What's new

About namco system 11 c431 keycus(dancing eyes)

Something like that! Basically my rambling code post needs to be cleaned up, translated into opcodes and shoehorned into the program where the keycus calls go.
 
Hammy said:
Something like that! Basically my rambling code post needs to be cleaned up, translated into opcodes and shoehorned into the program where the keycus calls go.
Click to expand...
At moment trying to find the call..
 
yes, you will need to let the game run in demo, and complete the game (many times? - point blank 2 had some "tests on a timer" ... ) and take notes of all the calls so they can be patched.
if you find all the calls it's a start.

This is on my TODO list, but got much more important things to deal with at the moment!
 
This game require steering wheel.
There isnt any document about wiring.
 
Dude i finally done also DancingEye timer fix with Hex to Dec

At offset: 0x800788BC
Here what do the game on original state:
Game write the value that need to be converted to keycus:
offset 0x000788BC, address 0x800788BC routine 0x1fa20018

lui v1,0x1fa2
lui a0,0x1fa2
lbu a0,0(a0)
lbu v1,1(v1)
lbu v0,0(s0) ; s0 = 0x1fa20008

Keycus convert and send it back to

0x1fa20000 → 1
0x1fa20001 → 2
0x1fa20008 → 3

stack:
sp+0x12
sp+0x11
sp+0x10

So i replace it with:

li t3,10
divu s1,t3
mfhi a0 ; unit
mflo v1 ; tens
move v0,zero ; hundreds

I think its would work in hardware but at moment i test it only in mame, original file from where i start is from master @WangDrum if he agree i will share.
 
To be precise, these are the instructions that also include hundreds, even if it is practically impossible to get more than 100 in game time.

li t3,10
divu s1,t3
mfhi a0 ; units
mflo t1 ; tens+hundreds
divu t1,t3
mfhi v1 ; tens
mflo v0 ; hundreds

Senza titolo.jpg
 
Last edited:
pierpa86 said:
@Hammy check this out :-) pocket racer patched... i test it only on mame...
Its need more testing, but start and not crash from what i testing now.
Click to expand...
Holy crap! I hope it's good!
As you know, i'm not setup to burn the roms required so cannot test in hardware.


Sounds like you figured it out! That was fast :)
 
pierpa86 said:
To be precise, these are the instructions that also include hundreds, even if it is practically impossible to get more than 100 in game time.

li t3,10
divu s1,t3
mfhi a0 ; units
mflo t1 ; tens+hundreds
divu t1,t3
mfhi v1 ; tens
mflo v0 ; hundreds

Senza titolo.jpg
Click to expand...
great!

I took a quick look at the patched ROM in mame debug.

lui v1,0x1fa2
lui a0,0x1fa2
lbu a0,0(a0)
lbu v1,1(v1)
lbu v0,0(s0) ; s0 = 0x1fa20008

The above command sequence can be deleted because it returns the value after conversion from keycus.

but, Next 2 lines

800608D0 addiu t1,sp,0x13
800608D4 sw t1,0x28(sp)

Since these two lines were deleted when rom was patched, a detailed analysis is needed to determine what role they play.
There may be a potential cause for error due to the deletion of these two lines.
Since it was deleted by overwriting with the two commands below, to prevent malfunctions in the future, the command for 100 digits

mfhi v1
mflo v0

It is safe to write code by finding an empty space in the memory and using the 'jal' command to jump and return.
 
  • Like
Reactions: nem
WangDrum said:
great!

I took a quick look at the patched ROM in mame debug.

lui v1,0x1fa2
lui a0,0x1fa2
lbu a0,0(a0)
lbu v1,1(v1)
lbu v0,0(s0) ; s0 = 0x1fa20008

The above command sequence can be deleted because it returns the value after conversion from keycus.

but, Next 2 lines

800608D0 addiu t1,sp,0x13
800608D4 sw t1,0x28(sp)

Since these two lines were deleted when rom was patched, a detailed analysis is needed to determine what role they play.
There may be a potential cause for error due to the deletion of these two lines.
Since it was deleted by overwriting with the two commands below, to prevent malfunctions in the future, the command for 100 digits

mfhi v1
mflo v0

It is safe to write code by finding an empty space in the memory and using the 'jal' command to jump and return.
Click to expand...
Thanks for review here my next solution, please check it.
Removed keycus and hook (ROM 0x800788BC, RAM 0x800608BC)

0x800788BC: lui v1,0x1fa2 → j 0x8007E68C
0x800788C0: lui a0,0x1fa2 → nop
0x800788C4: lbu a0,0(a0) → nop
0x800788C8: lbu v1,1(v1) → nop
0x800788CC: lbu v0,0(s0) → nop

(ROM 0x8009668C, RAM 0x8007E68C)

0x8009668C: li t3,10
0x80096690: divu s1,t3
0x80096694: mfhi a0 ; units
0x80096698: mflo t1 ; tens+hundreds
0x8009669C: divu t1,t3
0x800966A0: mfhi v1 ; tens
0x800966A4: mflo v0 ; hundreds
0x800966A8: j 0x800608D0 ; jump back

Check PM !

I also have tested some other space where jump but at boot was inizializated.
 
Last edited:
Hammy said:
Holy crap! I hope it's good!
As you know, i'm not setup to burn the roms required so cannot test in hardware.


Sounds like you figured it out! That was fast :)
Click to expand...
Was a damn hell this game X/
Somethings weird happen in Service mode i mean on original version if you test in mame.
Service menu is not working in my patched version and it works poorly even in the unpatched version.
Code is working on mame i tested it using tekken file name but roms are too different, similar rom used just to testing is xevi3dga.zip
Since this game is damn complicated and need steering wheel i stop here for the moment.
Maybe one day i will test it on real hardware but no steering whell, have sense use a joystick ? maybe a future patch to use it ?
I'm happy to contribute to the scene.
I hope someone will want to continue the discussion of this game, optimize and understand the work done.
I will put on hardware dancing eye really soon, this is my goal for now.
My good friend gift me a Tekken Tag Sys12 so next i will consolize it.... so many project ! work .... you know.
have fun !
 
RepairGuy95 said:
How close are we now on the list to de-keycus the games?
Click to expand...
One less :D Here tested file and fully working DanceEye for all.
@WangDrum agree to share our work so here it is.
Enjoy



.....I'm sure this will play its part in the road to a future multigame.
 

Attachments

Dude ! I'm happy to tell that Pocket Racer is working on real hardware ! tested !
I just test boot i dont have a controller to use, i tested with a MVS mapped jamma.
Service mode go boot loop but game start and i can go in play !
 
Last edited:
Excellent! i think the protection was used on screen transitions. Will be interesting to see how you did it!

https://www.arcade-museum.com/manuals-videogames/S/Speed-Racer-Namco.pdf

It should be the same as speed racer, techno drive, final lap R etc.

Sadly Final lap R manual shows a filterboard not the real connections. I think the speed racer is correct...
On the diagram 48Pin = 2nd connector, 56Pin = Jamma, I THINK!!
Also check/compare with the namco system 11 schematic that was posted recently to be 100% sure
 
You must log in or register to reply here.
Back
Top