I could put in many, ways, but the simpliest one is to see the video below:
http://www.youtube.com/watch?v=kihjG2gjDQE&feature=youtu.be
The Isos should be floating around before the end of the month.
Thursday, February 21, 2013
Tuesday, February 19, 2013
Hacking from Dammam
Unfortunately I'm on a business trip and couldn't bring with me the real thing.
I identified together with Joerg Hartenberger, a new set of interrupts not emulated by MAME that happen in the real thing. This is most probably where the error is coming from.
Bottom line, as soon as I can grab my setup back home, I'll test it on the real thing and I'm quite confident it's going to work. If that's the case, before the end of the month all tables for all games can be released...
Stay tuned.
I identified together with Joerg Hartenberger, a new set of interrupts not emulated by MAME that happen in the real thing. This is most probably where the error is coming from.
Bottom line, as soon as I can grab my setup back home, I'll test it on the real thing and I'm quite confident it's going to work. If that's the case, before the end of the month all tables for all games can be released...
Stay tuned.
Sunday, February 10, 2013
The Hartenberger effect
Looking at the title, you may thing I'm talking about a film about secret weapons in the second world war, but no.
I've been regularly discussing with Joerg Hartenberger, a Mame expert and creator of the site: http://www.arcademodbios.com/ with lots of interesting hacks that has been very supportive and has given me many ideas, so I wanted to make sure his support was recognised.
The status of the tables for the tool is the following:
As I mentioned before, I'm able to create an ISO that will change any system with battery free SFIII-2 to any other game and that works great on MAME....but not on the real thing.
In order to locate where the problem was I've been working the last weeks in an interesting approach, which is the following:
I create a hacked version of a game and after updating the SIMMs it will run code from the game ONLY until instruction X where I force it to JUMP to the BIOS to show something on the screen (the Game Update menu for instance). If we can see the BIOS code, it means that my hacked version was able to run code until adress X, so I will go further some more thousands of instruccions and check again with a new CD if the hacked version is able to arrive now to address Y. If it doesn't then I have to look for a new address Z somewhere between X and Y.
This might sound like something that can be sorted out with 2-3 tries, but the reality is that after 20 tries (and 20 CDs burnt) I have managed to narrow it down to only 4000 instructions executed.
This is now much easier to read and handle (vs a 500Mb file created with an execution dump). You can get an idea of the process by starting mame in debugging mode ( -debug )and type in any moment the command "trace", the game will run about 20-30 times slower than usual and will generate a file of hundreds of Mb.
I'm analysing the code and I hope to have some conclusions soon, but as I travel very frequently it might still take some weeks as I can't take my MAK and CPS3 real board with me :((.
Stay tuned for more :)
I've been regularly discussing with Joerg Hartenberger, a Mame expert and creator of the site: http://www.arcademodbios.com/ with lots of interesting hacks that has been very supportive and has given me many ideas, so I wanted to make sure his support was recognised.
The status of the tables for the tool is the following:
As I mentioned before, I'm able to create an ISO that will change any system with battery free SFIII-2 to any other game and that works great on MAME....but not on the real thing.
In order to locate where the problem was I've been working the last weeks in an interesting approach, which is the following:
I create a hacked version of a game and after updating the SIMMs it will run code from the game ONLY until instruction X where I force it to JUMP to the BIOS to show something on the screen (the Game Update menu for instance). If we can see the BIOS code, it means that my hacked version was able to run code until adress X, so I will go further some more thousands of instruccions and check again with a new CD if the hacked version is able to arrive now to address Y. If it doesn't then I have to look for a new address Z somewhere between X and Y.
This might sound like something that can be sorted out with 2-3 tries, but the reality is that after 20 tries (and 20 CDs burnt) I have managed to narrow it down to only 4000 instructions executed.
This is now much easier to read and handle (vs a 500Mb file created with an execution dump). You can get an idea of the process by starting mame in debugging mode ( -debug )and type in any moment the command "trace", the game will run about 20-30 times slower than usual and will generate a file of hundreds of Mb.
I'm analysing the code and I hope to have some conclusions soon, but as I travel very frequently it might still take some weeks as I can't take my MAK and CPS3 real board with me :((.
Stay tuned for more :)
Wednesday, December 12, 2012
CPS3 converting tool v0.4
Hello,
I'm releasing the newest version of the tool so everyone can already have it. Don't get too excited, it doesn't contain any tables yet.
I have ready the SF3-NG table that works great on MAME but for some reason not in the real thing. As soon as I sort this out, I'll release it.
Stay tuned for more.
http://netload.in/dateiiXLtCUuBJv/cps3_iso_converter_v0.4.rar.htm
I'm releasing the newest version of the tool so everyone can already have it. Don't get too excited, it doesn't contain any tables yet.
I have ready the SF3-NG table that works great on MAME but for some reason not in the real thing. As soon as I sort this out, I'll release it.
Stay tuned for more.
http://netload.in/dateiiXLtCUuBJv/cps3_iso_converter_v0.4.rar.htm
Monday, December 3, 2012
Going public
Due to the request from some followers, I'm publishing the link to the special version of ElSemi CPS3 Emulator.
Everyone who'd like to contribute or that would like to see speed up the convertion process of his/her favourite game is welcome.
Just download this special version of the emulator: http://netload.in/datei37DARnQNE7/cps3.rar.htm
put your favourite romset and...play!
What you have to do is very simple, jut start the game you want and start playing, play it to the end with P1, then with P2 (you can change settings in the bios), then start a game with P1, then in half combat join P2, wait for time to finish, make so many combos as you can, etc. The idea is to execute so much code as possible. so then my robot can trace it.
If you play for let's say 1 hour and you need to do something else, you can let the emulator running. If you quit the emulator a file called "codeacces.bin" will be created. Good news is that when you start the emulator later, it reads the existing codeaccess.bin file and continues modifying it.
VERY IMPORTANT! BAD NEWS is that you can't start another game with the same codeaccess.bin. If you for example, played in total 3 hours of SF3-NG and then start another game even 5 seconds, the resulting table is compeltely messed and useless, so if you want to play another game, you need to rename the codeacces.bin table to something else like: codeacces-sf3ng.bin
Please don't send a table unless you are 100% sure that it's not mixed with another game. Even different versions of a game will corrupt it, so if you play i.e. SF3-NG 970204 then stick to 970204.
When you think you are done, please send the codeacces.bin file to pablofg_ [_at] hotmail.com
Stay tuned for more.
Everyone who'd like to contribute or that would like to see speed up the convertion process of his/her favourite game is welcome.
Just download this special version of the emulator: http://netload.in/datei37DARnQNE7/cps3.rar.htm
put your favourite romset and...play!
What you have to do is very simple, jut start the game you want and start playing, play it to the end with P1, then with P2 (you can change settings in the bios), then start a game with P1, then in half combat join P2, wait for time to finish, make so many combos as you can, etc. The idea is to execute so much code as possible. so then my robot can trace it.
If you play for let's say 1 hour and you need to do something else, you can let the emulator running. If you quit the emulator a file called "codeacces.bin" will be created. Good news is that when you start the emulator later, it reads the existing codeaccess.bin file and continues modifying it.
VERY IMPORTANT! BAD NEWS is that you can't start another game with the same codeaccess.bin. If you for example, played in total 3 hours of SF3-NG and then start another game even 5 seconds, the resulting table is compeltely messed and useless, so if you want to play another game, you need to rename the codeacces.bin table to something else like: codeacces-sf3ng.bin
Please don't send a table unless you are 100% sure that it's not mixed with another game. Even different versions of a game will corrupt it, so if you play i.e. SF3-NG 970204 then stick to 970204.
When you think you are done, please send the codeacces.bin file to pablofg_ [_at] hotmail.com
Stay tuned for more.
Saturday, December 1, 2012
Help with the tables and latest update
I have ready a table version for SF3NG that should work on a SF3-2I. It works great on MAME but for some reason when I test it on the real thing it doesn't work. Nothing...just black screen.
I see two options, either the BIOS is checking something that needs to be patched or there is some code in the game, that is not marked as code in the decryption table, and that MAME doesn't execute, BUT the real hardware does.
While I try to find a solution for this. I'm asking for the support of the donnors to help creating very accurate tables.
They will get a special version of the emulator of ElSemi that will create the table as you play, make combos, enter in different menus,etc.
more news soon.
I see two options, either the BIOS is checking something that needs to be patched or there is some code in the game, that is not marked as code in the decryption table, and that MAME doesn't execute, BUT the real hardware does.
While I try to find a solution for this. I'm asking for the support of the donnors to help creating very accurate tables.
They will get a special version of the emulator of ElSemi that will create the table as you play, make combos, enter in different menus,etc.
more news soon.
Thursday, November 8, 2012
Update on the tables
As I said in previous posts, the tool is ready and ready to be released anytime, the big problem are the tables that are needed and that tell the CPS3 Tool what is code and what is data.
I have choosen a very tiny format for the table. The range of memory to which the table refers goes from 0x06000000 to 0x06ffffff. that means a range of address of 16Mb. One efficient way to do it, is by creating a table of 2Mb in which each bit, represents if a byte is code (1) or data (0).
As I know that in the SH2 instructions are executed in pairs of 2 bytes, I've splited the table on half and now each bit, means if two bytes are data or code, what leaves with a table of 1Mb.
Moreover, I've found that in SF3-NG the range of code goes from 0 to 0x3d0000 what means that a table of 250k would be enough. I haven't analysed in detail any other game yet, so I won't squeeze the table before being sure that it works.
Regarding the bot, I've decided to use a combined effor, creating 4 different 'tiny' programs.
The first one, will take a several Gigs file generated with MAME's commmand 'trace' and will update the table.
I have created several of these files so I have to make several passes.
Playing a game, when the trace command is on, is almost impossible, luckily I have the Special version of ElSemi (thanks mate).
The second version of the tool will update an existing table with the table that generate the program of ElSemi. Again several passes are needed as I have several tables generated
The third tool is the robot, which will basically analyze the code of the game and will look for all conditional branches (BF, BFS, BT, BTS) and if "we are over one instruccion that it's code" and "the destination branch is not marked as code" then we launch a exploring subroutine that will explore this specific branch.
As you will understand when you are inside a branch, you have to check instruction by instruction until you find something that will stop the lineal execution, which basically means a jmp, a subrutine, a BT, a BF, a RTE, etc. This has a small inconvenient, because the robot sometimes can't determine i.e. the address to which 'JMP R14' is pointing to, so several JMPs, BSRs, JSRs,etc. have to be manually checked with the MAME debugger.
Evern with all that I only got like 70% of the code validated. so I generated a 4th tool that will look through all the memory and will look for all the addresses marked as data that point to any adrress in the range of 06000000-063d0000. At this moment this means 2500 branches that I have to analyze by hand (looking at the dissasembled code) and if they are really code, then include them in a file called "manual.txt" that will use the robot of the 3rd tool to manually analyze those areas.
I hope you all understand the lack of updates due to the long process that this takes. Luckily now I seem to have a procedure and the right tools.
I'll try to get several tables ready before christmas as a present you all CPS3 lovers.
Expect more news soon.
I have choosen a very tiny format for the table. The range of memory to which the table refers goes from 0x06000000 to 0x06ffffff. that means a range of address of 16Mb. One efficient way to do it, is by creating a table of 2Mb in which each bit, represents if a byte is code (1) or data (0).
As I know that in the SH2 instructions are executed in pairs of 2 bytes, I've splited the table on half and now each bit, means if two bytes are data or code, what leaves with a table of 1Mb.
Moreover, I've found that in SF3-NG the range of code goes from 0 to 0x3d0000 what means that a table of 250k would be enough. I haven't analysed in detail any other game yet, so I won't squeeze the table before being sure that it works.
Regarding the bot, I've decided to use a combined effor, creating 4 different 'tiny' programs.
The first one, will take a several Gigs file generated with MAME's commmand 'trace' and will update the table.
I have created several of these files so I have to make several passes.
Playing a game, when the trace command is on, is almost impossible, luckily I have the Special version of ElSemi (thanks mate).
The second version of the tool will update an existing table with the table that generate the program of ElSemi. Again several passes are needed as I have several tables generated
The third tool is the robot, which will basically analyze the code of the game and will look for all conditional branches (BF, BFS, BT, BTS) and if "we are over one instruccion that it's code" and "the destination branch is not marked as code" then we launch a exploring subroutine that will explore this specific branch.
As you will understand when you are inside a branch, you have to check instruction by instruction until you find something that will stop the lineal execution, which basically means a jmp, a subrutine, a BT, a BF, a RTE, etc. This has a small inconvenient, because the robot sometimes can't determine i.e. the address to which 'JMP R14' is pointing to, so several JMPs, BSRs, JSRs,etc. have to be manually checked with the MAME debugger.
Evern with all that I only got like 70% of the code validated. so I generated a 4th tool that will look through all the memory and will look for all the addresses marked as data that point to any adrress in the range of 06000000-063d0000. At this moment this means 2500 branches that I have to analyze by hand (looking at the dissasembled code) and if they are really code, then include them in a file called "manual.txt" that will use the robot of the 3rd tool to manually analyze those areas.
I hope you all understand the lack of updates due to the long process that this takes. Luckily now I seem to have a procedure and the right tools.
I'll try to get several tables ready before christmas as a present you all CPS3 lovers.
Expect more news soon.
Subscribe to:
Posts (Atom)