158 replies to this topic

[edwardb]

"he guy who programmed it died suddenly a couple of years back"

Just out of intrest who was it, i can't remember him, and yeh Ghosttrapper was toward the downward slope for ace.

Andy Lewis.

[elcondor]

Here's what I found, in MAME format unfortunately:

AM_RANGE(0xfe0800, 0xfe09ff) lamps, 0x80 flash 0x40 dim
AM_RANGE(0xfe0a00, 0xfe0bff) led, 0x80 flash 0x40 dim
AM_RANGE(0xfe0c00, 0xfe0fff) INPUT
AM_RANGE(0xfe1000, 0xfe11ff) OUTPUT
AM_RANGE(0xfe1200, 0xfe120b) lamp timer
AM_RANGE(0xfe120c, 0xfe1210) led timer
AM_RANGE(0xfe1218, 0xfe1218)which lamp dim
AM_RANGE(0xfe1219, 0xfe1219) which led dim
AM_RANGE(0xffff14, 0xffff14) enable
AM_RANGE(0xffff15, 0xffff15) status

Hope this helps, I don't have anything else

[todd1970]

This is a very interesting debate about wether or not Epoch can be cracked..Although i havent got a scoob what you guys are going on about I hope to see it cracked one day.

There are a few good machines out there..Manic Miner..Hurricane..Pick yer Peso's..Beaver Las Vegas and such likes..so good luck with this project guys.

Oh another question while youse are feeling all technical..there are a few machines out there that i have no idea what they run on..Disco Inferno is one of them and Jail Break ?

Cheers guys

[DialTone]

Interesting memory map that elcondor - Any idea where that came from? I'm just puzzled as it seems close in places and way off in others. I don't have a "complete" map as yet, but I have something pretty comprehensive.

Unfortunately I'm not in a position to post what I have as that may jeopardize my information source, but if anyone gets as far as a running CPU (one without glaring bugs that is LOL) then I'd be happy to answer specific queries privately.

DT

[Guitar]

Have to disagree, I'm talking about Play it again, etc etc (the ones with the band aid features)
They kept me in beer money for a few years ;-)

But on the other hand the late ace mc's were crap.

Oh, fair point. I was thinking more along the lines of Cash raider. Thinking about it, isn't that just ACE, not ACE coin.

I retract that statement.

[prizeguy2005]

Todd jail break I believe is heber tech ( looks as if it is in the JPM cabinet) Disco Inferno is Scorpian 4 however it gives a reel error when loaded into the emulator, so looks like a non runner.

Re Epoch not building my hopes up but its great the people who certainly have the ability to code are pulling in the right direction offering relevant information, so good luck on this.

Hasnt (I read ftom a previous thread) someone designed a sound tool thing for epoch where you can play the sound samples? Would be cool listening to the audio on the Simpsons.

[spa]

Todd jail break I believe is heber tech ( looks as if it is in the JPM cabinet) Disco Inferno is Scorpian 4 however it gives a reel error when loaded into the emulator, so looks like a non runner.

Re Epoch not building my hopes up but its great the people who certainly have the ability to code are pulling in the right direction offering relevant information, so good luck on this.

Hasnt (I read ftom a previous thread) someone designed a sound tool thing for epoch where you can play the sound samples? Would be cool listening to the audio on the Simpsons.

/spa hands over a few simpson episodes... Knock yourself out

[prizeguy2005]

lol

the audio sample I like on the simpsons is the electric guitar noise (think thats what is) when you get feature entry 3 characters

one thing maygay machines did was produce excellant audio sets for machines

[Guitar]

Todd jail break I believe is heber tech ( looks as if it is in the JPM cabinet) Disco Inferno is Scorpian 4 however it gives a reel error when loaded into the emulator, so looks like a non runner.

Re Epoch not building my hopes up but its great the people who certainly have the ability to code are pulling in the right direction offering relevant information, so good luck on this.

Hasnt (I read ftom a previous thread) someone designed a sound tool thing for epoch where you can play the sound samples? Would be cool listening to the audio on the Simpsons.

Care to post the disco inferno roms? I had the same problem with Casino fruits 'n' suits. I had to play around with it to get it working, but it can be done.

[prizeguy2005]

Hi there are on the repro under repro stuff/ rom flood Mazooma

have full sound too!
also is Wet and Wild
Top Gear
Stir Crazy all give same error I believe

just loaded into emu when the game fires up the reels spin but the number reel just jerks and shudders then Reel 4 error 24 comes up

Regarding other machines as anyone looked at QPS Cashvania

loaded roms up appeared to work without error (also on repro) is a flyer on fruit emu) looks a decent game not already done

[elcondor]

Interesting memory map that elcondor - Any idea where that came from? I'm just puzzled as it seems close in places and way off in others. I don't have a "complete" map as yet, but I have something pretty comprehensive.

Unfortunately I'm not in a position to post what I have as that may jeopardize my information source, but if anyone gets as far as a running CPU (one without glaring bugs that is LOL) then I'd be happy to answer specific queries privately.

DT

Just from pottering around with the Simpsons ROM, I have no idea how much of that is cobblers, since a lot of it was educated guesswork, and trying to use Seven's core for the MAME debugger.

Could the map be game (or rather PIC) specific?

[CrAzYbAr]

Hi there are on the repro under repro stuff/ rom flood Mazooma

have full sound too!
also is Wet and Wild
Top Gear
Stir Crazy all give same error I believe

just loaded into emu when the game fires up the reels spin but the number reel just jerks and shudders then Reel 4 error 24 comes up

Regarding other machines as anyone looked at QPS Cashvania

loaded roms up appeared to work without error (also on repro) is a flyer on fruit emu) looks a decent game not already done

They wont work because they use a CardMech unit as opposed to a reel.

[g-man]

Failing that, an intrusive analysis can be made on the IC with Fuming Nitric Acid and MicroProbing for around $1000 ...

I haven't got too much of a clue what you're talking about,but it sounds bizarre and possibly dangerous!

[edwardb]

Hi there are on the repro under repro stuff/ rom flood Mazooma

have full sound too!
also is Wet and Wild
Top Gear
Stir Crazy all give same error I believe

just loaded into emu when the game fires up the reels spin but the number reel just jerks and shudders then Reel 4 error 24 comes up

Regarding other machines as anyone looked at QPS Cashvania

loaded roms up appeared to work without error (also on repro) is a flyer on fruit emu) looks a decent game not already done

Disco Inferno and all those games listed about have the CardMech, basically a stepper motor with cards attached. Let me know if you want any help with it, I've probably got the ramp tables somewhere!!

[russdx]

"MicroProbing for around $1000 ..."

alth gets this done for $50 lol

[elcondor]

I haven't got too much of a clue what you're talking about,but it sounds bizarre and possibly dangerous!

I'm fairly familiar with the concept, basically you drip a very small amount fuming nitric acid onto the top of the chip, and wash it away with distilled water, and repeat until you've eaten the package off the chip and exposed the die. You then use high resolution microscopy to take pictures of the chip, and painstakingly convert the images into the 0s and 1s that make the code.

Some call it decapping, and MAME's done a lot of it lately.

And yes, it is dangerous if you don't know what you're doing - I'm a research chemist, and I wouldn't fancy doing it

[DialTone]

Here's what I found, in MAME format unfortunately:

AM_RANGE(0xfe0800, 0xfe09ff) lamps, 0x80 flash 0x40 dim
AM_RANGE(0xfe0a00, 0xfe0bff) led, 0x80 flash 0x40 dim
AM_RANGE(0xfe0c00, 0xfe0fff) INPUT
AM_RANGE(0xfe1000, 0xfe11ff) OUTPUT
AM_RANGE(0xfe1200, 0xfe120b) lamp timer
AM_RANGE(0xfe120c, 0xfe1210) led timer
AM_RANGE(0xfe1218, 0xfe1218)which lamp dim
AM_RANGE(0xfe1219, 0xfe1219) which led dim
AM_RANGE(0xffff14, 0xffff14) enable
AM_RANGE(0xffff15, 0xffff15) status

Hope this helps, I don't have anything else

I was just a little puzzled how this information could be determined from inspecting the ROM alone ?!?

Anyway, the input array further sub-divides...

fe0c00 to fe0dff is the input mapping, but
fe0e00 to fe0fff is the input interrupt enable mapping

The outputs run from fe1000 to fe1fff (I suspect you have a mis-type there!)

The LED timers also are "short mapped" in your list - they actually run
fe120c to fe1217 - that's kinda self-evident as it mirrors the size of the lamp timers and also makes the map sequential.

The last thing you're missing from the sequential block is fe121a to fe121b which are the option switches.

You're right about ffff14 and ffff15, although the description is somewhat "vague" - enable and status for what exactly? But you're also missing some others... ffff10, ffff11, ffff12, ffff13 amongst others. The YMZ audio chip ought to "jump right out" at you too if you inspect the ROM.

Just seemed odd to me was all that you'd identified things that clearly *couldn't* have been determined by inspecting the ROM, and missed things that *would* have shown up... ~confused~

DT

[DialTone]

BTW, the fuming nitric acid thing - yes, largely correct, but the difference here is the "microprobing" - instead of reading the bits from images, you use microscopic probes to attach to the address/data lines *on-die* so you can read the memory regions directly without any concern for the security fuse.

You're dead right though, with a combination of microscopy and UV lasers, you can also read the contents of a GAL or PAL by imaging the die and then determining the logic configuration inside the device. Lovely

DT

[elcondor]

To tell the truth, it dropped into my inbox one day from someone following the masterclass who asked me to pass it on as a disassembly. I don't know if we share a 'source' or what .

As for the microprobing, I hear that if you're good enough, you can repair the security fuse on a protected chip, and read it conventionally, but that sounds like a job for a surgeon.

[elcondor]

To clarify the above, some of it is mine, some of it is not, but I cannot remember which is which anymore, as I never really took interest at the time.
Oh, and if you ask me, emulating Epoch is still too soon, I am only in it for the CPU core.