158 replies to this topic

[jamesb99_1999]

Just posting back the old FF Epoch thread from early last year;

The Emulator Masterclass: Exercise 1, Epoch Emulation - Fruit Forums

In case anybody didn't read it.. Sort of helps explain where we are a bit better I think if you also look at their current thread on it...

[edwardb]

Not exactly Mr. Powell's finest hour then!

I think it was just the mindset of thinking a distributed processing system was right for what is quite a volatile environment when, with hindsight, it clearly wasn't. DPS are common in casino environments but there, people are highly trained and usually it's the actual engineers from the manufacturer who comes to repair them.

Had the lamp driver board and the power supplies not been so unreliable it would have been fine. They should have seen the problems from site within 6 months and just developed a single board unit, oh and a new PSU!

Scorpion 4 boards had problems with the lamp driver system, but BFG power supplies are bomb proof (made by Sanken).

[DialTone]

It strikes me that having a connector that *can* be mis-mated is the problem with regard to In/Out ribbons being swapped. Keying the plug is no good either as the keys often fall out!

As for the PSU, that's just unacceptable really - should have picked a better one imho.

You seem like you're "in the know" - Can you confirm that there are 4 PICs on the board - BOOT pic (presumably does memory sizing and reset and suchlike), RTC PIC (self-explanatory), ALPHA PIC (self-explanatory) and Security PIC?

Regarding the Security PIC on the board, is that accessible directly by the CPU (and if so, at what address, assuming you can/will share that info), or is it accessed by the ASIC only? Feel free to respond in PM if you prefer.

Cheers
DT

[edwardb]

There's not much I can tell you about the PICs.

Boot PIC (labelled "BOOT MICRO" on the main board is THE security PIC.

The PIC labelled "SECURITY MICRO" is the RTC (hence doesn't need to be fitted to work *normally* but it may lock-up if you try and access it when it's not there.

The PIC on the LDB is for the alpha only, I think. Lamp data is just processed by the ASIC, I assume.

As I said in previous posts, PICs changed on a seemingly random basis, depending on the developer (MML/IMP/EXTR/GLOBAL/MAB/etc) and for the market & sector, AND for the eprom size. So assuming a UK AWP you'd need to know the boot PIC revision (of which there were about 8). I can't give you any more info as to which machine had what because I just don't know!

All PIC related stuff was done by the guy who created the system, for obvious reasons.

[mart1711]

Like so many others i know little at all about the technology side but this is a great thread here!!! One things for sure sooner if not later epoch will be emulated if it isnt already. Every thing that can be cracked will be cracked. I remeber NOKIA (one of the biggest companies in the world not a uk based comparitively tiny fruit machine operation) boasting of their mobile phones being totally secure and unhackable with regards to sim locks. Of the last generation of nokia phones it was rumored something like £20 million was spent on this very security. It was then decoded and hacked by a 20yr old russian student working alone!!

[DialTone]

Interesting - thanks edward. Might have to buzz the board out to see how the Boot PIC is hooked up My guess though is that it's a red herring unless you're writing code to run on "real" hardware though...

DT

[edwardb]

Well the boot PIC would only be checked if you had actually defined the variable in your code, I didn't bother for ages during development until I thought oh I might as well use it as my game was for eastern Europe.

There, people copying machines is a problem for the industry. They will literally take out the glass, put it on a colour photocopier, and then copy all the wiring. If there is no copy protection in the software, you can suddenly find some 100s of fake machines on site. Not good when you're trying to run a business!

Barcrest had a massive problem with this in the 90s, as their MPU4 stuff would just get ripped off. Literally every new machine launched would be copied in about 3 months. In western countries also (e.g. Germany) - and they would send around squads of people with local police to seize fake machines and stick them in a car crusher. Squished machine, anyone?

[DialTone]

Fair enough My take on the whole copy protection thing is that there appear to be 2 camps here (3 if you include the "no protection") - One where the game itself is protected by reading either from a PIC or a GAL or whatever (Barcrest Characteriser etc) - The other where the machine hardware itself is protected in that the ASIC requires "magic numbers" to be sent to it (based on the ROM contents) otherwise it will continually reset the board (like IMPACT). Obviously the 2nd is no problem for emulation, but the first can be - will have to see how this affects EPOCH I suppose.

DT

[edwardb]

Fair enough My take on the whole copy protection thing is that there appear to be 2 camps here (3 if you include the "no protection") - One where the game itself is protected by reading either from a PIC or a GAL or whatever (Barcrest Characteriser etc) - The other where the machine hardware itself is protected in that the ASIC requires "magic numbers" to be sent to it (based on the ROM contents) otherwise it will continually reset the board (like IMPACT). Obviously the 2nd is no problem for emulation, but the first can be - will have to see how this affects EPOCH I suppose.

DT

Precisely. Scorp 4 has a hardware watchdog which has to be kicked every 1ms to stop the board resetting, as does IMPACT. Epoch has a combination of both.

[DialTone]

Sure, there's the watchdogs - most boards have those I believe. Some also have an "extra" watchdog for the lamp strobes. In the case of MPU4, failing to update the strobe quickly enough forces the 74LS138 (strobe line decoder, effectively) to be disabled, thereby turning off the lamps to prevent blown bulbs.

In the case of IMPACT, what I meant was that a sequence of 2 (4?) bytes need to be written directly to the ASIC in order to satisfy the "protection" element of the ASIC - without that, the ASIC will power-down. After that, a simple watchdog kick will suffice.

Anyway, the PIC shouldn't prove too much problem anyway - certainly having the protection on a separate IC leaves it vulnerable to a "man-in-the-middle" attack (i.e. datalogger/protocol analyzer or whatever). Failing that, an intrusive analysis can be made on the IC with Fuming Nitric Acid and MicroProbing for around $1000 (and let's face it, £500 isn't that expensive in the grand scheme of things). These "security" implementations might have been secure 20 years ago, but with today's technology they're virtually worthless.

Anyway, all kind of immaterial at this point I guess without a "working" emu. Dave Powell and his choice of obscure f*****g CPUs grrrrrr!

[edwardb]

Anyway, all kind of immaterial at this point I guess without a "working" emu. Dave Powell and his choice of obscure f*****g CPUs grrrrrr!

I never understood the liking of Hitachi chips. SP-Ace and Epoch both use em. Personally I'd just have used an obscure CPU which would have let me spend tons of someone else's money on lots of toys for the engineering department...

Oh wait...

;-)

[lincs1]

epoch tech gave so many faults with the power supplies that we just sold them all to global.

a bad fault for us was sometimes when the power supply went faulty it emptied the hopper when no one is playing it.

i totally agree with you on that baz the old vision cabinet machines like pink panther and monopoly (green glass) on the M1a's used to be a right swine for emptying when not been played


lincs1

[elcondor]

It's nice to see that there's work in place to try to get this CPU core sorted out for good. I have some details about memory mapping somewhere in my files, I'll try to dig them out and post them here if it helps with the emulation cause.

[roderz]

Personally I'd just have used an obscure CPU which would have let me spend tons of someone else's money on lots of toys for the engineering department...

Oh wait...

;-)

Ahh - I remember them days back at ACE coin!
Giant scalextric that took up most of the dev dpt !!!!!!

[Guitar]

That explains why Ace coin machines were utter shit then. Memory map would be handy if you have a near complete one elconder.

[roderz]

That explains why Ace coin machines were utter shit then.

Have to disagree, I'm talking about Play it again, etc etc (the ones with the band aid features)
They kept me in beer money for a few years ;-)

But on the other hand the late ace mc's were crap.

[jamesb99_1999]

Have to disagree, I'm talking about Play it again, etc etc (the ones with the band aid features)
They kept me in beer money for a few years ;-)

But on the other hand the late ace mc's were crap.

I thought many Ace's rocked to be honest... I loved most of them for the time... Classics...

[edwardb]

First machine I owned was a "Ghosttrapper" by ACE.

Pile of shit game, but very good to get in the back and see how it all worked.

Sadly, the guy who programmed it died suddenly a couple of years back, I used to work with him at Mazooma. Top bloke, too. He did Hyde & Streak, Aces High and Knock Out among others. Left behind a wife and kid, terrible shame, he was in his late 30s.

[roderz]

"he guy who programmed it died suddenly a couple of years back"

Just out of intrest who was it, i can't remember him, and yeh Ghosttrapper was toward the downward slope for ace.