Taito F3 PCB 101

[undamned]

If you've grown tired of this thread and just want to cut to the meat, here it is:

http://therealundamned.blogspot.com/200 ... b-101.html

Everything you wanted to know about F3 PCB's but were afraid to ask
-ud

[robivy64]

Excellent.

[PC Engine Fan X!]

Quite infomative as always, ud. Keep up the awesome F3 related info coming. There is bound to be more info down the pipeline. ^_~

PC Engine Fan X! ^_~

[undamned]

Glad you guys liked it!

There is bound to be more info down the pipeline. ^_~

Yeah, I guess my top two remaining quandaries are:

- Details on the unreleased prototypes: Recal horn, Twin Qix, and Command War
- Parts and game play comparison between ORANGE and WHITE Raystorm boards

Got ahold of the guy on VAPS that supposedly owns the Twin Qix PCB. I sent him my offer after he confirmed that it was still in his possession and he didn't reply, so I'm assuming he's turning up his nose. Sorry, I just can't justify $500 when I paid less than $100 shipped for my Landmaker proto. Not only that, but he said he no longer has a cab and can't do a final test before shipping. I'd be mental to throw down hundreds of dollars on a PCB that may not even run
-ud

[rtw]

Awesome info ud , thanks for sharing!

Now can anyone explain how to activate the "EXTRA" mode in Bubble Memories ?

All my translation attempts indicate that this is something that the arcade
operator decides on but I cannot get it activated.

[undamned]

Now can anyone explain how to activate the "EXTRA" mode in Bubble Memories ?

Sorry, dude. Never really looked into it. I think I still got the cart laying around somewhere, but I doubt I'd know any more than you would, goofing around w/ the test menu and such...
-ud

[pcb_revival]

I think the extra version Bubble Memories and Darius Gaiden are not included in the original cart ROMs.

Instead they are separate release like Puzzle Bobble 2X but much much rarer.

Has anyone played Bubble Memories Extra as its not in mame unlike Darius Gaiden Extra which is.

[twalden]

This ebay auction for Bubble Memories looks like the extra version from the title screen shot. I'd like to find out more about this version. What are the differences from the regular version?

http://cgi.ebay.com/ARCADE-PCB-BOARD-TA ... 286.c0.m14

[pcb_revival]

This ebay auction for Bubble Memories looks like the extra version from the title screen shot. I'd like to find out more about this version. What are the differences from the regular version?

http://cgi.ebay.com/ARCADE-PCB-BOARD-TA ... 286.c0.m14

The seller says its software version 2.40 which is in mame already - so Extra mode might be operator activated.

Also of note the Taito cart seal as been removed.

[pcb_revival]

Beening trawling the net but have not found how to enable the extra mode

- however -

copy and paste from gamefaqs.


As far as I can tell, the old Bubble Bobble codes do NOT do anything.

Three codes are known right now-

Power Up: up, right, left, down, up, right, left, down
Doing two clockwise circles causes Bub and Bob to have permanent
shoes, blue gum, and yellow gum.

Super Game: left, start, bubble, jump, up, down, start, right
You get the second set of levels when this code is used. It does
nothing special on a machine with Extra Mode enabled. I recommend
avoiding this code until you have beaten the game in normal mode, so
you don't miss part of the story (and the fun!).

Original Game: start, left, bubble, jump, bubble, jump, bubble, jump
You can get to the secret rooms on levels 7 and 37, even if you die.



Enter these codes on the title screen with no credits loaded.





_________________________________________________________________

[Ex-Cyber]

Been trawling the program ROM but have not found how to enable the extra mode.

FWIW, the following strings all occur in the same general area (in this order):

EXTRA MODE
ORIGINAL MODE
SUPER MODE
HUMAN CHANGE
POWER UP
ORIGINAL GAME
SOUND RESET
ROUND SELECT

[twalden]

Thanks for posting those Bubble Memories codes. Never knew they existed. Been playing super mode the last few days, it's like a completely new game.

[pcb_revival]

Thanks for posting those Bubble Memories codes. Never knew they existed. Been playing super mode the last few days, it's like a completely new game.

No problem.

There are codes for Bubble Symphony also @ gamefaqs

The main BB fansites (BubandBub/BubbleBobbleHQ) appear to have died a death which isnt helping find the "extra mode" codes.

[rtw]

The main BB fansites (BubandBub/BubbleBobbleHQ) appear to have died a death which isnt helping find the "extra mode" codes.

True but...

BubbleBobbleHq is here albeit slightly limited: http://bubblebobblehq.110mb.com/

edit:
I have mailed him and asked him about the EXTRA code.

[Runefaust]

An awesome site thank you I just got a Grid Seeker board and feared it was a conversion or so because of this 2 extra ICs on the little watchtower.

[rtw]

Done a bit of digging and managed to find a setup which had EXTRA MODE enabled.

There is NO special ROM version, the selection is permantly stored in EEPROM on the motherboard.

So we need to find the operator code, anyone good with the MAME debugger ?

[undamned]

Done a bit of digging and managed to find a setup which had EXTRA MODE enabled.

There is NO special ROM version, the selection is permantly stored in EEPROM on the motherboard.

Nice, I may keep my cart in lieu of an EXTRA MODE byte hack!

So we need to find the operator code, anyone good with the MAME debugger ?

Sorry, no help here Anyone? Pretty please?
-ud

[Ex-Cyber]

I can't claim any experience with the MAME debugger, but:

1) I recently discovered that it's even in the official builds now; needing to set up the toolchain and roll my own debugger build was what stopped me from looking at it before, and

2) I'm about to start ascending the Ballmer Peak

I guess we'll see what happens.


edit: I'm getting too tired to make sense of things, so I'll just leave this here in case anyone else is interested.

I was trying to find the EEPROM access routines and work backwards from there. The CPU accesses the EEPROM by bitbanging, so it's a good bet that they didn't duplicate that functionality any more than they needed to (maybe once for in-game and once for the operator menu, but probably not even that). So far I've found a series of routines starting around 103D10 that seem to implement the EEPROM access if I'm understanding things right. The first routine to hit after reset (neglecting a general zero-init of the control ports) is at 103DBC, and as far as I can unwind it the call chain seems to go:

103988 -> 103BF0 -> 103DBC

[rtw]

Ex-Cyber awesome that you're playing with the debugger

I have tried to determine which bit is used in the EEPROM for the EXTRA option but so far I have been thwarted by a checksum at the end of it.

Here are three dumps with lives going from 3 - 5.

Code: Select all

0x00: 54 41 49 54 4f 03 30 31 31 30 e0 01 11 12 30 00   TAITO.0110....0.
0x10: 00 00 02 04 ff[f7]22 12 00 00 00 00 00 00 6c e7   ......".......l.

0x00: 54 41 49 54 4f 03 30 31 31 30 e0 01 11 12 30 00   TAITO.0110....0.
0x10: 00 00 02 04 ff[fb]22 12 00 00 00 00 00 00 6c e3   ......".......l.

0x00: 54 41 49 54 4f 03 30 31 31 30 e0 01 11 12 30 00   TAITO.0110....0.
0x10: 00 00 02 04 ff[ff]22 12 00 00 00 00 00 00 6c df   ......".......l.

I've tried writing a checksum program which sums the values as well as an XOR but no luck so far.

Another approach would be to use the debugger and see where the program goes if you enter any
of the known codes. My guess is that a comparison table is used together with a function pointer to
activate the code. Maybe we can find the EXTRA comparison table nearby.

I am 100% sure that an EXTRA code exists and can be set by the operator by a special code.

[Ex-Cyber]

I probably need to take a break for now, but some more notes:

The routine at 103BE8 copies the EEPROM contents into RAM (at 4001A0 onward) at startup. This copy seems to be the first stop for most operations; e.g. by changing the RAM copy I could change the number of lives, and configuration changes get written to the RAM copy before being committed to EEPROM.

The EEPROM checksum is the two's complement negative of the 16-bit sum (naturally, omitting the existing checksum value; the game actually adds it in and then subtracts it back out ). That is, add all but the last 16-bit word together and then negate the result. To put it another way, the 16-bit sum of the EEPROM contents should be zero. The routine responsible for producing the checksum is at 103C3A.

edit: or you can unzip the set and make the following changes with a hex editor if you don't mind MAME complaining at you about the checksum mismatch (you can't select the game from the menu this way, but it will work from the command line):

e21-19.18: 40E78=4E
e21-18.17: 40E78=71
e21-21.20: 40E79=4E
e21-20.19: 40E79=71

This only disables the actual checksum verification; there are a couple other things it checks besides that to decide whether the contents are valid.

Another approach would be to use the debugger and see where the program goes if you enter any
of the known codes. My guess is that a comparison table is used together with a function pointer to
activate the code. Maybe we can find the EXTRA comparison table nearby.

I thought about that, but the emulator doesn't seem to get controller input if the debugger window is focused, and AFAICT the existing codes don't alter the EEPROM configuration.

edit: That does give me another idea, though. I might not be able to step through the controller sequence, but I can set a watchpoint on e.g. the "SUPER MODE" string and see how it's addressed (I wasn't able to find any "raw" references to those strings via disassembler/hex editor); this might yield some kind of base pointer and/or pointer table that could be used to find where the "EXTRA MODE" string is referenced.

[rtw]

The EEPROM checksum is the two's complement negative of the 16-bit sum (naturally, omitting the existing checksum value; the game actually adds it in and then subtracts it back out ). That is, add all but the last 16-bit word together and then negate the result. To put it another way, the 16-bit sum of the EEPROM contents should be zero. The routine responsible for producing the checksum is at 103C3A.

Brilliant discovery

I wrote a quick program to generate the checksum so I could play "mod the NVRAM" files.

The checksum now passes but whenever I touch offset 0x12 & 0x13 the game asks
me to hit the test switch. I tried inserting 0xff and 0x00 at various locations but to
no avail.

[rtw]

Here is the program in case someone else wants to have a play

Patch the bubblem.nv file to your hearts content then create the new checksum automatically.

http://home.online.no/~an-tj/rtw/f3.exe

D:\src\bubblem>f3 bubblem.nv
file: bubblem.nv
checksum: 0x6ce7
checksum mismatch, calculated: 0x6ce7 file: 0xb22d
fixed...

[Ex-Cyber]

Close enough to bruteforce this, which I haven't seen anywhere:

ROUND SELECT: Down, Start, Bubble, Jump, Left, Start, Right, Start

edit: the routine I'm looking at handles only the 4 codes that are now known, at least by default (the table it uses is in RAM): Super Mode, Power Up, Original Game, and Round Select.

[Ex-Cyber]

Bump for some kinda results: setting byte 0x18 of the EEPROM to 0x58 will activate EXTRA MODE. No leads yet on how the hell this is supposed to happen, though. Just from quick fiddling with it, the only difference that jumps out at me is that you can select Super Mode without entering a code.

For MAME users who want to check it out but don't want to edit the EEPROM, drop this into cheat\bubblem.xml and turn it on before the title screen pops up:

Code: Select all

<mamecheat version="1">
  <cheat desc="'Extra' Mode">
    <parameter>
      <item value="0xFF">Enabled</item>
      <item value="0x00">Disabled</item>
    </parameter>
    <script state="run">
      <action>maincpu.pb@40713F=param</action>
    </script>
  </cheat>
</mamecheat>

[rtw]

Bump for some kinda results: setting byte 0x18 of the EEPROM to 0x58 will activate EXTRA MODE. No leads yet on how the hell this is supposed to happen, though. Just from quick fiddling with it, the only difference that jumps out at me is that you can select Super Mode without entering a code.

Nice find, 0x58 = 'X'

I've uploaded a fixed NVRAM which enables EXTRA. Just drop it in your NVRAM directory.

http://home.online.no/~an-tj/rtw/bubblem.nv

[pcb_revival]

So it would appear the extra mode is a resident level select, the player can choose the first 50 levels or the later "extra" 50.

Whilst the super mode starts the game at level 50 for that particulair game only.

Great work guys.

I would like to get this working on either my boot Bubble Memories or original carts as mame is running like a dog on my PC strangly though six years ago it worked fantastically

[Ex-Cyber]

Okay, this is weird. It looks like I got mixed up. The instruction apparently looks for a word >= 5A, not a byte equal to 58. Setting the high byte to 58 would accomplish this, though.

[spadgy]

Excellent.

Yes! Only just read your article undamned, but it was great - concise, and the pictures really helped.

Thanks for the effort!

[twalden]

Quick question. What's the story with the Darius Gaiden Extra version anyway? Was it just an EPROM upgrade? I don't think I've ever seen a dedicated cart of it.

[quoth09]

This ebay auction for Bubble Memories looks like the extra version from the title screen shot. I'd like to find out more about this version. What are the differences from the regular version?

http://cgi.ebay.com/ARCADE-PCB-BOARD-TA ... 286.c0.m14

Don't buy from this seller, ID drkittykr - It is Welink http://www.welink.cc out of South Korea. Sells defect items as working, lies about version he is selling and condition, and lastly the reason why the seals are probably gone or broken on that F3 cart is b/c he reflashes the eeproms as he likes, to change the cart region so it doesn't match what the actual board is. Has been popping up on eBay with all these uncommon boards b/c people stopped buying from them as much directly because of all the defects and other crap going on. I have already tried warning people, and no one listens. Thing is, you get a defect or wrong version from them, keep in mind to even get a refund through Paypal or them, you will have to pay about $30+ to ship the item back from the states with a tracking #, if not more. It's just not worth it, no matter how much you buy.

Quick question. What's the story with the Darius Gaiden Extra version anyway? Was it just an EPROM upgrade? I don't think I've ever seen a dedicated cart of it.

I have no idea what the deal is, Taito made several different Extra versions of games prior to this, so they just decided to make another one; I forget the exact differences on this one, but yes, I have seen a cart of it a couple of times before, goes for too damn much, just like regular Darius Gaiden.