What's new
By:

MK Y Unit Turbo Ninja 3.1

GarouSP

GarouSP

Student
Joined
Oct 1, 2016
Messages
85
Reaction score
33
Location
Brazil
Hi There,
Could anyone say if the version 3.1 turbo ninja from mame is decrypted? I burned the eproms but the game didn't booted.
MK1 Y Unit, U89 and U105 burned two times but no deal.
Saw on ebay the two eproms to sell w/o the kombo board so I assume that is a decrypted version.
THX!!!!
 
it's protected.
mame driver says:
/* the security GAL overlays a counter of some sort at 0xfffff400 in ROM space.
* A startup protection check expects to read back two different values in succession */

so it should be easy with the debugger to put a watch on that address, catch the check and then patch the code.
 
bumping the thread.

using mame set "mkyturbo"
load u105 into a hex editor or your programmer,
at address 0007:be98 you should see "c0"
change it to "60" and burn the rom.

that should kill the check but probably breaks the checksum - that can be looked at if this works so-far.
 
Tested on MAME, works fine, gonna burn the eproms and test on hardware, but I can only provide a feedback Tuesday, anyway thank you!!!!!!!
PS: mame complains about checksun but I guess that on hardware this should not be a problem coz when the pcb starts to check the roms, automatically is skipped, probably this was to the game work w/o any problem...
 
Last edited:
if i had time, i would get back to my project to run strikeforce on MK or high-impact boards. :D
have it running, but didnt fix the gfx.
my real issue is the time it takes my main machine to build mame.
i have a faster spare box, but i'd have to keep copying the source to it just to build the code and then copy the elf back to the main computer :(

another thing i'd like to do is find or get all the pld's dumped on Y boards.
damned boards use some oversized crap from intel - 9c-something aka epm610 or something like that.
 
stj said:
damned boards use some oversized crap from intel - 9c-something aka epm610 or something like that.
Click to expand...
Yep and when that chip is fucked the board is scrap :(
Some bootlegs have it so it should be dumpable.

Sounds like you have the same problem as the "lab" here - equipment getting a bit long in the tooth ;)

PS: If anyone has the terminator 2 Y unit bootleg that still needs to be dumped.
 
@stj tested today in a MK board, works fine.
@Hammy I used to have one but need to look for it and find it, what needs to be dumped, I'm a noob related to dump and just have a TL866CS but if I can help in any way, I'm glad to help, but need to warn that the board aren't working and if I remember well the is some parts missing, some rams I guess...... or if I can't do nothing maybe I can send the board.....
 
stj said:
bumping the thread.

using mame set "mkyturbo"
load u105 into a hex editor or your programmer,
at address 0007:be98 you should see "c0"
change it to "60" and burn the rom.

that should kill the check but probably breaks the checksum - that can be looked at if this works so-far.
Click to expand...
@stj sorry to bother you with this question but I simply forgot how to find an address like this one 0007:be98 can you help me?
PS: If someone could help I appreciate THX!!!!
 
Download HxD.

Open kombo-rom-u105.bin with it.

Scroll down to 0x7BE98.

kombo_rom_u105.jpg


Change C0 to 60.

Then go to 0x7BEA3, and change 60 to C0.

Profit?
 
You must log in or register to reply here.
Back
Top