Model 2 /3 Security hacks

    This site uses cookies. By continuing to browse this site, you are agreeing to our Cookie Policy.

    • TechnicalMonkey wrote:

      Update: the dream is on hold. I was quoted £250ish for the whole work. I then asked about just converting the security board, and I'm still waiting for a response.

      I take it that includes burning all of the 40+ roms? Honestly, it sounds about right. It takes literally hours to burn them, and then there's the cost of the chips.

      If you're interested in doing the leg work yourself, invest in an eprom programmer. You need one that can do 42 pin chips. There's a thread for programmers here:

      Best, low cost, programmer for most arcade hobbyists to have???

      Then just start burning the mame set for the game. The game will boot without a security board. When you're at that point and you have "working game" you can ask either for a converted security board or decrypted program roms (just four chips).
    • I have a GQ4x4, and I think I have the proper adapter to burn them. I was already pricing 100 pieces on eBay (I was thinking of burning the eight ROMs needed to convert vf3 to vf3tb.) Will USB be enough, or will I need a power supply as well to burn the chips?

      I'll need to see if my VS2 '99 is working. If it is, I will pull the trigger on the 100 PC's I saw for under $90 shipped. Even if they turn out to be used I can always erase them.

      Follow-up question: Does anyone know what the last version/revision of Fighting Vipers 2 is?

      Update: Before I commit to purchase ROM chips, what is the deal with the other 6 it so images. Do I not need to burn those as well?

      The post was edited 2 times, last by TechnicalMonkey ().

    • I've got the decrypted roms for the 2b version of Pilot Kids, and have tried to convert a Virtua Striker ROM board without success so far. Just wanted to check if I'm doing this right. Here are the instructions I got:

      Roms with 0x200000 size are 27C160, with 0x400000 are 27C322

      Main program roms are 27C4096 or whatever is on the donor cart

      ROM_START( pltkids ) /* Pilot Kids Revision A, Model 2B */

      ROM_REGION( 0x200000, "maincpu", 0 ) // i960 program

      ROM_LOAD32_WORD("epr-21285a.15", 0x000000, 0x080000, CRC(bdde5b41) SHA1(14c3f5031f85c6756c00bc67765a967ebaf7eb7f) )

      ROM_LOAD32_WORD("epr-21286a.16", 0x000002, 0x080000, CRC(c8092e0e) SHA1(01030621efa9c97eb43f4a5e3e029ec99a2363c5) )


      ROM_REGION32_LE( 0x2000000, "user1", 0 ) // Data

      ROM_LOAD32_WORD("mpr-21262.da0", 0x000000, 0x400000, CRC(aa71353e) SHA1(6eb5e8284734f01beec1dbbee049b6b7672e2504) )

      ROM_LOAD32_WORD("mpr-21263.da1", 0x000002, 0x400000, CRC(d55d4509) SHA1(641db6ec3e9266f8265a4b541bcd8c2f7d164cc3) )


      ROM_REGION( 0x2000000, "user2", 0 ) // Models

      ROM_LOAD32_WORD("mpr-21264.tp0", 0x0000000, 0x400000, CRC(6b35204d) SHA1(3a07701b140eb3088fad29c8b2d9c1e1e7ef9471) )

      ROM_LOAD32_WORD("mpr-21268.tp1", 0x0000002, 0x400000, CRC(16ce2147) SHA1(39cba6b4f1130a3da7e2d226c948425eec34090e) )

      ROM_LOAD32_WORD("mpr-21265.tp2", 0x0800000, 0x400000, CRC(f061e639) SHA1(a89b7a84192fcc1e9e0fe9adf7446f7b275d5a03) )

      ROM_LOAD32_WORD("mpr-21269.tp3", 0x0800002, 0x400000, CRC(8c06255e) SHA1(9a8c302528e590be1b56ed301da30abf21f0be2e) )

      ROM_LOAD32_WORD("mpr-21266.tp4", 0x1000000, 0x400000, CRC(f9c32021) SHA1(b21f8bf281bf2cfcdc7e5eb798cd633e905ab8b8) )

      ROM_LOAD32_WORD("mpr-21270.tp5", 0x1000002, 0x400000, CRC(b61f81c3) SHA1(7733f44e791974070df139958eb97e0585ee50f8) )

      ROM_LOAD32_WORD("mpr-21267.tp6", 0x1800000, 0x400000, CRC(c42cc938) SHA1(6153f52add63295122e1215dd07d648d030a7306) )

      ROM_LOAD32_WORD("mpr-21271.tp7", 0x1800002, 0x400000, CRC(a5325c75) SHA1(d52836760475c7d9fbb4e5b8147ac416ffd1fcd9) )


      ROM_REGION( 0x1000000, "user3", 0 ) // Textures

      ROM_LOAD32_WORD("mpr-21274.tx1", 0x0000000, 0x400000, CRC(f045e3d1) SHA1(548909d2da22ed98594e0ab6ecffebec4fca2f93) )

      ROM_LOAD32_WORD("mpr-21272.tx0", 0x0000002, 0x400000, CRC(dd605c21) SHA1(8363a082a666ceeb84df84929ff3fbaff49af821) )

      ROM_LOAD32_WORD("mpr-21275.tx3", 0x0800000, 0x400000, CRC(c4870b7c) SHA1(feb8a34acb620a36ed5aea92d22622a76d7e1b29) )

      ROM_LOAD32_WORD("mpr-21273.tx2", 0x0800002, 0x400000, CRC(722ec8a2) SHA1(1a1dc92488cde6284a96acce80e47a9cceccde76) )


      ROM_REGION( 0x800000, "user5", ROMREGION_ERASE00 ) // Coprocessor Data ROM


      ROM_REGION( 0x100000, "audiocpu", 0 ) // Sound program

      ROM_LOAD16_WORD_SWAP("epr-21276.sd0", 0x080000, 0x080000, CRC(8f415bc3) SHA1(4e8e1ccbe025deca42fcf2582f3da46fa34780b7) )


      ROM_REGION( 0x800000, "scsp", 0 ) // Samples

      ROM_LOAD("mpr-21277.sd1", 0x0000000, 0x200000, CRC(bfba0ff6) SHA1(11081b3eabc33a42ecfc0b2b535ce16510496144) )

      ROM_LOAD("mpr-21278.sd2", 0x0200000, 0x200000, CRC(27e18e08) SHA1(254c0ad4d6bd572ff0efc3ea80489e73716a31a7) )

      ROM_LOAD("mpr-21279.sd3", 0x0400000, 0x200000, CRC(3a8dcf68) SHA1(312496b45b699051c8b4dd0e5d94e73fe5f3ad8d) )

      ROM_LOAD("mpr-21280.sd4", 0x0600000, 0x200000, CRC(aa548124) SHA1(a94adfe16b5c3236746451c181ccd3e1c27432f4) )



      The decrypted ROMs I got were called M2.15 and M2.16, so I just used those files instead of the epr-21285a.15 and epr-21286a.16 listed above. I put them in IC15 & 16 (which are labelled Program Code 0 & 1).

      I programmed 14 m27c322 ROMs for all the 0x400000 listed above, and 4 m27c160 ROMs for all the 0x200000.

      For the main program ROMs I used 3x m27c4002, which I think may be where I went wrong, as the original ones were M27c1024 in IC 15 & 16, and 27C210A for the sound program. Would that make a difference, or should they work with m27c4002 chips?

      Can anyone see any other issues in what I've done? This is the first conversion I've tried, so know very little about programming ROMs.
    • 2huwman wrote:

      For the main program ROMs I used 3x m27c4002, which I think may be where I went wrong, as the original ones were M27c1024 in IC 15 & 16, and 27C210A for the sound program. Would that make a difference, or should they work with m27c4002 chips?

      Yep, that will definitely be an issue. Original chips are 1 megabit, yours are 4 megabit. You need to double (quadruple?) up the original files. If you're using Windows, load up cmd and type in

      copy /b M2.15+M2.15+M2.15+M2.15 ic15.bin

      Do the same for the other two.
    • nem wrote:

      2huwman wrote:

      For the main program ROMs I used 3x m27c4002, which I think may be where I went wrong, as the original ones were M27c1024 in IC 15 & 16, and 27C210A for the sound program. Would that make a difference, or should they work with m27c4002 chips?
      Yep, that will definitely be an issue. Original chips are 1 megabit, yours are 4 megabit. You need to double (quadruple?) up the original files. If you're using Windows, load up cmd and type in

      copy /b M2.15+M2.15+M2.15+M2.15 ic15.bin

      Do the same for the other two.
      Maybe I'm wrong but as I understand it program ROMs for Pilot Kids are 4Mbit (512kb) so nothing to double/quadruple here. However there might be jumpers to be moved to correctly route extra two address lines.
      Looking for:
      - OutRun boardset
      - Sega System 18 romboard type 171-5987



      01010011 01000101 01000011 01010010 01000101 01010100 00100000 01001101 01000101 01001110 01010101 00100000 01000111 01010101 01011001
    • thanks guys - i haven't had a chance to try doubling or quadrupling yet, but it looks like the original and decrypted program roms are all 512kb, so maybe that's not the issue.

      does anyone have the jumper settings for pilot kids, or have a picture of the model 2b pilot kids rom board? i haven't moved any of the jumpers from their positions for virtua striker.
    • Apocalypse wrote:

      Maybe I'm wrong but as I understand it program ROMs for Pilot Kids are 4Mbit (512kb) so nothing to double/quadruple here. However there might be jumpers to be moved to correctly route extra two address lines.

      Haha, that's a good point!

      I didn't check Mame, just going on by what OP posted.

      @2huwman, Pilot Kids is rare. Possibly no-one on here owns a legit board. You could look on Mame what other Model 2 games have 512kb program roms and look online for pictures of the rom boards.
    • wow... so the only Model 2 game that has jumpers listed in MAME is Behind Enemy Lines, and looking through there aren't any other games that have a similar ROM layout to Pilot Kids.

      I can't find any pictures online of the ROM board and VAPs only lists 2 collectors, Shou and another rare Japanese game collector.

      So I think you're probably on your own for figuring out the jumpers. I had to do this when I did my Air Assault conversion because I was in the same scenario, you've got to use a multimeter, figure out where the jumpers are routed and make educated guesses as to how they should be set.

      if you find the jumpers for Dynamite Cop that game has the same graphics and sound ROM layout as pilot kids. so you should be able to borrow THOSE jumper settings

      GunBlade NY and SkyTarget have similar Program ROM layout as pilot kids. so you should be able to borrow THOSE program ROM settings.

      no game that I can see has a similar Data ROM layout to pilot kids so you'll need to play around with that.
      Buy 3D Printed Parts: bit-district.com
      Projects: instagram | blog
      Games: VAPS | VOOT | UMK3 | RFM | Vewlix | FiF Jr. | KI2 | E29 | E29| Net City | DDR | Flash Beats
      Wanted Items | For Trade

      The post was edited 1 time, last by twistedsymphony ().

    • twistedsymphony wrote:

      I can't find any pictures online of the ROM board and VAPs only lists 2 collectors, Shou and another rare Japanese game collector.
      One simple solution would be asking him directly since he's a member here.
      Looking for:
      - OutRun boardset
      - Sega System 18 romboard type 171-5987



      01010011 01000101 01000011 01010010 01000101 01010100 00100000 01001101 01000101 01001110 01010101 00100000 01000111 01010101 01011001