What's new
By:

Samurai Shodown V Perfect on real hardware?

The french Forum NeoGeo System has released a working patched rom.
You can find it here https://we.tl/t-Q7KpqKNLio (Link available only 7 days)

here’s is the process to run the game under Retropie with FBNeo (translated from the NGS forum)
- in the retropie setup menu, do a retropie setup script update
- from the retropie setup menu, do an update for lr-fbneo from sources and not from the binaries (sources supports samsh5fe, added june 06th)
- put the rom samsh5fe.zip under the NeoGeo rom folder
- restart emulation station
- launch the game, open retroarch menu, choose bios MVS JAP
- enjoy !
 
Last edited:
Snickers said:
has anyone the neobuilder to share?
Click to expand...
It will not work.

If you try to use it with the GUI it will not load a rom with an unkown zip name.
If you try to use the samsho5sp.zip name it will not work because of bad CRC.
If you use the command line in generic mode it will output bad structure.

Really Apple like minded software with obsessive control.

You should use NeoSDConv:
https://github.com/city41/neosdconv

If you are not on Linux just install WSL.
 
YaYaLanD said:
The french Forum NeoGeo System has released a working patched rom.
You can find it here we.tl/t-Q7KpqKNLio (Link available only 7 days)
Click to expand...
YaYaLanD said:
- from the retropie setup menu, do an update for lr-fbneo from sources and not from the binaries (sources supports samsh5fe, added june 06th)
Click to expand...
I have checked that romset and it's not patched. It's the same one floating around and probably that's the reason why you need to upload the emulator. They have probably implemented the changes/hooks needed to run that game in the emulator, imitating those Real Time hooks / replace that are done in the game avalaibale online.
 
Sorry Darksoft, my bad. I thought it was patched with the new title. I apologize. I’m editing my last post so people won’t be cheated.

i’ve checked NGS forum, and they are still actively working on the patch.
 
I'm no expert on all this. But on YouTube there's a video of perfect on the title screen being played on mvs. Hope sometime soon so will all of us
 
Lol
I was just crusin. Thought that was what going to happen so I didn't pay it much attention. Now that i see alot of work is going this way, maybe we should find the guy. It wasn't listed in away to be easily found. I think it was from Asia. I'll try to find it.
 
MetalliC said:
I'm pretty sure that's how this thing works -
emulator install execute hook at PC = 0x68C8, which is some kind of printf() routine, and have reg A0 pointing to message start, then iterate and compare A0 with all the pbins[ I ].dst_offset and if it match - replace A0 with respective pointer like &pbin_data_start[pbins[ I ].pbin_offset], and then continue execution of native M68K.

feel free to implement the same in native M68K machine code and inject jump to it at the start of 0x68C8 subroutine, and you'll get English story texts.
Click to expand...
I went ahead and did this, mostly just to see if I could. Basic testing shows its working as expected.

C: 
// gcc -o ss_pbin_patch ss_pbin_patch.c
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdint.h>
#include <byteswap.h>

#define ENTRY_OFFSET  0x068c8
#define PATCH_OFFSET  0x9ddd0
#define PBIN_OFFSET   0x9e000

char entry_code[] = {
  0x4e, 0xf9, 0x00, 0x09, 0xdd, 0xd0, 0x4e, 0x71
};

char patch_code[] = {
  0x48, 0xe7, 0xe0, 0xc0, 0x43, 0xfa, 0x02, 0x2a, 0x20, 0x19, 0x58, 0x89, 0x53,
  0x40, 0x20, 0x19, 0xb1, 0xd9, 0x67, 0x06, 0x51, 0xc8, 0xff, 0xf8, 0x60, 0x08,
  0xd0, 0xbc, 0x00, 0x09, 0xe0, 0x00, 0x20, 0x40, 0x43, 0xed, 0x18, 0x8e, 0x4e,
  0xf8, 0x68, 0xd0
};

int main(int argc, char **argv) {
  FILE *pbin, *rom;
  uint32_t num_patches;
  uint32_t data32;
  uint16_t data16;
  int32_t i, j;

  if(argc < 3) {
    printf("ss_pbin_patch <pbin> <rom>\n");
    return 1;
  }

  pbin = fopen(argv[1], "r");
  if(!pbin) {
    printf("Error: unable to open %s for reading.\n", argv[1]);
    return 1;
  }

  rom = fopen(argv[2], "r+");
  if(!rom) {
    printf("Error: unable to open %s for writing.\n", argv[2]);
    return 1;
  }

  // header part of pbin needs to be 32bit swapped
  fseek(rom, PBIN_OFFSET, SEEK_SET);
  fread(&num_patches, sizeof(uint32_t), 1, pbin);
  printf("Number of patches: %d\n", num_patches);
  fseek(pbin, 0, SEEK_SET);
  for(i = 0; i < (num_patches * 2) + 2;i++) {
    fread(&data32, sizeof(data32), 1, pbin);
    data32 = bswap_32(data32);
    fwrite(&data32, sizeof(data32), 1, rom);
  }

  // data part of pbin needs to be 16bit swapped
  while(fread(&data16, sizeof(data16), 1, pbin) == 1) {
    data16 = bswap_16(data16);
    fwrite(&data16, sizeof(data16), 1, rom);
  }

  fseek(rom, ENTRY_OFFSET, SEEK_SET);
  fwrite(&entry_code, sizeof(entry_code), 1, rom);

  fseek(rom, PATCH_OFFSET, SEEK_SET);
  fwrite(&patch_code, sizeof(patch_code), 1, rom);

  fclose(pbin);
  fclose(rom);
}
To use the patcher, be sure to backup your samsho5_fe.cslot1_maincpu as the patcher will write directly to the provided file

Code: 
$ ./ss_pbin_patch SamuraiShodown5_FE.pbin samsho5_fe.cslot1_maincpu
$ dd if=samsho5_fe.cslot1_maincpu of=272-p1d.p1 conv=swab

$ md5sum 272-p1d.p1
e5425fa247b4bd25fb0a57dacec0e42a  272-p1d.p1
This is not needed to use the patch, but for completeness here is the assembly used to generate the entry_code and patch_code blobs in the c code.

Code: 
; vasmm68k_mot -Fbin -m68000 -spaces -L ss_patch.asm.txt -chklabels -o ss_patch.bin ss_patch.asm
ENTRY_OFFSET            equ $68c8
PATCH_OFFSET            equ $9ddd0
PBIN_OFFSET             equ $9e000      ; location pbin was written in p rom


        org ENTRY_OFFSET

        jmp     patch_code
        nop
return_point:

        ; a0 = string address we might want to override
        ; d0,d1,a1 are free to use
        org PATCH_OFFSET

patch_code:
        movem.l d0-d2/a0-a1, -(a7)      ; instruction we overwrote for our jmp

        lea     PBIN_OFFSET, a1
        move.l  (a1)+, d0               ; number of entries
        addq.l  #4, a1                  ; skip 0x000000
        subq    #$1, d0

        ; struct {
        ;   long pbin_offset;           ; offset of override string within pbin file
        ;   long string_address         ; string we would want to override
        ; }
.loop_next_entry:
        move.l  (a1)+, d0               ; pbin_offset
        cmpa.l  (a1)+, a0               ; string_address
        beq     .found_match
        dbra    d0, .loop_next_entry
        bra     .do_exit

.found_match:
        add.l   #PBIN_OFFSET, d0        ; adjust target address based on where pbin is in the p rom
        movea.l d0, a0

.do_exit:
        lea     ($188e,a5), a1          ; another instruction we overwrote from our jmp
        jmp     return_point
 
too late here. Can someone confirm this prom works as expected in the original Neogeo?
 
That's amazing ACK!

So it needs to be byteswaped after and do the prom cut and joined together as a normal maincpu file?

Doing a date night with the wife, can't test it right away but as soon as I'm free I'll!
 
fandangos said:
That's amazing ACK!

So it needs to be byteswaped after and do the prom cut and joined together as a normal maincpu file?

Doing a date night with the wife, can't test it right away but as soon as I'm free I'll!
Click to expand...
The patcher needs to be run against the original samsho5_fe.cslot1_maincpu from the mbundle, then it will need to be byte swapped. What you do after that will depend on how you are loading the rom. 272-p1d.p1 is from ss5spnd set, which just has 1 big p rom. I added that set to my local mame build so I could use it to test/debug.
 
The reversing of the patch is something to wonder, really awesome what you did there.

Working as it should:

sucess.png


Now only the logo remains to be added.
 
If I had to guess, all the patch is doing is swapping out the in-game story text (which is only in Japanese obviously) for its English equivalent, so the only way you ever get the story sequence bits is if the game's language/region is set to Japanese. Probably a lot easier and quicker to drop it in than to rework the entire rom contents to add another language mode.
 
@ack glad to see it worked as expected

@King of Dirt yep, developer(s) implemented it in the most easy and fast way, as usual.

at the side note - I'm pretty sure this SS collection was developed by same person(s) who previously did "Street Fighter 30th Anniversary" for Capcom.
 
You must log in or register to reply here.
Back
Top