What's new

neocps1

Student
Joined
Sep 17, 2016
Messages
20
Reaction score
119
As many knows, RTC on this system will lost its content when the battery runs out.
You will be granted by a hardware security error.

Not all programmers can program the M48T58Y chip, so often you are out of luck.

I have made a program which still need some testing which allows reseting the RTC to the correct values
when needed.

So far it works for nba play by play and gradius 4.

I will release all sources and tools when done.

You can donate for this project to neocps1@gmail.com

thank you !
 
Ok, here is the PowerPC code which should be injected starting at 0x2284 in the nba play by play code rom.
Basically, since the hardware has direct memory access to the RTC, it programs the data from m48t58_data
to the RTC and clears the rest of the nvram.

Update m48t58_data for the game you want to reset the RTC for.

Usually 27C160 are used for program roms, but you can use 27C322.
So I suggest you to concat both original game program rom with the patched nba play by play code rom,
add a switch to select the upper address bit, so you can reprogram the RTC when needed (just see the above picture).

This way, no need to open the metal cage to reprogram the RTC if its content is lost.

Also, no need to find a programmer that supports the M48T58 device.
Code:
	.section	".text"
	bl	main
led_output:
	ori		%r5,%r3,0

	li		%r6,0xA
	divw	%r5,%r5,%r6

	lis		%r29,led_lut@h
	ori		%r29,%r29,led_lut@l
	add		%r29,%r29,%r5
	lbz		%r8,0(%r29)
	rlwinm	%r8,%r8,8,0,31

	li		%r6,0xA
	mullw	%r5,%r5,%r6
	subf	%r5,%r5,%r3

	lis		%r29,led_lut@h
	ori		%r29,%r29,led_lut@l
	add		%r29,%r29,%r5
	lbz		%r7,0(%r29)
	or		%r8,%r8,%r7

	lis		%r4,0x7D01
	addic   %r4, %r4, 0x2F70
	sth     %r8, -0x2F70(%r4)

	blr
main:
	bl		m48t58_initialize
main_next:
	lis		%r28,0x7D01
	addic	%r28,%r28,0

	/* Reset sound cpu. */	
	li		%r3,0x80
	stb		%r3,0x04(%r28)

	/* Initialize graphics hardware. */
	li		%r3,0xe0
	stb		%r3,0x07(%r28)

	li      %r3, 0x00
loop:
	stb		%r3,-4(%sp)
	bl		led_output
	lbz		%r3,-4(%sp)
	addic	%r3,%r3,0x01
	lis		%r25,0x0010
	addic	%r25,%r25,0x0000
	mtctr	%r25

wait:
	li		%r4,0x00
	stb		%r4,0x6(%r28)
	li		%r4,0x80
	stb		%r4,0x6(%r28)
	bdnz wait
	bl loop
m48t58_initialize:

m48t58_copy_data:
	lis		%r28,0x7D02
	addic	%r28,%r28,0
	lis		%r29,m48t58_data@h
	addic	%r29,%r29,m48t58_data@l
	li		%r25,0x00
	addic	%r25,%r25,0x10
	mtctr	%r25
m48t58_copy_data_loop:
	lbz		%r4,0x0(%r29)
	stb		%r4,0x0(%r28)
	addic	%r28,%r28,0x0001
	addic	%r29,%r29,0x0001
	bdnz	m48t58_copy_data_loop

	lis		%r28,0x7D02
	addic	%r28,%r28,0x10

m48t58_clear:
	li		%r25,0x00
	addic	%r25,%r25,0x70
	mtctr	%r25
	li		%r4,0x00
m48t58_clear_loop:
	stb		%r4,0x0(%r28)
	addic	%r28,%r28,0x0001
	bdnz	m48t58_clear_loop

	.section	".data"
led_lut:
	.byte 0x81,0xcf,0x92,0x86,0xcc,0xa4,0xa0,0x8f,0x80,0x84
m48t58_data:
	.byte 0x47,0x58,0x37,0x37,0x38,0x00,0x00,0x00
	.byte 0x19,0x98,0x4A,0x41,0x41,0x00,0x02,0xc2
 
Here is the complete PowerPC toolchain to compile this :

PowerPC toolchain

To make the rom, you have to unzip the nba play by play romset in your mame roms directory (roms\nbapbp).
Then update the compile.bat in the PowerPC bin directory to change the paths.

Update m48t58_data in hboot.s with the RTC content you want, run compile.bat and burn 778a01.27p from the mame roms\nbapnp directory
to a 27C160 eprom.

Replace the program rom from your hornet cpu board by the burned eprom and power the system.
The led indicator should blink constantly. It is normal.

Power it off, remove the program rom and replace by the original one.

That's all. Any donations appreciated for the work and the share :)
 
Here is the dual mode switch I made for gradius (works on any other hornet game) :

The gradius 4 eprom content (4 MB / 27C322) : http://www.mediafire.com/file/8zz7vsk8a53clga/gradius4.bin

gradiu10.png
 
interesting aproach to the problem!
one thing you should change, replace the vcc line to the switch with a pullup resistor.
just incase someone makes one with a "make before break" type switch, or just plain slips and hits the contacts against the case! :D
 
very nice work... maybe if I ever find a hornet board set for a reasonable price I'll be able to use it :D
 
finding cheap konami stuff is not hard if it's faulty, fixing it could be.
 
Hi @neocps1

Amazing work. I need to actually fix my NBA Play By Play. I just had a few questions

As I understand it, I need to-

1) Download hornet.rar from above link, extract to c:\hornet

2) Extract NBA play by play Mame rom somewhere, say C:\hornet\nbapbp

3) Go into c:\hornet\bin and right-click 'compile.bat' and click 'edit'

4) Make sure the last line of information in there, matches the nbapbp rom directory like below:
.\inject\inject\bin\Debug\inject hornet_inject.bin c:\hornet\nbapbp\778a01.27p 0x2284

5) Update m48t58_data in hboot.s with the RTC content you want - question listed below

6) Double click c:\hornet\bin\compile.bat

7) After step 6 is complete, go to c:\hornet\nbapbp and get file 778a01.27p as it will now be modified. Have this file burned onto a blank 27C160 chip

8. Open up NBA Play By Play cage. Remove chip 778A01 from location 27p on the PCB board. Install the chip burned in step 7.

9) Power on the game board and an LED indicator will blink, then power off

10 ) Remove the burned chip from location 27p and reinstall my original games 778a01 chip. Power up game again


I had a few questions if you could please confirm

Question 1. The above process listed is for someone who does not wish to use a switch, yes?

Question 2. can the burnt chip be re-used multiple times in the future, when socketed in again?

Question 3. What RTC chip needs to be installed into the game board? A new blank one?

Question 4: are you using this on your own games dump , or just mame one is fine?

Question 5. At the end of the process, you have advised to install the original game chip back. Is it best just to use the mame version of this game rom, considering the tool uses this version to be compiled?

Question 6: "Update m48t58_data in hboot.s with the RTC content you want"

Can you please clarify?

I have opened hboot.s in notepad and looked for m48t58_data and found this:

m48t58_data:
.byte 0x47,0x58,0x37,0x37,0x38,0x00,0x00,0x00
.byte 0x19,0x98,0x4A,0x41,0x41,0x00,0x02,0xc2

What do I need to update in here using notepad?

Question 7: How long does the game board need to be powered on for, before powering off and putting the original game chip back in?


Question 8. If someone wanted to install a switch using your wiring diagram above, would I simply need to keep the burnt 778a01 chip installed, rather than the original game chip?

If so, do you solder to those 3 wires to points on the socket, or do you lift the pins from the chip outside the socket and solder to the chip directly?

Any help would be much appreciated

Thank you!!!
 
Last edited:
@mrJAMMA, since you have the USA version we cannot help you before it is dumped. There are a few guys in Australia who can help you with this.

Should be quick and easy
 
thanks for that. Yes i know someone i could reach out to.

might be an easier option just to change my region if its just one program chip
 
Last edited:
might be an easier option just to change my region if its just one program chip
yes, but dumping an undumped version of a game is a great way to give back the community.

If anyone has any undumped games in their collection they should dump and send it to the dumping union regardless of what their personal plans are for the hardware; because it's the right thing to do.
 
Cool got it.

I now see the reasoning for it and ill look at getting it dumped in case someone has use for it one day.

Thats not an issue and if its going to be helpful ill be happy to contribute.

Ill just need to reach out to a guy i know interstate locally (whom ive dealt with before for cps2 stuff and i am comfortable with) and see when hes happy to free up time to help out as well. I know the process is probably very quick but the guy i like and dealt with before for cps2 chips, has his job and family, so i like to organise with him to his convenience up front and we work it all out.

Considering neo understands more about these boards and his fix, id just like to see his input on the above first please.

If im going to be asking my local person to help dump my chip, then at the same time id like to also ask him to burn me any chips i will need to fix my board at the same time and then i can pay for his time/service in one go. That way its convenient timewise for him to put time aside and to do everything in one session (and more convenient for me time and cost wise as well) and have him post it all back to me in one postage cost when hes ready as well. Will save me going through the China route too.

If I'm going through this route, I will need clarification on the above steps in any case, as i will need to be clear about whats required for him to do.

Specifically question 6 is most confusing, as well as needing to determine if I need him to burn me just a revival chip alone, or a japanese program rom to use moving forward as well.

Once I can work out everything that needs to be done, ill look to get everything done at the one time and everything will turn out and i will pass on the dump of my original chip

Will await neos feedback. Thanks
 
Last edited:
@mrJAMMA if you tell us where you are located in Australia we can get see if we have members from here or the dumping union which can help you dump the ROM and burn new ones
 
as a bonus, they could probably program the new RTC module too.
 
Back
Top