Konami hornet revival

    This site uses cookies. By continuing to browse this site, you are agreeing to our Cookie Policy.

    • Konami hornet revival

      As many knows, RTC on this system will lost its content when the battery runs out.
      You will be granted by a hardware security error.

      Not all programmers can program the M48T58Y chip, so often you are out of luck.

      I have made a program which still need some testing which allows reseting the RTC to the correct values
      when needed.

      So far it works for nba play by play and gradius 4.

      I will release all sources and tools when done.

      You can donate for this project to neocps1@gmail.com

      thank you !
    • Ok, here is the PowerPC code which should be injected starting at 0x2284 in the nba play by play code rom.
      Basically, since the hardware has direct memory access to the RTC, it programs the data from m48t58_data
      to the RTC and clears the rest of the nvram.

      Update m48t58_data for the game you want to reset the RTC for.

      Usually 27C160 are used for program roms, but you can use 27C322.
      So I suggest you to concat both original game program rom with the patched nba play by play code rom,
      add a switch to select the upper address bit, so you can reprogram the RTC when needed (just see the above picture).

      This way, no need to open the metal cage to reprogram the RTC if its content is lost.

      Also, no need to find a programmer that supports the M48T58 device.

      Source Code

      1. .section ".text"
      2. bl main
      3. led_output:
      4. ori %r5,%r3,0
      5. li %r6,0xA
      6. divw %r5,%r5,%r6
      7. lis %r29,led_lut@h
      8. ori %r29,%r29,led_lut@l
      9. add %r29,%r29,%r5
      10. lbz %r8,0(%r29)
      11. rlwinm %r8,%r8,8,0,31
      12. li %r6,0xA
      13. mullw %r5,%r5,%r6
      14. subf %r5,%r5,%r3
      15. lis %r29,led_lut@h
      16. ori %r29,%r29,led_lut@l
      17. add %r29,%r29,%r5
      18. lbz %r7,0(%r29)
      19. or %r8,%r8,%r7
      20. lis %r4,0x7D01
      21. addic %r4, %r4, 0x2F70
      22. sth %r8, -0x2F70(%r4)
      23. blr
      24. main:
      25. bl m48t58_initialize
      26. main_next:
      27. lis %r28,0x7D01
      28. addic %r28,%r28,0
      29. /* Reset sound cpu. */
      30. li %r3,0x80
      31. stb %r3,0x04(%r28)
      32. /* Initialize graphics hardware. */
      33. li %r3,0xe0
      34. stb %r3,0x07(%r28)
      35. li %r3, 0x00
      36. loop:
      37. stb %r3,-4(%sp)
      38. bl led_output
      39. lbz %r3,-4(%sp)
      40. addic %r3,%r3,0x01
      41. lis %r25,0x0010
      42. addic %r25,%r25,0x0000
      43. mtctr %r25
      44. wait:
      45. li %r4,0x00
      46. stb %r4,0x6(%r28)
      47. li %r4,0x80
      48. stb %r4,0x6(%r28)
      49. bdnz wait
      50. bl loop
      51. m48t58_initialize:
      52. m48t58_copy_data:
      53. lis %r28,0x7D02
      54. addic %r28,%r28,0
      55. lis %r29,m48t58_data@h
      56. addic %r29,%r29,m48t58_data@l
      57. li %r25,0x00
      58. addic %r25,%r25,0x10
      59. mtctr %r25
      60. m48t58_copy_data_loop:
      61. lbz %r4,0x0(%r29)
      62. stb %r4,0x0(%r28)
      63. addic %r28,%r28,0x0001
      64. addic %r29,%r29,0x0001
      65. bdnz m48t58_copy_data_loop
      66. lis %r28,0x7D02
      67. addic %r28,%r28,0x10
      68. m48t58_clear:
      69. li %r25,0x00
      70. addic %r25,%r25,0x70
      71. mtctr %r25
      72. li %r4,0x00
      73. m48t58_clear_loop:
      74. stb %r4,0x0(%r28)
      75. addic %r28,%r28,0x0001
      76. bdnz m48t58_clear_loop
      77. .section ".data"
      78. led_lut:
      79. .byte 0x81,0xcf,0x92,0x86,0xcc,0xa4,0xa0,0x8f,0x80,0x84
      80. m48t58_data:
      81. .byte 0x47,0x58,0x37,0x37,0x38,0x00,0x00,0x00
      82. .byte 0x19,0x98,0x4A,0x41,0x41,0x00,0x02,0xc2
      Display All
    • Here is the complete PowerPC toolchain to compile this :

      PowerPC toolchain

      To make the rom, you have to unzip the nba play by play romset in your mame roms directory (roms\nbapbp).
      Then update the compile.bat in the PowerPC bin directory to change the paths.

      Update m48t58_data in hboot.s with the RTC content you want, run compile.bat and burn 778a01.27p from the mame roms\nbapnp directory
      to a 27C160 eprom.

      Replace the program rom from your hornet cpu board by the burned eprom and power the system.
      The led indicator should blink constantly. It is normal.

      Power it off, remove the program rom and replace by the original one.

      That's all. Any donations appreciated for the work and the share :)
    • stj wrote:

      finding cheap konami stuff is not hard if it's faulty, fixing it could be.
      I haven't even found faulty Konami Hornet stuff. I've had feelers out for a few months now too.
      Buy 3D Printed Parts: bit-district.com
      Projects: instagram | blog
      Games: VAPS | VOOT | UMK3 | RFM | Vewlix | FiF Jr. | KI2 | E29 | Net City | DDR | Flash Beats
      Wanted | For Sale/Trade
    • Hi @neocps1

      Amazing work. I need to actually fix my NBA Play By Play. I just had a few questions

      As I understand it, I need to-

      1) Download hornet.rar from above link, extract to c:\hornet

      2) Extract NBA play by play Mame rom somewhere, say C:\hornet\nbapbp

      3) Go into c:\hornet\bin and right-click 'compile.bat' and click 'edit'

      4) Make sure the last line of information in there, matches the nbapbp rom directory like below:
      .\inject\inject\bin\Debug\inject hornet_inject.bin c:\hornet\nbapbp\778a01.27p 0x2284

      5) Update m48t58_data in hboot.s with the RTC content you want - question listed below

      6) Double click c:\hornet\bin\compile.bat

      7) After step 6 is complete, go to c:\hornet\nbapbp and get file 778a01.27p as it will now be modified. Have this file burned onto a blank 27C160 chip

      8. Open up NBA Play By Play cage. Remove chip 778A01 from location 27p on the PCB board. Install the chip burned in step 7.

      9) Power on the game board and an LED indicator will blink, then power off

      10 ) Remove the burned chip from location 27p and reinstall my original games 778a01 chip. Power up game again


      I had a few questions if you could please confirm

      Question 1. The above process listed is for someone who does not wish to use a switch, yes?

      Question 2. can the burnt chip be re-used multiple times in the future, when socketed in again?

      Question 3. What RTC chip needs to be installed into the game board? A new blank one?

      Question 4: are you using this on your own games dump , or just mame one is fine?

      Question 5. At the end of the process, you have advised to install the original game chip back. Is it best just to use the mame version of this game rom, considering the tool uses this version to be compiled?

      Question 6: "Update m48t58_data in hboot.s with the RTC content you want"

      Can you please clarify?

      I have opened hboot.s in notepad and looked for m48t58_data and found this:

      m48t58_data:
      .byte 0x47,0x58,0x37,0x37,0x38,0x00,0x00,0x00
      .byte 0x19,0x98,0x4A,0x41,0x41,0x00,0x02,0xc2

      What do I need to update in here using notepad?

      Question 7: How long does the game board need to be powered on for, before powering off and putting the original game chip back in?


      Question 8. If someone wanted to install a switch using your wiring diagram above, would I simply need to keep the burnt 778a01 chip installed, rather than the original game chip?

      If so, do you solder to those 3 wires to points on the socket, or do you lift the pins from the chip outside the socket and solder to the chip directly?

      Any help would be much appreciated

      Thank you!!!

      The post was edited 6 times, last by pyJamma ().

    • mrJAMMA wrote:

      might be an easier option just to change my region if its just one program chip
      yes, but dumping an undumped version of a game is a great way to give back the community.

      If anyone has any undumped games in their collection they should dump and send it to the dumping union regardless of what their personal plans are for the hardware; because it's the right thing to do.
      Buy 3D Printed Parts: bit-district.com
      Projects: instagram | blog
      Games: VAPS | VOOT | UMK3 | RFM | Vewlix | FiF Jr. | KI2 | E29 | Net City | DDR | Flash Beats
      Wanted | For Sale/Trade
    • Cool got it.

      I now see the reasoning for it and ill look at getting it dumped in case someone has use for it one day.

      Thats not an issue and if its going to be helpful ill be happy to contribute.

      Ill just need to reach out to a guy i know interstate locally (whom ive dealt with before for cps2 stuff and i am comfortable with) and see when hes happy to free up time to help out as well. I know the process is probably very quick but the guy i like and dealt with before for cps2 chips, has his job and family, so i like to organise with him to his convenience up front and we work it all out.

      Considering neo understands more about these boards and his fix, id just like to see his input on the above first please.

      If im going to be asking my local person to help dump my chip, then at the same time id like to also ask him to burn me any chips i will need to fix my board at the same time and then i can pay for his time/service in one go. That way its convenient timewise for him to put time aside and to do everything in one session (and more convenient for me time and cost wise as well) and have him post it all back to me in one postage cost when hes ready as well. Will save me going through the China route too.

      If I'm going through this route, I will need clarification on the above steps in any case, as i will need to be clear about whats required for him to do.

      Specifically question 6 is most confusing, as well as needing to determine if I need him to burn me just a revival chip alone, or a japanese program rom to use moving forward as well.

      Once I can work out everything that needs to be done, ill look to get everything done at the one time and everything will turn out and i will pass on the dump of my original chip

      Will await neos feedback. Thanks

      The post was edited 5 times, last by pyJamma ().