Did you know that Wild Riders crashes with error 22 after a minute when loading from network? This happens in all packs. Entering and exiting test mode helped. I struggled with the problem for two weeks, and we finally found it! It was fixed. Now it doesn't crash.
link for BIN + MD :
https://drive.google.com/drive/folders/1yanADrJuXdt7xSaj320PCg2N04vBRmAx
# Wild Riders Netboot Error 22: Explanation
Yes — it was a **bad/incomplete netboot hack of the game**, not primarily a NetDIMM firmware problem.
The point is: the old `wldrider.bin` had already been “converted for netboot”, but it was done in a rough way. It only disabled the **final jump to the error handler**, while the game’s protection code itself was still running.
In the original Wild Riders cartridge, the ROM is accompanied by protection/security devices:
```text
x76f100_eeprom.bin
315-6146.bin
315-6215.bin
main_eeprom.bin
```
MAME runs the game correctly not because it magically patches the game, but because it has dumps of those protection components and the driver knows how to provide the correct environment/responses to the game.
A NetDIMM netboot image does not have the original cartridge protection hardware anymore. So the protection check has to be either properly emulated or fully bypassed.
What the old netboot hack did was this:
```text
0x000FE4B4:
04 8B -> 09 00
```
This location corresponds roughly to:
```text
if the protection response is bad:
jump to error
```
The old hack replaced that branch with `nop`. So effectively:
```text
the protection check failed,
but do not jump to the error path
```
At first glance, that looks like it should be enough. But the problem is that the actual protection call happens earlier.
The critical routine starts here:
```text
file offset: 0x000FE480
SH-4 addr: 0x0C0FE480
```
It does roughly this:
```text
if the internal protection state is 0 or 1:
return
otherwise:
call the protection reader
read/receive 0x80 bytes
compare them with the reference string "WILDRIDERSSTAFFAOSAITOU..."
if they do not match:
go to the error path
```
And the reader call was here:
```text
0x000FE4A0:
jsr @0x0C194EC0
```
So the old hack disabled only the “if bad, show error” part, but **did not disable the actual access to the cartridge protection**.
That appears to be what was causing the issue. On NetDIMM, the game was still trying to talk to the missing/incorrect cartridge protection. At first this did not show up, because the protection code does not immediately reach the active stage. Later, roughly after about a minute or during attract/demo/title transitions, the internal state reached the relevant branch, the game called the protection reader again, received garbage/wrong status/wrong data, and eventually collapsed into Error 22.
That is why V13 does not just add another `nop` after the comparison. It does the more correct thing for netboot:
```text
0x000FE480:
E6 2F 22 4F -> 0B 00 09 00
```
In other words, the start of the routine was replaced with:
```asm
rts
nop
```
So the protection task now returns immediately and never calls the protection reader at all.
That is why V13 works: we did not merely prevent the game from complaining about a bad response; we prevented it from touching the missing cartridge protection path entirely.
## Summary
```text
Old netboot hack:
- disabled only the branch to the error handler;
- left the protection polling code alive;
- the game still accessed the cart/security path;
- after some time it triggered Error 22.
New V13 hack:
- completely disables the periodic cart-security task;
- the protection reader is no longer called;
- the game no longer touches the missing cartridge protection path;
- Error 22 is gone.
```
So we were partly chasing the wrong suspect with the NetDIMM firmware. The firmware may have affected the symptoms, but the real cause was that `wldrider.bin` was only partially “netboot-ready”.
link for BIN + MD :
https://drive.google.com/drive/folders/1yanADrJuXdt7xSaj320PCg2N04vBRmAx
# Wild Riders Netboot Error 22: Explanation
Yes — it was a **bad/incomplete netboot hack of the game**, not primarily a NetDIMM firmware problem.
The point is: the old `wldrider.bin` had already been “converted for netboot”, but it was done in a rough way. It only disabled the **final jump to the error handler**, while the game’s protection code itself was still running.
In the original Wild Riders cartridge, the ROM is accompanied by protection/security devices:
```text
x76f100_eeprom.bin
315-6146.bin
315-6215.bin
main_eeprom.bin
```
MAME runs the game correctly not because it magically patches the game, but because it has dumps of those protection components and the driver knows how to provide the correct environment/responses to the game.
A NetDIMM netboot image does not have the original cartridge protection hardware anymore. So the protection check has to be either properly emulated or fully bypassed.
What the old netboot hack did was this:
```text
0x000FE4B4:
04 8B -> 09 00
```
This location corresponds roughly to:
```text
if the protection response is bad:
jump to error
```
The old hack replaced that branch with `nop`. So effectively:
```text
the protection check failed,
but do not jump to the error path
```
At first glance, that looks like it should be enough. But the problem is that the actual protection call happens earlier.
The critical routine starts here:
```text
file offset: 0x000FE480
SH-4 addr: 0x0C0FE480
```
It does roughly this:
```text
if the internal protection state is 0 or 1:
return
otherwise:
call the protection reader
read/receive 0x80 bytes
compare them with the reference string "WILDRIDERSSTAFFAOSAITOU..."
if they do not match:
go to the error path
```
And the reader call was here:
```text
0x000FE4A0:
jsr @0x0C194EC0
```
So the old hack disabled only the “if bad, show error” part, but **did not disable the actual access to the cartridge protection**.
That appears to be what was causing the issue. On NetDIMM, the game was still trying to talk to the missing/incorrect cartridge protection. At first this did not show up, because the protection code does not immediately reach the active stage. Later, roughly after about a minute or during attract/demo/title transitions, the internal state reached the relevant branch, the game called the protection reader again, received garbage/wrong status/wrong data, and eventually collapsed into Error 22.
That is why V13 does not just add another `nop` after the comparison. It does the more correct thing for netboot:
```text
0x000FE480:
E6 2F 22 4F -> 0B 00 09 00
```
In other words, the start of the routine was replaced with:
```asm
rts
nop
```
So the protection task now returns immediately and never calls the protection reader at all.
That is why V13 works: we did not merely prevent the game from complaining about a bad response; we prevented it from touching the missing cartridge protection path entirely.
## Summary
```text
Old netboot hack:
- disabled only the branch to the error handler;
- left the protection polling code alive;
- the game still accessed the cart/security path;
- after some time it triggered Error 22.
New V13 hack:
- completely disables the periodic cart-security task;
- the protection reader is no longer called;
- the game no longer touches the missing cartridge protection path;
- Error 22 is gone.
```
So we were partly chasing the wrong suspect with the NetDIMM firmware. The firmware may have affected the symptoms, but the real cause was that `wldrider.bin` was only partially “netboot-ready”.
---