Freitag, 9. Juni 2017

Preservation, Emulation and Flashcarts


Most of you will know the TOMY PYUUTA or TUTOR console. Released in 1982, it had a 16bit CPU and was way above the standards at it's time.


2015 and 2016 we were at a hunt to get the remaining undumped cartridges for this system. Most japanese cart's were undumped at that time and after a hugh amount of invested money, we could aquire all missing games for dumping.

the big problem was, that the cartridges and the console itself are very RARE and you have to pay high prices for some games. Cartridges get sold for 50EUR to 150EUR each. You mostly don't have the time to think about it twice and directly have to buy the rare cartridges if you see some of it popping up in various auctions-plattforms...

At the end, we got all officially released cartridges dumped! Currently only 2 DEMO cartridges (US and JP) are undumped.

Emulation in MAME was nearly completed and only had to get some small modifications, so that the 32kb games could be played!





The Tutor/Pyuuta got about 30 unique game-releases. There are three 3D games (with 32kb), 5 games with 16kb and all others only using 8kb.

After we had a complete dumped collection of all the games, i was thinking about a Flashcart...
I contacted Brizzo, and about 2 weeks later he had designed a Flashcart.



left: Rev1    right: Rev1+Modifcation

Revision 1 of the cartridge has 512kb space and you can play all available 8kb games with it. You can select the games by dipswitch.

I made a One-Wire-Modification to the flashcart and now you can play all available 8kb and 16kb games with it.




the cartridge/game is recognized
The nice thing is, that this flashcart costs maybe half the price of the cheapest Tutor/Pyuuta cartridge and you can play nearly 90% of all available games with it. All you need is the cartridge and the DIP-Switch-List (see below) and you can enjoy 28 games on your console!
Game running
Gamelist + DIP-Switch Settings




To get the remaining three 3D games working will be more tricky, as the Tutor/Pyuuta console needs a special GAME ADAPTOR to play these. The consoles don't have enough addresslines for 32kb cartridges, so my next goal is a special flashcart which has this GAME ADAPTOR (which is rare as hell too) included and fits directly into the I/O Port of the console.

this just show's what's the main three goals about dumping the games!

Preservation: available cartridges are becoming less and less. So a digital copy of the content is a must have!
Emulation: people all around the world can enjoy or view the games/programs, even without having the original device!
Flashcarts: What would you do with an hardware-device, when you don't get games for it anymore, or when the available games are damn expensive. So flashcarts keep the original hardware useful!

Samstag, 27. Mai 2017

V.Smile - emulation needed!

i got interested about the V.Smile again some weeks ago and quickly bought 4 new/undumped games for it!

- 52-092004 - Abenteuer im ABC Park (GER)
 

- 52-092422 - Finding Nemo - De Wonderwereld Van Nemo (NL)


. 52-092862 - Shrek De Derde - Arthurs Schooldag Avontuur (NL)
 - 52-092942 - Mickey Mouse Clubhouse (NL)
 


The current emulation-status of the V.Smile is most likely only luck...some games boot in MAME, some only give a black screen. Sound and Controls are not emulated.
As i'm pretty sure the booting games would be playable, if controls would work...i contacted BeckieRGB about it! She did some investigations and found it! "It's a 4800 bps 8N1 serial protocol with some control lines."
This will hopefully bring us working controls in the next few weeks!

As there are alot of questions about the CPU and SOUND, i contacted Sean if he can buy a console and decap the CPU from it!

He bought a "V.Smile" and a "V.Smile Baby" and decapped the CPU's from it!

V.Smile - Sunplus QU7073-P69A
https://commons.wikimedia.org/wiki/File:Sunplus_qu7073-p69a.jpg



V.Smile Baby - OL8139C or QL8139C 


https://commons.wikimedia.org/wiki/File:Sunplusol8139c.jpg


Sean also dumped the US-Bios of the V.Smile too!

I really hope more devs get interested at the current V.Smile MAME-driver and we get some games to a "working" state.

Freitag, 7. April 2017

Epoxy Block, a good Protection in the 80's, not so good today!

Brian sent me two epoxy blocks from two Dodge City boards. Merit covered the CPU, a PAL and an 2816 eeprom inside an epoxy block. Mainly for protection reasons!
I have already seen this kind of protection quiet a lot of times on different gambling pcb's. Video Klein for example used this on basically every board they made.

The Merit games have some code inside the 2816 eeprom, so a dump of it is needed to get the games running! MAME has already three different revisions of Dodge City included, but all are missing the 2816 dump, so none of it is playable!

remove the epoxy to get to the chips, now!


heatgun, flat screwdriver and the 2 epoxy blocks


one Epoxy Block

use the heatgun to heat the epoxy to about 330° and you can brake it away with your screwdriver. this was done within 10 minutes

removed epoxy pieces

some minutes later, the 2816 and the PAL are desoldered and  can now get dumped

same procedure on the second epoxy block, as i now knew where the interesting chips are located, i only removed the epoxy at this area.


So it was possible to brake this protection for two games within 60 minutes. The good thing, it looks like these two blocks are from different revisions of Dodge City, so hopefully two revisions can now get playable!













Samstag, 1. April 2017

decapping is a Fun World #4

I got a donated FunWorld pcb yesterday. The board is basically in bad shape, but at least i got good reads from all eproms!
As the board is not working correctly, i looked threw the dumps to hopefully get at least the GameTitle...which i didn't find inside. But, i found something much more interesting inside one eprom!



After reading this i used some tools to scan the binary file for images and sounds.
I got this 15kb Image as a result:


After some research, i found infos about a guy called Hans Scherz, who worked for more than 15 years at FunWorld, but sadly no actual informations about him and how to contact him...


EDIT: 02.04.2017
1st APRIL is over....most of you already knew it...this was a Joke! It never gave an eprom with this text inside and the photo is a  picture from the net, a little bit photoshoped!
Btw. great job KITSUNE SNIPER for finding the original picture!!

Sonntag, 19. März 2017

decapping is a Fun World #3

Over the years, i got a lot machines, consoles and arcade boards, which had the CPU or decryption part hidden under Epoxy and that made it sometimes hard to get the game/program emulated correctly.

So i sent a package with some of those hidden DIE's to Sean, who is really an expert for removing the epoxy and he also has a great equipment for doing HighRes-Pictures of those DIE's, to indentify it.

So what new informations did we get with his help:

FRUIT STAR (Funworld)


this board, has an hidden CPU with decryption devices hidden inside an 40pin epoxy block (like many other Fun World boards, read more about it below)...while we at least were pretty sure the CPU is a Z80, we did not know what other parts were inside the block.

LSI Logic Corp gate array (68 pins)

24-pin chip from "WaferScale", marked CNW50

40-pin Zilog chip with a '75 copyright - pretty sure a Z80




Genius BrainStation 5505X (2001) (Germany)

Some of the VTech Learning Laptop's already work partially in MAME, but some do not, mostly because they used some unknown CPU-types, hidden under epoxy.



CPU (JV27005A) - Hopefully this information brings use one step closer...


Genius Leader 6600CX (1999) (Germany)

I already took a closer look at this CPU about 2 years ago, but with my cheap USB microsope i only got "NSC" as information from it.


National Semiconductor NSC1028B
On a press-release from 1999 you can read the following: National Semiconductor designed the Geode NSC1028 processor specifically for VTech's new email appliances. The system-on-a-chip integrates a powerful 16-bit RISC processor, keyboard and printer ports, LCD display controller and speech synthesis circuitry into a single piece of silicon. This custom integrated processor represents the first step in a partnership between VTech and National to bring attractively priced, easy-to-use information appliances to the consumer market.


Reader Laptop E (2004) (Germany)

Another Laptop from Vtech! This was the first Vtech-Laptop i dumped, about 5 years ago...i always tought the dump was added to MESS/MAME...but it looks like it wasn't. At least i did not find anything about in inside the current MAME-Version.


Elan EU3A12

Plug & Play Spongebob

Sometimes you have a system, were you are not sure, how to dump it! For me this are the Plug & Play TV-systems, which have everything hidden under epoxy...even the rom data. That's why i destroyed one system and sent the rom-epoxy to Sean to identify it!



"Winbond 2003 05 AA5853".  It's a 42-pin chip.

Mega Card 3 (Funworld)

I also sent the DIE's from the Mega MC3 board (which i did show in this blog already some posts below) to Sean, as he has the better equipment for photographing the DIE's.
 

F245 (TI 1986) [octal latch]

7400

65SC02
With this new/better pictures, he also could clear some mistakes with the previous decoder rom!



All upper DIE shots can be downloaded here in FULL HIGH RESOLUTION!





SEGA PICO

we got two new Pico cartridges dumped! Previously we did not know that Sega also made swedish games for the PICO, but we know now!

MK-49021-24 - Ett Ar Med Nalle Puh (Sweden)


MK-49037-24 - Lejonkungen Äventyr (Sweden)
 

Sonntag, 5. Februar 2017

PICO and MCU confirmation

Got a nice package from Italy last week!

Thanks to f205v who donated a package of italian Pico-Stuff too me. So we got a new previously undumped PICO game!

Ecco Jr. E La Grande Caccia Al Tesoro Nell'Oceano! (Italy)



Quizard MCU's:
If you look at this post  you can read about my progress dumping the locked MCU for Quizard 4. About one day later i decapped the MCU for an Quizard 1, but was not 100% sure the dump is GOOD.
So i ordered a couple of new D8751H MCU's to try the dumps on the real hardware.

I can now confirm, both dumps are GOOD and working perfectly on the real system!
 


Samstag, 28. Januar 2017

decapping is a Fun World #2

a new day, a new post.

short summary of the last days:
two days ago, we did not know what type the 3 die's and the plcc28 chip, inside the "security device", are.
today we know it!
thx to the help of f205v and Sean Riddle we now know the following.

The PLCC28 chip is a CY7C291A (a prom replacement)
DIE#1 is a TI74F245A
DIE#2 is the CPU, a 65sc02
DIE#3 is a 7400

with that informations i'm good hope that we understand the decoding of the program-roms.

the bit-area of the 65sc02, of which i posted a picture in the last post, is the decode rom. so basically shouldn't be needed for emulation stuff.

Sean Riddle made this:
1001101101100110101010
0101100101100110101010
1001101001101010101010
1001100101101010101010
1001011001101010101010
1001010101101010101010
1101010111101111100101
1101010101101010010110
0101011001101010101010
0101010101101010101010
0101101001101010101010
0101100101101010101010
0110101010100110101001
1110010111101111101001
1110010101101010011010
0110011011101111101001
1010101110100110011010
0110011110101011101010
0110011110101101101010
0110011001101010011010
1010101111011101010110
0110100110101111101010
0110100111101101101010
0110111010100110101010
1101010111011111100101
1111111111111111111111
1110111111011101010110
1010101011011101100110
1001101010011010101010
1001100010100110101010
1101010101011010010110
1101111111101111100101
1001011010101010100110
1001010111100101100110
1010101010011010100110
0101100110101010111010
1001010110010110101010
1010010111100101100110
0101100111101101110110
0101100110101010110110
1101111111101111010110
1001011111101101010110
1001011110100110010110
1001011110000110011010
0110100110101111011010
1010111110100110011010
0110100111101101011010
0110010110100110101010
0110100101100110011010
0110011010100110011010
1101111101101010101001
1101111101101010011010
1110111110011010101001
1101111110011010101001
1101111101101010101010
0101101010101010101010
1001011010011010101010
1001100110010110101010
1001100111101101100110
0101011101100110101010
1001101010101010100110
1101111011101111111111
1010100111100101101010
0110101010011010101010
1110111101011010101010
1001011101100110101010
1010111111101111101001
1010111101101010011010
0110100111101111101001
0110101001100110101010
0110100101101010011010
1010101101100110011010
0110101010100110011010
1101010101010110011010
1001101010101101100110
0110101001100101110110
1111111111111111111111
1010011101011000111010
1001010110101001101010
1010101010101011100110
1001101001101101100110
1010101010011010101010
1001100110011010101010
1101111101100110101001
1101111111100101111011
1001010111010101101010
1010010110101010100110
1010011010101010100110
1110111111101111111011
0101101001010101101010
1110111101101010010110
1110111110101010100101
1101111110101010011010
1101101111100110011010
0101011110100110011010
1101111101100110101010
1001101010101010101010
1010100110011010101010
0101111110100110101010
1010100110101010100110
0101101010100110100101
1101100101101010010110
1001010110101011100110
1010100111101001101010
0110101001010101101010
1101111111101010010110
0101011111101111100110
1001011011101001100110
0101010111101111100101
0101101010100110101010
1001111101100101011010
0101111101101001101010
1001100101101001101010
1001011101101001101010
1110101001011001101001
0110101001100111100101
0101101010010110101010
1001010111101111100101
0110101001011101111011
1001100101101010010110
0110101010010101101001
1001010111101111100101
1001010101101010010110
1111111111111111111111
1001100110100110011010
1101101001100101011010
1010011111010101111011
1110111111011010111011
1001100110101101010110
1101011000101010010110
0101011001101111100101
1001101111100110011010
0101011101100101011010
1001011010100101101010
1001010110100101101010
0101010101101010010110
1001010110100110011010
0101011111101111100101
1001101001110110011010
0101011110100110101010
1001111111011111110111
0101111111011111110111
0101100111101111100101
0101101010011010101010
1001101111101111100101
1001101011101101010110
1001110111101101010110
1001101110100110011010
1001110110100110101010
1111111111111111111111
1101010111101111110111
1101111101011010101000
1101010101100110011010
1001011110101010101010
1101011001100110011010
1001011010100110101010
0101011010101111100110
1110011101010010101001
0110101001011001101010
0110101010010101101010
0101111010100110101010
0101101011100110101010
0101100110100110101010
0101100101100101011010
1001011001100110011010
1001101010101101100110
1101111101100110101001
0101010101010110011010
0101010110101111100110
1001101001101010010110
1001011111101101010110
1001011110100110011010
0110101001011001011010
0101010110100110101010
0101111011100110011010
1111111111111111111111
1001010101100101101010
1101111101101001101010
1101101010101001011010
1001111101101001011010
1101111101101001101001
1101111110101010101001
1001011001101010010110
1001011011101111000101
0110101010010101011010
1001101011101111100101
0101111101010101101010
1101111101010101011010
0101100110100110011010
1101111100010111101001
1111111111111111111111
1101111101011010111001
0101100101010101011010
0101011101011111101001
0101011101010101111001
1001111101010101011010
0101100101011111101001
1001111101011111101001
1101100101010101111010
1010010111010101101010
1110111101011010101010
1001010101010110011010
1001100110101010100110
1110011001010110011010
0110101001100110011010
1101011011101101010110
1001111111101101010110
0101010111101101010110
0101100101100101101010
1001010110011010101010
1010111010010110101010
1010110110010110101010
1110010101010110011010
1010011110011010101010
1101011101101001011010
1001100110101010101010
0110101001100111110111
0110101011101010100101
0110101001101010010110
0101111101100101101010
1001100101100101101010
1101111101100101011010
1101111101100101101001
0101101110101001101001
0101101010101001111010
1110111101011010011010
0101100101100110011010
1010011010010101101010
0101101101101001011010
0101101010101001101010
0110101010011010101010
0110111111010101111011
1110111111011001111011
0110101010010101111011
1001101011101001101010
1101111110101001101001
1101111110101001111010
1101101101011010101001
1110100101100101100110
0110111101100111110101
1110111101100101010110
1110111101101111100101
1010011111010101011010
1010011111010101101001
1010101111010101111011
1110011101011001101001
1110011101011001011010
1010101101011001111011
0110011110010101111011
0110100110010101111011
1110110101011001111011


and sent me a binary file of it: DOWNLOAD