What's new
A

Apocalypse

I'm really getting to the bottom of my pile of faulty PCBs, so now I'm fixing real crap like System 11 quiz games.
Nothing major on that side, one faulty transistor on the last stage of green amplification for one (mainboard), a bad inductor in the video level circuitry for the other (CPU board).

Since there's nothing I can really do with those Japanese quiz games I had a look if they could be converted to something a little less boring.
I did patch a System 11 game before to get rid of the KeyCus protection so I knew conversions or a multi were possible.

The thing is program flashes are soldered on the mainboard, so dumping/reprogramming requires to pull them.
But I also found weird those flashes didn't have stickers or anything to identify them as you would expect if they came preprogrammed before pick and place.
Surely Namco had a way to program them in place (i.e. all motherboards came out the same from assembly lines and were programmed later).
@Hammy pointed out the fact the write signal for those flashes was coming from a PAL. Humm... Very interesting.

Probing address, data and control lines I found all the needed signals were accessible from the J105 connector (through LS245 buffers for data lines and LS244 for address and control lines).
The equation to enter programming mode has to be deducted but that isn't an issue.

So the next step, when I'll have time, will be to build a dumping adapter that plugs in J105.
I also found some System 11 games had a PAL (in PLCC20 package) on the 'romboard' (banked ROMs) that wasn't dumped. I'll do that to.

One last thing, my boards are Quozodate Quiz 3, MAME states a rev.B of that game could exist, and one of mine has a 'Rev.A' sticker strikethrough with a capital B handwritten, so maybe it exists after all.
Sure thing is MAME has 2 files of 2MB for flashes but mine have 4 * 1MB flashes. Could be the same data split though.
 
Last edited by a moderator:
A

Apocalypse

I also found some System 11 games had a PAL (in PLCC20 package) on the 'romboard' (banked ROMs) that wasn't dumped. I'll do that to.
ROM8_DEC0 (IC1) is now dumped (PALCE16V8, registered and secured, brute-forced).
Waiting for PLCC20 GAL16V8s to test the dump.
 

Hammy

Champion
Joined
Feb 3, 2018
Messages
1,243
Reaction score
2,459
Location
U.K
I had this all sussed from a software point of view same as you ( keycus new versions )
The problem was always the program ROMS. The rom boards are simple enough but those fujistu flash suck.
If you can somehow execute code (and graft in extra storage) i'm sure the prog roms can be dumped + programmed by the system.
 
A

Apocalypse

I had this all sussed from a software point of view same as you ( keycus new versions )
I also have a repro KeyCus I need to test. But that's just for purists, as you say it's completely unecessary (and would just increase the multi's BOM).
The problem was always the program ROMS. The rom boards are simple enough but those fujistu flash suck.
We discussed about it, they can be dumped with at least two cheap programmers (and adapters): TOP3000 and TL86+.
If you can somehow execute code (and graft in extra storage) i'm sure the prog roms can be dumped + programmed by the system.
I doubt it, there's a pin on J105 controlling write mode and it's simply tied high on the CPU board so you would need to cut that trace at least and have a mecanism to handle it properly.
Maybe with a new board sitting between the mainboard and the CPU board.
To me Namco just plugged in an adapter to J105 to flash the code.
 

Hammy

Champion
Joined
Feb 3, 2018
Messages
1,243
Reaction score
2,459
Location
U.K
I also have a repro KeyCus I need to test. But that's just for purists, as you say it's completely unecessary (and would just increase the multi's BOM).
My keycus repro works good and does the random and ID functions but nothing implanted for the sys 11 games.
For 2 gal chips + 1 logic it's not bad on the BOM's side.

Maybe with a new board sitting between the mainboard and the CPU board.

This was my 1st idea but is a lot of work, it will need perfect alignment with sound rom socket etc etc.
This idea means removing the PROG roms completely away from the motherboard and not read/writing but rather hijacking the lines before the buffers from there)
If you can program from there it's only alignment to worry about.

The other idea was everything from the rom board "side" utilizing the keycus socket etc
In my "2nd idea" the "lines" would be stolen from the keycus socket and wires for the remains, it's good to see you progressing so fast :D
 
Last edited:

Hammy

Champion
Joined
Feb 3, 2018
Messages
1,243
Reaction score
2,459
Location
U.K
A

Apocalypse

I have many system 12 alt PROG's to dump... Can you give us a clue :)
All signals are available though the J105 connector for main CPU code.
Sound ROM is a bit trickier but I can't tell more, I'm seriously thinking of a multi now.
Your "sega hacks" got added to mame recently it would be nice to get the unhacked versions one day...
No idea what you are talking about.
I don't think they all do the same function, did you do all the games?
No they don't altough some are very similar in behaviour.
I also doubt you reproduced those with only two GALs and a TTL.
Might work for the previous KeyCus generation but on S11 you need between 16 and 24 internal latches just for the p1/p2/p3 parameters.
 

Hammy

Champion
Joined
Feb 3, 2018
Messages
1,243
Reaction score
2,459
Location
U.K
All signals are available though the J105 connector for main CPU code.
Sound ROM is a bit trickier but I can't tell more, I'm seriously thinking of a multi now.
I don't care about the sound rom, only the progs need dumping.

I also doubt you reproduced those with only two GALs and a TTL.

My keycus only did the RNG functions seen on early hw, out of 8 games 1 needed a crack/patch.

PS; Lending a lift and tyre pump instead of sending a man with passion of cars to re-invent the wheel.
I wonder what has much higher chance of him returning with a full new roller.
 

Hammy

Champion
Joined
Feb 3, 2018
Messages
1,243
Reaction score
2,459
Location
U.K
Well. Seems your findings are only for system 11.
I checked the system 12 and it's all via C416
 
A

Apocalypse

I don't own any System 12 game. Surely CPU board can access the flashes through J111. Or you mean signals go through C416 first?
Anyway, Namco had a way to ISP those flashes, we just need to find how.
 

twistedsymphony

Enlightened
Staff member
Immortal
Joined
Jul 21, 2015
Messages
10,434
Reaction score
10,274
Location
NH, USA
Flashes read/write from J105 = tested!
holy shit that's a game changer!
For years I've looked at sys11 and sys 12 and was convinced that it should be possible to read/write the flashes without removal.

I'd love to know more about how this works. This would be great to getting a lot more games dumped. and maybe I can finally region/revision swap some games without worrying about damaging the chips or the PCB in the process.
 

nativedragon

Beginner
Joined
Jul 27, 2020
Messages
2
Reaction score
0
Location
las Vegas
Thats pretty sweet, does your dump method documented anywhere? i'd like to try and move a software from one board to another from j105, also i did notice 2 different revisions, one says B on it. any idea what was different? maybe just type of flash used?

really cool work! totally interested!
 
A

Apocalypse

PS; Lending a lift and tyre pump instead of sending a man with passion of cars to re-invent the wheel.
I wonder what has much higher chance of him returning with a full new roller.
I don't know what that means. I've always answered your questions, if not publicly in PM at least. I don't see how that passive agressive posture is helping here.
My answer was serious, there's no magic for main CPU flashes.
I'd love to know more about how this works. This would be great to getting a lot more games dumped. and maybe I can finally region/revision swap some games without worrying about damaging the chips or the PCB in the process.
Your comment is actually very interesting, is there any version of some games more valuable than others? If I release the method we're garanteed it will used by some people to create undetectable conversions.
Thats pretty sweet, does your dump method documented anywhere? i'd like to try and move a software from one board to another from j105, also i did notice 2 different revisions, one says B on it. any idea what was different? maybe just type of flash used?
Nothing public (yet?), though it's not rocket science.
I believe the 1st revision motherboards have 4 x 1Mb main CPU flashes while 2nd revision have 2 x 2Mb flashes.
 

twistedsymphony

Enlightened
Staff member
Immortal
Joined
Jul 21, 2015
Messages
10,434
Reaction score
10,274
Location
NH, USA
Your comment is actually very interesting, is there any version of some games more valuable than others? If I release the method we're garanteed it will used by some people to create undetectable conversions.
Yes and no. I have 3 use cases...
1. I have a few games that are "maybe" undumped versions of previous dumped games. given the risk of damage removing the chips for dumping, they haven't been dumped to confirm if they are indeed different than what has been dumped before. A solder-free way to dump these I could easily confirm my whole collection of System 11 and System 12 games and maybe find some new versions in the process.

2. Region swapping. I have Tenkomori Shooting (JP) and Star Sweep (JP) that I'd much rather have the English language versions of. I believe these games share the same Keycus between regions so it's just a matter of swapping the program ROMs. on any other board it's a quick EPROM burn and chip pull, but again on these boards with fine-pinned flash ROMs there's more risk involved, so it'd be great to be able to do a region swap like that. For these games in particular I'm not sure there's value added or removed for the region swaps I'm interested in, there might be for some other games though.

3. Revision Swapping. I have Tekken 2, Tekken 3, Soul Calibur, etc that play and work fine but aren't the last released patch level of the game (for instance I might have Rev D when there is a Rev E out there). It'd be nice to be able to upgrade my games to including the last released bug-fixes and balances. I'm not super competitive in any of these game but like with any fighter; for some games specific older Revs might be the "preferred" revision for competitive play. Again there may or may not be a value increase or decrease depending on the version, it really depends on the specific game. At least in this sense this would have been a service that Namco would provide in the past that is no longer available.

I don't have any personal need for this but A 4th use case is board repair. If I've got a valuable game (like Fighting Layer) that no longer functions I could pull the keycus and transplant it on a good working mobo and then reflash the program roms/swap over the sub-board to bring it back to life.

As for changing one game to a completely different game? I don't think that would be possible without patching out the keycus, and most games have fairly unique sub-boards that would need to be reproduced as well.
 
A

Apocalypse

As for changing one game to a completely different game? I don't think that would be possible without patching out the keycus, and most games have fairly unique sub-boards that would need to be reproduced as well.
KeyCus protection can be patched easily. KeyCus chips can also be reproduced fairly simply but that would be easily spotted too. Lastly on S11 at least, only Point Blank uses a dedicated sub-board for the guns I think.

Anyway, sending a PM your way. :)
 

nem

Legendary
Joined
May 29, 2016
Messages
4,524
Reaction score
3,884
Location
Finland
Lastly on S11 at least, only Point Blank uses a dedicated sub-board for the guns I think.

Don't all of these boards have additional game specific ROM boards that contain mask roms? (Star Sweep excluded) How are you going to do conversions without those?

What am I missing?

Anyway, I too would love to region / version swap some of my games.
 
A

Apocalypse

Don't all of these boards have additional game specific ROM boards that contain mask roms?
There's only 2 different romboards, the latter allowing a bigger ROM space. You can replace the mask ROMs with flashes.
 

Hammy

Champion
Joined
Feb 3, 2018
Messages
1,243
Reaction score
2,459
Location
U.K
I don't know what that means. I've always answered your questions, if not publicly in PM at least. I don't see how that passive agressive posture is helping here.
My answer was serious, there's no magic for main CPU flashes.
The PAL 22 is the magic.

Secondly, if you brag about dumps that you are unlikely to release , it's gonna make someone who shares everything flip they lid!!
Especially after spending 6-7 hours on a namco dump + emulated the day before.

I am sick of time wasting, especially on PSX hardware in general.

I checked the system 12 and it's all via C416

Talking shit there, it's similar but not the same.

No they don't altough some are very similar in behaviour.
I also doubt you reproduced those with only two GALs and a TTL.
Might work for the previous KeyCus generation but on S11 you need between 16 and 24 internal latches just for the p1/p2/p3 parameters.

Point blank 2, My angel and starsweep use the basic ID check as seen on NA1 / NB1.
The others are maths operations. Soul edge's does things on the backgrounds on the water raft level for example.
 

twistedsymphony

Enlightened
Staff member
Immortal
Joined
Jul 21, 2015
Messages
10,434
Reaction score
10,274
Location
NH, USA
Lastly on S11 at least, only Point Blank uses a dedicated sub-board for the guns I think.
When I say "sub-board" I'm referring to this one, used on some games to store additional graphical assets:
system_11_sub_board.jpg


Looking at MAME source this is referred to as the "Daughter PCB". and it looks like there are two known versions of it "There are two known revisions of this PCB. They're mostly identical except one uses all 32MBit SOP44 mask ROMs and the other uses 64MBit SOP44 mask ROMs. The 64MBit ROM board also has space for a PAL and a KEYCUS."

It appears to be used by every game except Star Sweep.

to be honest I thought there was more variety than just 2 versions. I believe System 12 has quite a few more variants of their "daughter board"

So for a "Multi" to work you'd not only have to re-flash the program flashes and replace the daughter board, but you'd also have to re-program the sound chips. which both seem to be custom chips on the mobo according to mame:
C76 - Sound CPU with 16k internal BIOS, a Namco-badged custom, actually a Mitsubishi M37702 MCU (QFP80)
C352 - Namco custom C352 PCM sound chip (QFP100)

I wonder if these are reflashable through some mobo header as well.
 
Last edited:
Top