it in the spare interrupt cycles of the main CPU just the like bootleggers back in he days. He calls the project REDUX, and you can read all about it in this thread.

Phew, that was a long intro...but when I had read all this, I started looking for a cheap bootleg, and soon found an untested one from a french seller on evilBay. From the auction photo, I made sure, that this was indeed a REDUX-able type of bootleg ie doesn't have an 68705 MCU.


The auction closed at 29.90EURO with a shipping price to Denmark of 13.90EURO; so all-in-all ~45EURO for an untested bootleg Bobble Bobble...sweet! };-P

When the board arrived, I did the usual visual inspection. It was obvious that this board had been made in a rush; some components had not been pressed correctly into the holes, before the board went into the flowsoldering machine (this is the worst example)


However all the pins made fine contact, so if I could get it up and running, I didn't bother. Also some rather ugly mod/repairs had been done on the secondary board



But again, if I could make it work, why bother. One thing about this board looked extremely strange though


Notice that the two ribbon connectors doesn't match up. Also notice that both the upper and lower PCB has the parts side facing up. This is very rare on arcade boards, as they are usually back-to-back/front-to-front. I tried to check for contact between GND on the edge connector and GND on an IC on the secondary PCB with my multimeter and found none. Hmmm, this started to smell bad };-S I removed the legs and flipped the secondary board 180 degrees so the PCB was now back-to-back, and viola


suddenly the two ribbon connectors matched up. And I checked for connection between GND on the two PCBs, I got a fine beep };-P Now I was extremely happy, that the seller didn't test this board, as the consequences could have been disastrous. My only hope was, that he was telling the truth.
Next, I started dumping all the ROMs on the board, but when I got to the one labeled "2", I found this


and ofcause I was unable to read it in the Top. Now it is actually possible to transplant pins from an old IC, if there is just a tiny bit of the pin left, so I tried doing that


and was now able to read it in the Top. All the ROMs validated against MAME };-P Next step, was to actually test the board. I found the pinout at mikesarcade.com and threw together a QAD adaptor with only power, video, and sound.


The board booted up just fine


however the colours looked a bit strange. Either the pinout I had found was wrong, or this was a unique type, where blue and red crossed. I switched the two wires, and got this


Perfect colours and the sound was fine too. Quickly I hooked up the rest of the wires


and was able to play a test game...both 1P and 2P worked perfectly...sweeeet! };-P

Now for the REDUX-part. I downloaded the package with the prepatched ROMs (linked from the thread), and programmed them onto 3 27C256 EPROMs. Slammed them into the board (I have to make some nice custom stickers };-P),


and fired her up



Meesa liiiike dat!!! Haven't played it to the end yet, but it seems to play just flawlessly };-P REDUX FTW!!! A special thnx to joaoljr for the big effort.

27.3.13

Capcom 1942 Repair Log

I found this cheap 'untested' original 1942 on evilBay a looooong time ago. Untested usually means tested but defective, but with the 'alternative description', sellers think that they can get more for their defective boards. This was actually one of first 5 boards I ever bought, and I was still young and innocent. So I was full of hope, when I connected the board for the first time. However, all that showed on the screen, was this static screen full of sprites


This was long before I even started doing reps, so the game was just put on shelf with the optimistic thought, that I might be able to fix it some time in the future.

At some point I snapped up another cheap original 1942; this one was working. So I tried swapping the secondary boards on the two and saw, that the working one with the secondary board from the defective, booted to this screen and was working fine.


...the other combo resulted in the same screen as before. So the static screen had to be caused by the primary board. So far so good.

Now about a year ago, I felt I had the courage to take a real look at this board. During the initial visual inspection, I quickly found this


This, the brown patches at each side of the edge connector, looked very much like the result of a major short circuit or some other type of overload. Also a cap was missing in the sound section, so a new one was fitted (easy, as the schematics can be found at porchys site jammacade.net)


Other than that, both PCB's looked quite sober and well. Next step was to dump the ROMs on the primary PCB, thereby also reseating them. However, when I got to the 5 ROMs SR03-SR07 I got either this


or this


Both cases meant that the ROMs were knackered...ALL 5 of them?!...you don't see that very often. So found the MAME ROM-set and programmed and fitted 5 new ones. Well actually I couldn't find any 27C128 in the scrap pile, so I used 5 27C256 instead. This is done quite easily: You make a ROM-image twice as big, by putting 2 copies of the original image after each other (in a Windows environment this can be done with the copy-command (with the /b option and '+' between the 2 source files) from cmd.exe; on nix-systems you can use the cat-command and pipe the result into a new file). That way it doesn't matter if the most significant address bit is high or low (or floats for that matter), because the same data resides in both the upper and lower part of the ROM; effectively making a 27C256 act as a 27C128.


I still had the static screen though. So next I checked the control signals on the main CPU: Clock, reset, halt etc. They all looked fine, but there was no activity on the main address bus neither the main data bus. This can often be caused by bad work RAM


so I desoldered them both to test them in the Top. They were both fried, so fitted sockets and found 2 replacements from the scrap pile


However it didn't change a thing on the screen, neither on silent buses. This was as far I got at that time, so back on the shelf it went.

A couple of weeks ago, I decided to pick this board up again. I had recently acquired my Fluke9010A, and this would be a perfect chance to use it };-P So started by desoldering the main CPU


and fitted a socket; notice that I don't use machined pin header strips, as the Fluke works better with standard sockets.


Next, let's power up that beast };-P


Now the first thing to do, is always the BUS TEST to see if any lines are stuck, floating, or tied together


I turned off the power and checked for direct connection between GND and data pin 3, but found none. So this was likely either a broken TTL, or the short might be on the other side of a mux, latch etc. Did a read-up on the schematics and found, that the first component on the databus after the CPU itself, was the 374 closest to the CPU. So desoldered it to test it in the Top, and was not surprised to see that the verdict was BAD!!!


So a socket was fitted and a replacement sourced from a scrap board.


Connected the Fluke again and ran the BUS TEST again. This time I got


Again consulting the schematics, I found that the next component on the databus was this 245 just beside the program-ROMs.


I had a tube of NOS 245's, so tried piggybacking one on top of the suspect


and now got the following result from the BUS TEST


...a clear indication, that something was rotten (in the State of Denmark };-P). So desoldered and tested it...once again a BAD!!! So a socket was fitted and the 245 from the tube installed.


(Yes I do know, that the 367 just beside it is now also socketed; I was a bit tired at the time and accidentally desoldered the wrong IC };-D When off-board anyway, I tested it in the Top, and it tested OK.) Now I finally got


With shaky hands I prepared the "RUN UUT"-function,


pressed the 'YES'-button, aaaand


It's aliiiive };-P Even though the start screen was olive green and not black, the attractmode played fine with no colour issues. Coined up the game and hit the start-button. Right upon start-up, the plane flew all the way to the right, but beside that, the controls worked fine. Turned the board off again, removed the Fluke-pod and reinstalled the original Z80.


Hmmm, could seem like the main CPU was toasted as well. Found an original Zilog from a scrap-board, installed it, and the board now worked just like when the Fluke was running it.
I decided to address the control issue first. By using the continuity tester, I traced the 'RIGHT'-pad on the edge connector back to this 367 at A4


As all these 3 367's are already socketed, it was an easy task to test it in the Top. It tested BAD!!! and a working one from scrap was installed.


Now the controls were perfect, so I had to address the olive green start screen. So far, I had only been concentrating my attention on the main PCB; now I turned to the secondary one, as this handles the graphics. As usual I did visual inspection, but found it in good shape. Next I started dumping the ROMs. But when I got to SR13, the Top reported unconnected pins...


So I sourced (scrap), erased, and programmed a new one with the image from the MAME ROM-set, and presto:


black background on the start screen restored };-P

Last but not least, I borrowed some of my wife's coloured crea-tape and made some lovely looking new stickers for the newly programmed ROMs (note to self: buy heart shaped stickers for future reps };-P)


As I have mentioned before, I can't stand the sorry excuse for music in this game, and I don't think much of the gameplay...so I will try to trade this board for some more defective ones };-P

3.3.13

Capcom Three Wonders Repair Log

This board was sent to me by my dear friend Alf81. When turned on, all you got was a black screen and something that sounded like a burp from the speakers. As this game runs on CPS1 hardware, the thesis was, that it had committed suicide. But what does that actually mean?
Well, by the end of the Golden Age (mid 70's to mid 80's), the arcade manufacturers discovered, that if they made the games so durable that they lasted too long, the arcade owners would not buy new games. They then came up the idea to install a mechanism into the games, that would render them useless after some time. And even unrepairable by 3rd party arcade reppers. This is what is known as a suicide mechanism, but in fact the name is a bit miss leading, as it implies an active action; in fact it's kind of like the opposite:
(EDIT: Womble (RCM, AussieArcade, etc.) pointed out in a comment, that I'm on the wrong track with this theory. As he has far more experience than me, and as his explanation sounds more plausible, I think he's right. You can read it here.)
The principle is almost the same for all flavours. You take a part of the game code (usually vital for the game to run, but early examples also includes only the sound system ie Shinobi) and encrypt it before putting it onto the ROMs. Then you put the decryption key into a small block of RAM hidden inside some custom chip and add a battery on the board to keep the piece of RAM alive even when the game is turned off. At some point, the battery will run out of power, and the RAM will loose the decryption key forever. The game can no longer read it's own game code and is unplayable, and as the decryption key is gone, the game can't be 'fixed' by anyone else but the manufacture (at a high price).

Cosmetically the board seemed to be in good shape.


so right away I had a look at the usual suspect, the battery. On CPS1 systems, the battery as well as the custom chip containing the RAM for the decryption key, is placed on the little sub board called the C-board


So I tried putting a voltmeter on the poor thing and got this


This battery was surely stone dead! So what can you do? Well, when I said before, that suicided games was not fixable by any 3rd party repper, that was not entirely true. Cause here in modern times, ultracool software/hardware hackers (not me) have found ways to pre-decrypt the code so that it will fit on the ROMs. It is then possible to put the custom chip into it's non-decryption mode, and it will be able to read the (now) decrypted ROMs. The game will rise from the dead.
The #1 place to get these pre-decrypted ROM images is at The Dead Battery Society. Here you will also find instructions on how the make the appropriate hardware modifications to your dead game. I this case (CPS1), you have to first remove the battery, as it will not be needed anymore.


Then break the connection on two adjacent grounded pins on the custom chip and set them high instead. I'm not that good at SMD's, but with a little help from liquid flux, I managed to pull it through };-P


Next step was to update the ROMs. First I dumped the ROMs already on the board to find out what version it was


From this it was obvious, that this was a 'World' version. However, at present time, decrypted ROMs (30, 31, 35, 36) only exsists for the US version. So in order to make it work, I would have to replace the other region specific ROMs (29, 34) as well. As I don't like erasing the original ROMs of a game before I know that my rep works, I went hunting for 27C010's in the scrap pile, and started the cumbersome task of cleaning windows and UV-erasing the EPROMs. But after a couple of cycles, I had 6 working ICs


Next we program them,


slam them into the board,


and try it out



It's Alive! It's ALIIIIIIVE!!! MUAHAHAHAHA!};-P
Please notice though, that the select screen is a bit blue-ish. This is apparently a known issue with this game. However it does look a bit art. But the game-play is absolutely perfect.
As a last thing, I moved the old stickers over to the new ROMs,


and the game is ready to be sent back to it's rightful owner };-P

UPDATE:
My dear friend Charter McCloskey aka Alf81 has sent me these nice photos of him unpacking the game, turning the screen in his Egret, the game running, and a photo of him self showing just how pleased he is to be able to play his 3Wonders again };-P