Monday, January 05, 2015

Space Harrier Protection Mechanism

The Sega Enhanced package has been updated with a fix for a protection issue when running the game on Enduro Racer hardware. Sega protected the original game code, to prevent it from running on hardware without the i8751 microcontroller.

It was previously thought that the protection was defeated, however an interesting bug surfaced. Interestingly, MAME did not correctly support the protection either. This resulted in Space Harrier being flawed on MAME, with the life counter incorrectly incremented.

More details from the UKVAC post are below:

This all came to light when Space Harrier world champion and fine upstanding member of the UKVAC community Jodo mentioned in the discussion that there was a *bug* in Space Harrier when played on Enduro Racer hardware whereby occasionally your lives remaining would NOT decrease when you got hit by an enemy, or in some cases your lives remaining would actually *increase* when you got hit by an enemy.  He posted a video of it in action and I then also confirmed that the issue existed using both patched and unpatched SH roms in MAME.

Well this fascinated me and, as I've become rather adept at fixing Sega code bugs in the past few years, I thought I'd look into it deeper to hopefully resolve it.

As you may be aware it's possible to play Space Harrier on an Enduro Racer board set.  The only difference between an SH board set and an ER board set is the inclusion of an i8751 protection MCU on SH.

It was originally thought that the only purpose of the MCU was to check the main cpu roms at boot time, generate a vblank interrupt for the main cpu and process analog inputs/pass them to the main cpu.

It now turns out that this is not the case and the MCU does further protection on the game code.  This is the *bug* (it isn't actually a bug, it's protection code).

The protection routine starts at address $4aae in the main cpu code.  It works by querying the in-game timer (the timer that starts when you start a new game) and if the timer is a multiple of $200 (512) seconds it adds 1 to the word value @ $400f0 in memory.

This value is then copied, every vblank, to $124306 (in shared ram) by the code @ $4e86.  This is the trigger for bad things to start happening.

The value at $124306 is queried whenever you lose a life by the code @ $75ca and the following happens, based on the value held in that memory location at that time :-

if the value is 0 then nothing further happens (this is what the value should ALWAYS be)

if the value is 1 (i.e. after 512 seconds of gameplay) then the in-game frame counter is ANDed with a value of 1 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that, after 512 seconds of gameplay, you've got a 50/50 chance of NOT losing a life when you get hit by a bad guy.

if the value is 2 (i.e. after 1024 second of gameplay) then the in-game frame counter is ANDed with a value of 3 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that, after 1024 seconds of gameplay, you've got a 25% chance of losing a life, a 25% chance of NOT losing a life, a 25% chance of GAINING a life or a 25% chance of GAINING 2 lives, when hit by a bad guy.

if the value is 3 or higher (i.e. after 1536 seconds of gameplay) then the in-game frame counter is ANDed with a value of 7 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that you're now swimming in extra lives, to the point that the game will eventually crash if you keep getting hit by the bad guys (as you've accumulated so many lives by this point).


Long serving and well respected MAME dev team member Chris Hardy (Junofirstman on here) has confirmed my initial findings.  He believes the MCU writes a value of zero to address $400f0 every vblank, so the absence of this simulated code in SH running on ER hardware or in MAME meant that the above phenomenon was happening after 512 seconds of gameplay.

Chris has updated the MAME driver and submitted it and also suggested a patch to the roms for playing on ER hardware which will eliminate the problem.

So, taking a step back, I think this was a pretty crafty protection scheme by Sega.  Time delayed protections are usually very effective and the most difficult to find as they often don't start kicking in until a long time after the game has booted (as is the case here, ~8.5 minutes of gameplay until the effect is noticed).  This means that the bootleggers (was there ever a bootleg of SH?) may have thought that they'd overcome the MCU protection if they managed to clone the functionality of it sufficiently to get the game to boot.  They may not then have proceeded to test it sufficiently long enough to notice the time delayed protection effects kicking in.

What this would mean though is that, if SH was bootlegged and the bootleggers didn't overcome the time based protection and arcade operators bought a bootleg board instead of a genuine Sega board then the operators would likely have been losing money as the players would have been getting much longer gameplay for their 10/20p due to all the extra lives they'd have been getting.  So Sega's idea was to hit the operators where it hurt, in the pocket.

Thanks go out to Chris Hardy, Jodo, Mark Haysman and Ordyne for all chipping in with info and to Sega for making awesome games with semi-awesome protection. 

Monday, December 22, 2014

The Ultimate Way To Play OutRun

The Force Dynamics team have ported CannonBall to run on their 401cr motion simulator. It's particularly cool to see the terrain data is used to adjust the height of the simulator! 

It's fantastic to see CannonBall running on everything from Android phones through to military grade hardware! Check out the video below. 


Wednesday, November 19, 2014

Restoration - Boardset

I pulled the PCB out of the machine and connected it with my test harness to a CRT TV. After sitting in a garage unused since the 90s it was surely never going to work?


I couldn't believe my eyes - it booted up and everything seems ok. Maybe I won't need that spare PCB after all. There's a bit of an audio hiss under the sounds but that's it. I'm going to leave it running for a bit to see if it explodes. ;)

Saturday, November 15, 2014

OutRun Mini Restoration

Back in 1997, I bought an OutRun Mini cabinet. It cost £200 and had been in use in a youth club. It worked, but had been well used and seen better days.


When I left London and headed to university in 1999 the cabinet remained in my parent's garage. It's resided there for the past 15 years gathering dust.

Most of the cabinet was unwisely painted black at some point and the red side art covered. The black paint had started to flake off, taking the red stencilled side art with it; it looked pretty awful as you can see below. 


I got in touch with a chap called Rudy who has reproduced the side art. This is in the post and will serve as a nice motivational reminder of the way things should be. 


The control panel has also been painted black, the sticker ripped and the start button replaced. Everything works fine however. There are no broken cogs and the original OutRun steering wheel emblem is present. 


I have a replacement control panel in great condition, so I have a few options here for the restoration, so it should be one of the easier parts to get right. Some of the chipboard is in particularly poor condition at the base of the cabinet. 


The insides of the cabinet are dusty, but thankfully not rusty. I was quite concerned that storing the cabinet in a drafty garage for 15 years would have caused more obvious problems. 


Even the PCB shows no obvious signs of corrosion which is pleasing.  I doubt it still works, but I will check it in my test harness at some point. 


The bottom interior of the cabinet is filthy. As a bonus, I found 20p amongst the dust. Evidence below. 


It's nice to find out when the cabinet was born; 22nd July 1987. It was last serviced in 1996, a year before I bought it. 


There's a lengthy task ahead, and I will be stripping the cabinet down for a full refurbishment over the coming months. Hopefully I can restore this cabinet to its former glory and learn something along the way. 

Tuesday, November 11, 2014

CannonBall 0.3 - Widescreen Tilemaps & Freeplay

This is a version of CannonBall I meant to release a while ago, but moving house and family commitments ended up causing me to sit on it for a while. I suspect there may be some new bugs as there was a gap between coding and release, so please report anything found.

I also spoke with Colin who is going to carry on with CannonBoard work soon. Behind the scenes a lot is done and ready to go from a software point of view.

Features:
- Widescreen tilemap support for music selection screen.


- Widescreen support for map screen. The sea on the left now extends further.


- Freeplay Mode (enabled in config.xml for now)

- Optional Timing Fixes (enabled in config.xml for now)

Android

Also of note is the following project, which is a port of CannonBall to Android phones, tablets and other devices. There are some bugs and suggestions I have for the author, but overall it runs nicely!


You will need to enable the installation of APK files from unknown sources in the Settings -> Security section of your device to use it.


The author has kindly released the source code, which is available here.

Cabinet Restoration

One benefit of moving is that I finally have space for my OutRun cabinet. It needs a lot of restoration work, so I will be devoting a lot of free time to this project in the coming months as well as supporting Colin with his CannonBoard work. I'll post some pictures once I get going.

Wednesday, August 06, 2014

Sega Enhanced (formerly OutRun Enhanced Edition)

The OutRun Enhanced Edition pack has evolved and is now a multi-pack supporting additional Sega titles. Adrian Smethurst created a patch for Super Hang-On and Limited Edition Hang-On to improve free play mode.

Originally, with free play mode selected by the dip switches, the game would never enter attract mode. It immediately went to the class selection screen when a game was over. If unattended, it would time out and go to the music selection screen. If still unattended, it would time out and start a game; the game (and music) would play until the game timer expired, after which the cycle would start again at the class selection screen.

Improved free play mode DOES allow attract mode (no automatic credit is given). To begin a game in free play mode, simply press the START button whenever it is flashing. This "coins up" the game, and proceeds to the class selection screen.

In addition, the OutRun Enhanced patches can now be applied to the original Japanese rom set with the alternate track layouts.

The patches to run Enduro Racer on the Space Harrier hardware are also included for convenience.

Download the package from here

Monday, July 14, 2014

Tile Editing

One of the problems with CannonBall feature development is that many of the remaining tasks are hard to achieve. Take the music selection screen for example; it's one of the parts of the game that isn't widescreen and remains letterboxed.

Now it would be easy to simply drop in a replacement graphic at this point and bypass the original code to display it. In fact many people have sent me such an image over the last couple of years in the hope I would do just that. But that's not really true to the ethos of what CannonBall is about. The real solution is to extend the original tilemap and use the tile layer to render the screen, rather than hack in a replacement.

Unfortunately, this approach needs a full tile editing tool, which is a rather complex way of achieving something that will look no different to the end user. Nevertheless, I'm writing such a tool so that tilemaps can be edited, new tiles created and the screen finally widened.


Currently I have the ability to import the music selection tilemap, edit tile data and edit tile maps. I'm in the process of creating the new tiles to extend the image to widescreen. As you can see above, the right hand side is relatively easy to extend and I'm just starting to tackle the more complex five columns on the left hand side. 

OutRun contains plenty of unused tiles, which can be replaced for this purpose. For example, the larger Space Harrier font exists in the tileset, which is of course unused. 

Now that tiles can be edited, I can also move on to create HUD graphics for the High / Low gear change, a MPH display and so forth. The next version of CannonBall will feature these improvements. 

UPDATE: And here is the final result in CannonBall. The observant among you will notice that I've based the new tilemap on the 3DS version. 


It was a lot of work for something that looks simple. One of the complications with the System 16 tilemap format is that bits have a shared usage, that I'd previously overlooked. After all, the complications of it don't really matter when simply rendering existing data. For example a typical word of the tilemap is configured as follows:

 MSB          LSB
 ---nnnnnnnnnnnnn Tile index (0-8191)
 ---ccccccc------ Palette (0-127)
 p--------------- Priority flag
 -??------------- Unused

As the index and palette share bits, this locks tiles to certain palettes dependent on their index. Therefore the previously identified unused tiles are not usable. Instead the new tiles end up being scattered through the tilemap from location 4096 onwards. I also had to create new palette entries to map to these tiles.

This explains why Sega games have tile duplication, where the same tiles appear multiple times in the graphic roms. It enables them to be used with multiple palettes. In practice I can't help but think it would have been simpler to double the tilemap memory, thus giving the palettes their own distinct bitrange and avoiding tile duplications. I guess this may have been a cost saving measure.