What's new

DerbyOwner

Beginner
Joined
Jan 6, 2022
Messages
8
Reaction score
1
Location
98133
1642032960504.png


This is what I can see on my end...

I am using DOC Rev C or DOCWE not the EX (Rev D)
Only 1 concern. I think the different versions may change what is written out, but not the checksums. IMO, understanding how the output to the card is written helps store the card data for retrieval. Still analyzing the data.
 

AbolishedEnigma

Student
Joined
Jan 5, 2022
Messages
42
Reaction score
21
Location
San Diego
Only 1 concern. I think the different versions may change what is written out, but not the checksums. IMO, understanding how the output to the card is written helps store the card data for retrieval. Still analyzing the data.
I can hook up Rev D and test if we need. I have both main boards and carts for EX as well.

What I’ve seen over the years of card scans is that it has different max values for horse internals. Or total internal value before it handicaps the horses.

I can set it all up tomorrow if need be.
 

DerbyOwner

Beginner
Joined
Jan 6, 2022
Messages
8
Reaction score
1
Location
98133
Only 1 concern. I think the different versions may change what is written out, but not the checksums. IMO, understanding how the output to the card is written helps store the card data for retrieval. Still analyzing the data.
The captured data has been analyzed and reverse engineered.
2 extra bytes occur after some of the data and the locations are known. I suspect this has to do with the protocol requirements to the sanwa, card reader/writer.

Analysis of Track 1 is conclusive:
msr206 data- 9AFF007767000482944E000000000000000068676948206E6961746E756F4D0000000000000000007265676954207373616C4700000000000000000000000000656E614A206C47FF
Captured Data


FF007767000482944E000000000000000068676948206E6961746E756F4D0000000000000000007265676954207373616C4700000000000000000000000000656E614A206C47
Reverse mapped data checks out.
007767000482944E 68676948206E6961746E756F4D 7265676954207373616c47
4E 94 82 04 00 67 77 00 03 66(msg0366) 4D 6F 75 6E 74 61 69 6E 20 48 69 67 68 47 6C 61 73 73 20 54 69 67 65 72 47 6C 61 73 73 20 54 69 67 65 72(not sur. msng 72)
...

Tracks 2 and 3 are the same and can be reverse engineered.

If your goal is to mimic the card reader/writer, then the captured data can be replayed and scripted. If you are wanting to modify horse cards, your spreadsheet should be able to help you understand how to do that. All is possible without removing the interim pcb.
Good work!

As a next step, I would recommend focusing on rs422 protocol traps. The current logs seem a little short on information and I wonder if the traffic out of the rs422 contains something special or if you are only capturing traffic one way, but I am not an expert.
 
Last edited:

AbolishedEnigma

Student
Joined
Jan 5, 2022
Messages
42
Reaction score
21
Location
San Diego
Sorry, I usually have to read these a few times. So we can effectively run a machine without a reader, as long as we are running software that allows us to feed the card data at the appropriate time? Pretty much the same way they do it with ID3 and so on?

So basically, what exists needs some revision and it will work for DOC also? Awesome!! There is hope.

Next task being that converter board. I think if we can get to a point where we can emulate all of the necessary components, we shouldn’t have an issue getting this thing playable in Demul. Possibly with a network option?

Wow, wouldn’t that be something?
 

DerbyOwner

Beginner
Joined
Jan 6, 2022
Messages
8
Reaction score
1
Location
98133
Good question. If Demul with network is an option I would be impressed. That is a sidebar question for Metallic.
 

AbolishedEnigma

Student
Joined
Jan 5, 2022
Messages
42
Reaction score
21
Location
San Diego
So I finally had some time to fiddle around with everything again. Any idea what is going on with "Track 3", "Track 2" and "Track 1" line up perfectly as inversed, but that "Track 3" is a bit of a mystery to me. Maybe I am just not seeing it?

I want to take a shot at updating Winteriscoming's ID3EMU for DOC and MetalliC's reader protocol and command list helped me to better understand how the Naomi and Reader talk back and forth (pulling it forward, but some of the commands look different in DOC, others are same), but I want to have a better grasp before attempting.
==================================================================================================
Here are the protocols that we see most of:

02 Start
03 Stop
05 Req
06 Recv ok

09 - ?
10 Init ('0'/'1')
20 get status?
33 read card data ('016') / load card ('216') (A0 30 34) (00 00 00) (A0 30 30)
40 cancel last command?
53 write data
78 print parameters ??
7A printer init ??
7C print text/pix
80 eject card
92 ?
A0 cleaning
B0 get card from dispenser
C1 ??? seems not used,
D0 open/close front door (shutter) ('0'/'1')

A few commands remain yet a mystery to me, not that it probably matters much other than for my own wanting to understand it...

Reader protocol:
>>> SEND PKT: [START 02][LEN][CMD][0][0][0]{optional data}[STOP 03][CRC]
<<< RECV ACK: [OK 06]
>>> SEND REQ: [RQ 05]
<<< RECV PKT: [START 02][LEN][CMD][RESULT1][RESULT2][RESULT3]{optional data}[STOP 03][CRC]
<<< RECV ERR: [15]
RESULT1 (SENSORS): binary value SSTCCCCC
S - Shutter state:
0 - "ERROR"
1 - "CLOSED"
2 - "OPEN"
3 - "NOW" (both open and close sensors)
T - Stocker (card dispenser) state:
0 - "NO" (empty)
1 - "OK" (full)
C - Card sensors:
0 - "NO CARD"
1 - "CARD EXIST (ENTER)" (card inserted in front of shutter)
18 - "CARD EXIST" (card loaded inside of reader)
other - "CARD EXIST (OTHER)"
RESULT2: char 01235QRSTUV`
Error ENUM "OK", "READ ERR", "WRITE ERR", "STOP ERR", "PRINT ERR", "READERR T1", "READERR T2", "READERR T3",
"READERR T12", "READERR T13", "READERR T23", "SHUT ERR"
RESULT3 (CMD_STATE): char 02345
State ENUM "OK", "DISABLE", "BUSY", "CARD WAIT", "NO CARD IN BOX"
===========================================================================================================================
Example - Insert Game Card
Naomi1 - 02 4B 33 78 30 30 47 6C 20 4A 61 6E 65 00 00 00 00 00 00 00 00 00 00 00 00 00 47 6C 61 73 73 20 54 69 67 65 72 00 00 00 00 00 00 00 00 00 4D 6F 75 6E 74 61 69 6E 20 48 69 67 68 00 00 00 00 00 00 00 00 4E 94 82 04 00 67 77 00 03 66

02 - Start
4B - Len?
33 - Read Card Data
78 - Parameters (78 = 120) <- length of data string
30 - ?
30 - Are these linked to the 78? Like 120 length, 30 (expect three strings) ?

Track One data (inverse) -
00 77 67 00 04 82 94 4E 00 00 00 00 00 00 00 00 68 67 69 48 20 6E 69 61 74 6E 75 6F 4D 00 00 00 00 00 00 00 00 00 72 65 67 69 54 20 73 73 61 6C 47 00 00 00 00 00 00 00 00 00 00 00 00 00 65 6E 61 4A 20 6C 47

03 - Stop
66 - ?

Reader
- 02 09 33 00 00 00 30 31 31 03 09

02 - Start
09 - ?
33 - Read Card Data
00 00 00 - ?
30 - ?
31 - Ready for the second track (?)
31
03 - Stop
09 - ?

Naomi1 - 06 Ready to receive?
Reader - 05 Ready to send?

Naomi1
- 02 06 33 78 30 33 03 4D

02 - Start
06 - Recieve
33 - Read Card Data
78 - Parameters (120)
30 - ?
33 - Read Card Data
03 - Stop
4D - ?

Reader -
05 Ready to send?

Naomi1 - 02 06 33 67 30 33 03 52

02 - Start
06 - Receive
33 - Read Card Data
67 -
30 - ?
33 - Read Card Data
03 - Stop
52 - ?

Reader
- 05 Ready to send?

Naomi1 - 02 4B 33 78 30 30 24 00 00 00 31 00 00 00 23 00 00 00 00 00 00 00 DC 09 00 00 04 01 00 03 02 00 2E 26 17 0E 0D 31 3F 03 08 04 05 0C 0B 08 03 0C 00 00 1C 29 1F 01 44 00 42 03 00 01 02 0E 05 00 00 00 00 00 00 00 04 00 67 77 00 03 CE

02 - Start
4B - Len?
33 - Read Card Data
78 - Parameters (120)
30 - ?
30 - ?

Track Two data (inverse) - 77 67 00 04 00 00 00 00 00 00 00 05 0E 02 01 00 03 42 00 44 01 1F 29 1C 00 00 0C 03 08 08 0C 05 04 08 03 3F 31 0D 0E 17 26 2E 00 02 03 00 01 04 00 00 09 DC 00 00 00 00 00 00 00 23 00 00 00 31 00 00 00 24 00

03 - Stop
CE - ?

Reader -
02 09 33 00 00 00 30 31 32 03 OA

02 - Start
09 - ?
33 - Read Card Data
00 , 00 , 00
30 - ?
31 - ?
32 - ? <- is this saying that there have been two strings communicated? (30 , 31, 32)
03 - Stop
OA - ?

Naomi1
- 06 Receive
Reader - 05 Send

Naomi1 - 02 06 33 78 30 33 03 4D

02 - Start
06 - Receive
33 - Read Card Data
78 - expecting 120 length?
30 - one string?
33 - Read Card Data
03 - Stop
4D ?

Reader -
05

Naomi1 - 02 06 33 67 30 33 03 52

02 - Start
06 - Receive
33 - Read Card Data
67 - ?
30 - one string?
33 - Read Card Data
03 - Stop
52 - ?

Reader -
05

Naomi1 - 02 4B 33 78 30 30 53 45 47 41 42 45 46 30 A8 00 00 00 00 00 00 00 00 00 30 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 67 77 00 03 FE

02 - Start
4B - Len?
33 - Read Card Data
78 - expecting 120 length
30 - ?
30 - ?

Track Three - 00 77 67 00 04 00 00.... <- this doesn't match track three from the horse card, it resembles bits and pieces of track two. I would have assumed this would be the third track read as the first two were above? Does this match up with what happens in the other games?

ID3, WMMT, Club Kart, Mario Kart, etc?


Sorry this has gotten so long... Is anyone able to fill in the blanks for me?


I appreciate your time...
 

chunksin

Professional
Joined
Jan 21, 2017
Messages
253
Reaction score
497
Location
Birmingham, UK
Mario Kart is finally in progress, I'm having a rethink on the method I've been using, it's a pain to scale it to the 94 icons this game uses and I'd like to aim for a more universal approach this time and backport it to Initial D and F-Zero. Still sticking with using PHP to print, the data files need to stay small so they'll still fit on an NFC card, a PNG image of the full card would be too large.
 

Attachments

  • unknown-3.png
    unknown-3.png
    183.7 KB · Views: 22

chunksin

Professional
Joined
Jan 21, 2017
Messages
253
Reaction score
497
Location
Birmingham, UK
Progress so far, if anyone has a printed card from MKGP (not MKGP2) please leave a comment on how this looks, I can't find a sample image on the internet with printed data. I've made some assumptions on character and line spacing based on the logic I'm seeing in the print data.

1645475815202.png
 

chunksin

Professional
Joined
Jan 21, 2017
Messages
253
Reaction score
497
Location
Birmingham, UK
Same code works pretty well for MKGP2, there were a few weird edge cases based around the print and save timings, the game can erase and print the driver name several times before the main card save and print process so tracking when to capture data was tricky. I'll tidy up the code and upload to my github soon once final testing is finished. At some point I'll also write up the discovery process and explain everything in detail in case anyone is interested or wants to take the project further.

Finally if anyone has scans of the original MKGP cards please let me know, the original game has the extra Driver section below Name. It would be great to get the full set!

1645649287785.png
 

chunksin

Professional
Joined
Jan 21, 2017
Messages
253
Reaction score
497
Location
Birmingham, UK
Started on WMMT today and thanks to @winteriscoming confirming there are no icons to print I've pretty much finished after a couple of hours of tweaking, code was just a simplified version of MKGP. WMMT2 differs very slightly as it has 2 lines for rank but pretty straightforward altogether.
 

Attachments

  • unknown.png
    unknown.png
    379.6 KB · Views: 27
  • WMMT2_card.png
    WMMT2_card.png
    510.6 KB · Views: 23

seventhbigsmoke

Beginner
Joined
Jul 4, 2021
Messages
34
Reaction score
5
Location
Spokane,WA
I'm an arcade operator I own initial d stage 3 and stage 5 aswell as mkgp2 and maximum tune 3. One of my card readers died on my id3 my question is with NFC and the emulator can you purchase new cards? I'd like to be able to keep selling cards if I can and rather not buy another card reader sense they cost a lot. Also for ID5 is there a way to setup for NFC? Cards for that game are impossible to find. Thank you
 

chunksin

Professional
Joined
Jan 21, 2017
Messages
253
Reaction score
497
Location
Birmingham, UK
You could certainly use an NFC reader and sell cards to use with ID3 and MKGP2 machines, maybe get them printed up with your arcade branding. You can use NTAG 215 or 216 cards, both will work fine and are very cheap to buy. You can set the emulator to start automatically and the purchase process works as it normally would, you insert more credits to purchase a virtual card in game then place the NFC card on the reader, it will write back to the NFC card when the card ejection sequence runs in the game. Once you have a save game on the card you can place it on the reader when the game asks you to insert it, very simple.

As for ID5 I'm afraid I'm not familiar with the cards or readers for that game and I don't own a Lindbergh, it might be one of those reader in a reader type that saves data out via NFC and prints to the cards too?
 

seventhbigsmoke

Beginner
Joined
Jul 4, 2021
Messages
34
Reaction score
5
Location
Spokane,WA
Okay I may wait on ID3 cause I can still buy the cards brand new oversea's but from what I know I believe ID5 is printing the cards like ID3. I saw some talking about it on this forum awhile ago but hasn't had a public release for it yet.
 

Attachments

  • -1099872901711703572.jpg
    -1099872901711703572.jpg
    66.4 KB · Views: 26

whatnot

Student
Joined
Oct 28, 2019
Messages
77
Reaction score
49
Location
USA
No more bs reply attacks...

YACardEmu


Confirmed working with MT1 & 2 with 3 support soon. It runs a tiny tiny web server which you send post commands to insert cards. Very usable.

Oh and a FOSS license which for some reason you arcade guys are so against.
 
Last edited:

whatnot

Student
Joined
Oct 28, 2019
Messages
77
Reaction score
49
Location
USA
Now has full multi-track read/write support, meaning it should be compatible with MT3 and other weird scenarios, and the RTC stuff is complete for systems that would ping that stuff.

I'm not sure how I want to do ID support yet, I know the first byte is different (with everything else being the same) and is actually a mask of physical buttons. Does anyone have a list of the bits?
 
Top