What's new

TheDrunkenArcade

Enthusiast
Joined
Jan 31, 2018
Messages
150
Reaction score
30
Location
Riverview, FL
The conversion seems and sounds really simple.. except 1 problem..

The PLCC Chip. From what I have heard asking around its a security chip with fuses that keep it from being pulled and copied.. thus not able to find a dump of it online to burn to.

I have asked around for anyone that has an extra PLCC that they want to sell and thats turned up nothing so far.. Is there away to get around it - or has anyone ripped it successfully?
 
I purchased my Rampage World Tour as conversion from a NBA Maximum Hangtime.
So at least one person must know how to create (dump/write) the Midway security chips (or is the chip tech different from Y/T-Units)?
 
I asked the guys at Jammarcades because they have an Any T-unit bin - but it doesnt seem like this is the correct bin for the chip I need.. I'd be interested in hearing if there is a bin I can use to burn to a new PLCC chip that I can replace it with..
 
the protection uses a lookup table in the chip,
the table and related shit is in mame - you could probably hack it out of the code.
 
I purchased my Rampage World Tour as conversion from a NBA Maximum Hangtime.
So at least one person must know how to create (dump/write) the Midway security chips (or is the chip tech different from Y/T-Units)?
Different, Wolf unit boards are converted by replacing the U64 chip. There's a thread here about it and the AnyU64 chip that now exists as a result :)

T-Unit and Y-Unit conversions as far as I'm aware are not possible :( I'd love to convert an MK1 to Smash TV
 
the protection uses a lookup table in the chip,
the table and related shit is in mame - you could probably hack it out of the code.
Unfortunately thats why above my paygrade and someone said that its not something that could be software patched.. not sure who I was talking to at this point I have asked/spoken to so many people my brain hurts.
 
Circa may 2017

Judge dredd / nba convert.


99.9% working
full game is playable till the end....

However Dredd hack is not polished enough yet but maybe someone would like to help finish it off?
second credit/game start will have errors... need to reset system after each game.....
Possibly down to 2 lines of deleted code (part of the hack) or something else missed...

The other games should be possible but it's a long job as you must play the games to the end see different situations multiple times.
 
Y-unit can be done,
i started converting the shitty but cheap football game to strikeforce.
i had it booting and running with bad graphics from what i remember,
then had to stop because of real-world stuff - but they are fully patcheable.

the real issue is finding a base that has the right soundboard for what you want to convert it to.
 
I Think that the Y unit requires modifications to the clock section when some games are swapped...
If you patched the game well and missed the clock you might have a nice surprise there ;)
The clock stuff put me off looking at those.

With T unit it's possible to patch and go forward in time - newer ppu on older game. but not older ppu on newer game due to added functions.
 
i know about y-unit clocks, i put a football and an mk2 side by side and noticed the fact that one had more oscilators fitted than the other.


that's not a problem, because we have the schematics.
 
I have dug around lost files and found some of the files from creating the hack.
Here is a screenshot from that time, it gives other hackers a good idea what to look for....

Very primitive, but some examples.... don't think it's what i ended up with...
the last version is actually on my pcb and needs dumping due to hard drive fail!

I will release the rom files at some stage, but would like it finished...
If the bug can't be worked out will just put a reset at the end of the game or something to get around the bug and call it done.
 

Attachments

  • dreddop0s.png
    dreddop0s.png
    410 KB · Views: 624
Interesting -- so with this bug - does the game just lock up until powered down?
Does it happen at the end of each game.. or per quarter?
 
Well, you can play the game with as many credits as you like and beat the game and it's perfect.

After beating the game the next play will be very boring as it will randomly select a level and just give you that again and again.
It's cool when it gives you the shooting stage tho.

This makes it a swine to track down requiring a complete play (and trace!) just to get to the error.
 
We're talking about Judge Dredd on Nba Jam TE boards. Hacking out the protection.

@Hammy in Dredd, was the security cpu only used as security for reading a result & comparing it? Or did they use the values to calculate stuff?

Nbajam TE: From looking at machine/midtunit.cpp i can see the custom cpu hold a table with 128 entries. (0x1ff values in total)
(Also both NBA Jam & TE do similar things on read/write to certain areas.)
16-bit read/write for this area is trapped and acted upon for the TE custom chip.
0x1b15f40 - 0x1b37f5f
0x1b95f40, 0x1bb7f5f

From the memory map these appear to be writes/reads into the middle of nowhere.
I wonder how this was researched & emulated in Mame properly. Monitoring this area in TE shows some standard routing writing and reading there. Not too special. in TE 4.0 for example, at
FF849CE0 it will write say, 2005006800F400 and read back 4200420042004200 i think?
My deductive powers elude me, but that value is not in the table. Also the machine code for the TMS is different from what i am used to :)
 
We're talking about Judge Dredd on Nba Jam TE boards. Hacking out the protection.

@Hammy in Dredd, was the security cpu only used as security for reading a result & comparing it? Or did they use the values to calculate stuff?
Also works on nba jam standard version / older chip. And in theory will work with others, i should test the mk2 ppu to confirm...

Yes it takes a read and will branch off the rails. knocking out or modifying the branches was enough to get to the end.
Dredd is the weakest of them all. the nops shown above are enough to get most of the way into the game.

I think in one case it's using the value it gets for the level order and that's where it screws up.

Dredd also needs button 4 hooking up in the mame nba driver to work on it (required to complete last bit of level 5)
Also a look through the 'very early' mame drivers give a lot more information (at least for dredd).

It's fun to look at strange processors, Learning about it was one of the reasons for having a look!
 
it's interesting you mention "early mame",
there does seem to be an ongoing shift away from "documentation" towards optimising the code into an unreadable load of object-oriented-shit!!!

i noticed this years ago when the protection handling got obfuscated in the mr.do driver.
 
it's interesting you mention "early mame",
there does seem to be an ongoing shift away from "documentation" towards optimising the code into an unreadable load of object-oriented-shit!!!

i noticed this years ago when the protection handling got obfuscated in the mr.do driver.
I think mame has got better at documenting clones and alt sets. Bootlegs etc are more accepted than 10 years ago ;)
And as time goes by, hacks are removed..... The thing is for this stuff, the hacks are what we need most of the time!
 
In case anyone was interested, you can convert NBA Jam to NBA JAM TE. But you would need to obtain an FPGA chip (Midway part 5410-13530-00) that was used in Tournament Edition for the graphics:



https://forums.arcade-museum.com/showthread.php?t=266112
https://forums.arcade-museum.com/showthread.php?t=378327


You could pull the FPGA off a non-working "for parts" board. You also need to replace a whole bunch of roms but that's easy to do these days.


Alternatively, the FPGA looks to be either a Texas Instruments or Atmel model (see the pictures in those threads), is it possible to 'dump' an FPGA and reprogram a new one?
 

Attachments

  • NBA KIT2.jpg
    NBA KIT2.jpg
    95.9 KB · Views: 500
  • NBA KIT1.jpg
    NBA KIT1.jpg
    93.9 KB · Views: 455
  • NBA KIT.jpg
    NBA KIT.jpg
    100.5 KB · Views: 450
the chips are protected from being read, otherwise there would be no point in them being there.
 
Back
Top