Main Restorations Software Audio/Jukebox/MP3 Everything Else Buy/Sell/Trade
Project Announcements Monitor/Video GroovyMAME Merit/JVL Touchscreen Meet Up Retail Vendors
Driving & Racing Woodworking Software Support Forums Consoles Project Arcade Reviews
Automated Projects Artwork Frontend Support Forums Pinball Forum Discussion Old Boards
Raspberry Pi & Dev Board controls.dat Linux Miscellaneous Arcade Wiki Discussion Old Archives
Site News

Unread posts | New Replies | Recent posts | Rules | Chatroom | Wiki | File Repository | RSS | Submit news


  

Author Topic: Hornet Hardware Timekeeper RAM  (Read 861 times)

0 Members and 1 Guest are viewing this topic.

mrjamma2

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 6
  • I want to build my own arcade controls!
Hornet Hardware Timekeeper RAM
« on: January 20, 2018, 09:35:30 pm »
Hey guys,

Just following on from a previous topic: http://forum.arcadecontrols.com/index.php/topic,130917.0/all.html
I was going to submit a reply to that thread, but it advised to consider making a new topic due to age.

I have a Hornet Hardware NBA Play by Play board. It recently suffered the inevitable fate of the timekeeper chip's internal battery dying, losing all its' data and suiciding the board. Dreaded RTC DEVICE ERROR 35D

I have been reaching out to various avenues to get as much info as I can, so I can decide which path I will be taking with it. Everyone has been really helpful in my endevaours so far and I am very grateful for such a great community.
Namely, there is an excellent repairer on the other side of the country who can guarantee a working repair, but advised me there may be a little bit more to it for him to get it going successfully (including possibly converting all the program roms to another region, so as to be able to get a working matching RTC for it to boot).
I'm still getting some final details on that, as well as needing to still check out a postage quote as these boards are large and heavy. Also waiting on some feedback in regards to what options I will have down the track after the repair is successful, when it inevitably fails again from another dead battery (i.e. does the whole board need to be sent there every time it fails, or will it be easier next time it fails and a chip could be posted to me , or what happens when he retires, etc.). In short, I'm trying to look to a more permanent or manageable solution long term.

The game itself is great, but ultimately their working value is likely around $300, so I need to assess how much is worth investing in it as well.

Also, I'm really curious how it all works as well :)

Okay, so all of that aside, back to looking into the technical side of the problem. Ideally I'd like to be able to have an RTC file compatible with my version game board, so that I can maybe even invest in a programmer and have a future proof solution.

Removal of the chip and soldering in either a new chip or a socket for that chip is not a concern.
A replacemnt M48T58Y chip from mouser with a new internal battery is also not a concern. There's even a guy who modifies these chips to have an external coin cell battery holder - another thing to consider.

Long and short of it - the issue lies in being able to get a compatible file to program to one of these chips for the current version of my board UAB

Only two versions of NBA Play by Play have been dumped for MAME
JAA (Jap)
AAB (Asia)

Whomever dumped the AAB version however, has copied across the M48T58Y file from the JAA version (imagine due to the hassle of needing to desolder their own chip to dump it).
Ultimately MAME does not emulate the security so that file was not relevant to dump I'd say.

So in short - I have access to one M48T58Y file - the JAA Japanese version.

My version however, is UAB (USA).

The way the security works on these boards, based on the previous thread, is that it looks at the data in the first 14 bytes, followed by the next two bytes being a checksum. The previous thread can explain more.

I don't know if this checksum remains steady once its programmed, or if its continually rolling and changing *shrug*?
I guess thats' my first question.

Porchy has a tool which can be used to check these RTC files for Silent Scope 2 and it will tell you the checksum found VS what it should be, based on an algorithm.
http://www.jammarcade.net/files/Programs/ss2check.zip

The only concern I have is that it works great when I test it on a silent scope games M48T58Y file (MAME rom), but when I tested it on Gradius, or even the dump of the Japanese NBA Play by Play (JAA version) - none of them match the expected checksum? How were these functioning on working PCB's out there? Is the algorithm different for games other than Silent Scope?

Please see my screenshot: https://imgur.com/a/E4gxg

I thought that I could simply edit the japanese file in Hex, change region to match UAB, then use the tool to verify the checksum and update the 15th and 16th byte to the expected checksum, save it and use that to program a M48T58Y

But based on the checksum tool, it might not be the case.

Thanks all in advanced for any input

« Last Edit: January 21, 2018, 10:01:45 am by mrjamma2 »

Haze

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 1148
  • I want to build my own arcade controls!
    • MAME Development Blog
Re: Hornet Hardware Timekeeper RAM
« Reply #1 on: January 21, 2018, 10:48:39 am »
I'm actually confused by this one.

MAME *does* emulate the timekeeper, however in the case of this game it gleefully ignores the content of it, to the point of just erases the data that is already there apparently running the game as 'no region at all' (hence the blank warning screen)

this makes me wonder if the timekeeper image MAME has for it is valid at all because the first thing it does is completely erase it when it can't find the data it wants.

however, that would mean the hardware shouldn't care if the timekeeper has the correct data on this game at all, as long as it's a functional chip?

I know some Konami games absolutely require the data to be valid to boot at all however.

if nothing else this should be a lesson in DUMP YOUR TIMEKEEPER CHIPS...

too often people have reported / asked 'my board failed, why can't I find the replacement roms / data in MAME' and when I tell them because nobody dumped it yet, and ask why didn't they, they always say they didn't want to be the one to risk it.

had somebody approach me about the final Cave shmup with a similar story the other day, their NAND flash rom had failed, and they expected to be able to download a MAME romset to repair it, however the game isn't in MAME because everybody who owns it is worried about devaluing their game, or not wanting to risk removing the rom to dump it in the first place... got the same story from this person 'Why didn't you dump it yourself earlier' 'Never expected mine to be the one that failed, didn't want to risk it' ....

« Last Edit: January 21, 2018, 10:53:14 am by Haze »

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6130
  • I break stuff...then fix it...sometimes
Re: Hornet Hardware Timekeeper RAM
« Reply #2 on: January 22, 2018, 02:19:06 pm »
This is just another variant of the "suicide battery"

There is some decryption keys konami stored in the timekeeper ram... when the battery dies... PFFFT gone.

MAME gets around this often by just having already decrypted ROM sets. I'm not sure if this is a viable option for your unit, but rewriting the ROMS with fixed software so it doesn't need the decryption data is a way around this.

if the game works in mame, it might already be decrypted or the timekeeper chip has valid data, either way you can use the MAME set to "repair" your board.

Haze

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 1148
  • I want to build my own arcade controls!
    • MAME Development Blog
Re: Hornet Hardware Timekeeper RAM
« Reply #3 on: January 22, 2018, 07:53:37 pm »
This is just another variant of the "suicide battery"

There is some decryption keys konami stored in the timekeeper ram... when the battery dies... PFFFT gone.

MAME gets around this often by just having already decrypted ROM sets. I'm not sure if this is a viable option for your unit, but rewriting the ROMS with fixed software so it doesn't need the decryption data is a way around this.

if the game works in mame, it might already be decrypted or the timekeeper chip has valid data, either way you can use the MAME set to "repair" your board.

sorry, but that's complete nonsense.

MAME isn't using 'decrypted romset'

MAME is emulating the timekeeper device.

There's no encryption, it just stores the settings, a region, and a checksum.  If one so desired it could be reverse engineered from the game code.

It's a stupid design, sure, presumably done because Konami were fed up of people using cheap imports with swapped roms, so moved the region code to somewhere people were less likely to copy it / wouldn't understand why they couldn't change the region with a romswap, but it certainly has nothing to do with encryption.
« Last Edit: January 22, 2018, 07:55:19 pm by Haze »

mrjamma2

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 6
  • I want to build my own arcade controls!
Re: Hornet Hardware Timekeeper RAM
« Reply #4 on: February 07, 2018, 10:23:19 pm »
Just an update.

NBA board is now working. Thank you for the advice Haze.

After you advised that it appears the game just erases and rewrites the RTC, I sourced a new M48T58Y chip and socket. It was a cheap and low risk option to try before I had funds from upcoming pay day to get it professionally looked at. Fortunately it worked out.

After the new blank chip was fitted, held the test button on the board. Whilst holding down, powered up the machine and kept 'test' held in all through the rom checks until the game booted fine again.
The NBA manual suggests holding test after 'repair'.. though not sure if this step is needed but did it anyway
http://antelopearcade.com/files/Arcade%20Manuals/NBN_PLAY_BY_PLAY.PDF

Looks like the NBA board works different to Silent Scope Hornet's though, as people have tried blank chips on them in the past (in other forum topics) and it hasn't ever worked. Either that, or I was very lucky.

Either way its working now with the above steps and just giving some feedback!

thanks all.


Haze

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 1148
  • I want to build my own arcade controls!
    • MAME Development Blog
Re: Hornet Hardware Timekeeper RAM
« Reply #5 on: February 08, 2018, 06:54:00 am »
yeah, Silent Scope won't run without a valid region / checksum.

NBA runs the game, even without a valid region.. so as long as you're happy with how it runs I guess it's fine.

Malenko

  • KNEEL BEFORE ZODlenko!
  • Trade Count: (+58)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 13115
    • forum.arcadecontrols.com/index.php/topic,142404.msg1475162.html
Re: Hornet Hardware Timekeeper RAM
« Reply #6 on: February 08, 2018, 07:48:40 am »
sorry, but that's complete nonsense.

MAME isn't using 'decrypted romset'
Is there a spur under your saddle?  He didnt say MAME emulates NBA play by play with decrypted data, just that MAME can run games using decrypted data, like the CPS2 games. Simmer down.
No matter one's station in life, the Dance of Death unites us all.

mrjamma2

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 6
  • I want to build my own arcade controls!
Re: Hornet Hardware Timekeeper RAM
« Reply #7 on: February 08, 2018, 08:49:47 am »
yeah, Silent Scope won't run without a valid region / checksum.

NBA runs the game, even without a valid region.. so as long as you're happy with how it runs I guess it's fine.

Actually its really interesting. I forgot to mention, it used to be UAB (USA) Region before it died.
Since the new blank chip/test button process above, it ran an initialization process on the first bootup after the rom checks were performed and subsequently has changed itself to permanently being AAB region now (Asia, but all in English).
Following that first time, it no longer runs an initialization process after the rom checks are complete and boots straight into the game after the rom checks complete themselves - i.e. as it should. During the rom check it identifies itself as being AAB region on every bootup now

Very happy that it boots first time every time and doesnt try to run any initialization procedures either . Result!
« Last Edit: February 08, 2018, 09:03:24 am by mrjamma2 »

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6130
  • I break stuff...then fix it...sometimes
Re: Hornet Hardware Timekeeper RAM
« Reply #8 on: February 08, 2018, 12:54:18 pm »
yeah, Silent Scope won't run without a valid region / checksum.

NBA runs the game, even without a valid region.. so as long as you're happy with how it runs I guess it's fine.

Seems that there is a small eeprom adjacent to the RTC with the default data stored in it that gets dumped into the RTC chip if it fails. some the system 16 era konami hardware has this chip, while some of them omitted this chip.... Silent scope 2 fatal judgement for sure omitted this chip. (which I the game I had issue with the RTC chip failure)

http://forum.arcadecontrols.com/index.php?topic=130917.0

mrjamma2

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 6
  • I want to build my own arcade controls!
Re: Hornet Hardware Timekeeper RAM
« Reply #9 on: February 08, 2018, 06:56:42 pm »
Wow, so even though both games are 'Hornet hardware', they have been designed differently..

So if I understand, NBA has a second chip installed from factory, which restores data to new blank RTC chips when the old one dies, and Silent Scope has no second chip at all and any replacement chips need programming first.

Makes sense and explains how mine revived itself with the new chip.

Haze

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 1148
  • I want to build my own arcade controls!
    • MAME Development Blog
Re: Hornet Hardware Timekeeper RAM
« Reply #10 on: February 08, 2018, 10:01:51 pm »
yeah, Silent Scope won't run without a valid region / checksum.

NBA runs the game, even without a valid region.. so as long as you're happy with how it runs I guess it's fine.

Actually its really interesting. I forgot to mention, it used to be UAB (USA) Region before it died.
Since the new blank chip/test button process above, it ran an initialization process on the first bootup after the rom checks were performed and subsequently has changed itself to permanently being AAB region now (Asia, but all in English).
Following that first time, it no longer runs an initialization process after the rom checks are complete and boots straight into the game after the rom checks complete themselves - i.e. as it should. During the rom check it identifies itself as being AAB region on every bootup now

Very happy that it boots first time every time and doesnt try to run any initialization procedures either . Result!

Ahh, that's interesting even for me to know, because in MAME it doesn't seem to have a valid region at all, but runs.

I guess it's like the other reply says, there's an eeprom with the region in it which gets copied across on this design, guess they cheaped out on later boards and dropped it.

That gives me something to go on if I do decide to look at this one in MAME tho, would be nice to allow it to run with a region.

« Last Edit: February 08, 2018, 10:03:50 pm by Haze »

mrjamma2

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 6
  • I want to build my own arcade controls!
Re: Hornet Hardware Timekeeper RAM
« Reply #11 on: February 09, 2018, 12:32:12 am »
yeah, Silent Scope won't run without a valid region / checksum.

NBA runs the game, even without a valid region.. so as long as you're happy with how it runs I guess it's fine.

Actually its really interesting. I forgot to mention, it used to be UAB (USA) Region before it died.
Since the new blank chip/test button process above, it ran an initialization process on the first bootup after the rom checks were performed and subsequently has changed itself to permanently being AAB region now (Asia, but all in English).
Following that first time, it no longer runs an initialization process after the rom checks are complete and boots straight into the game after the rom checks complete themselves - i.e. as it should. During the rom check it identifies itself as being AAB region on every bootup now

Very happy that it boots first time every time and doesnt try to run any initialization procedures either . Result!

Ahh, that's interesting even for me to know, because in MAME it doesn't seem to have a valid region at all, but runs.

I guess it's like the other reply says, there's an eeprom with the region in it which gets copied across on this design, guess they cheaped out on later boards and dropped it.

That gives me something to go on if I do decide to look at this one in MAME tho, would be nice to allow it to run with a region.

Youre quite right! In MAME it doesnt run the rom check procedure (which also shows region) on bootup, unlike the real hardware

Thanks again for the help
« Last Edit: February 09, 2018, 12:33:44 am by mrjamma2 »

mrjamma2

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 6
  • I want to build my own arcade controls!
Re: Hornet Hardware Timekeeper RAM
« Reply #12 on: February 16, 2018, 02:20:07 am »
Unfortunately it looks like my success was short-lived.

I was playing the game for about 15 minutes today and it was working beautiful.

That is until the game decided to randomly reboot, then on boot it showed version *** on bootup and gave an RTC error 35d.

I reflowed the solder points on the socket , no damaged traces anywhere as it was a very neat job and done some cont.tests with multimeter on point to point and all is as it should be.

I then grabbed a replacement RTC locally, initialised data and same thing. Played for 20 minutes and it reboot. After reboot It will reinitialise the data work for a few minutes of gameplay and then bang it will reboot and lose it's assigned AAB region again back to *** . Sometimes itll give 35d error... or reinitialise and work again , until it decides to reboot during gameplay


After enough reboots or holding the test button it will eventually reinitialise but the problem just ends up coming back during gameplay  or sometimes it long enough even during the demo intro

I've run the inbuilt mask rom test and it ill passes.

Do you guys believe that the board has a separate fault?

I honestly believe it has to be related to the timekeeper considering it keeps losing the region when it freaks out and shows *** on boot. Almost as though rtc is processing data and runs into a crash of some sort then deletes the region

Or an incompatibility in that my game roms were UAB USA version originally and the stored 8 pin chip which programs the rtc only keeps AAB rtc version and it collides at some point during gameplay?

I'm thinking that maybe the game roms need to be programmed to aab so the timekeeper matches when it retrieves its aab from the 8 pin chip.. there is no USA version RTC file available to program onto my rtc
EDIT: TRIED AAB PROGRAM ROM - NO GOOD. TRIED JAA JAP PROGRAM ROM AND A PREPROGRAMMED JAA JAP RTC - NO GOOD. KEEPS LOSING VERSION BACK TO ***.

a couple of people have used the available jap JAA mame file but then I have no idea what their game version was before failure..

Any thoughts. I'd love to know why it takes a certain amount of time before it decides to freak in other words is it processing some type of data which it runs into and then crashes



UPDATE:

Hi all

Update. A user on another forum developed an RTC revive chip , whereby you replace your rtc with a new one, then replace your program rom temporarily and power on the unit. It reprograms the rtc, then you power off and switch your program rom back in.

I tried this but i had ongoing reboots and blanking of region back to ***

Then i ran into some issues with my cps2 kit this week. Was blacking out randomly during use. Following advice i adjusted my voltage to be 5v at the gameboard, rather than it being 5.1v at the harness with no game connected and about 4.7-4.8v with a game (how it was previously)

Thus far cps2 seems ok but need to test it more.


Anyhow i thought maybe my NBA wasnt getting enough juice either so i tested it with the newly adjusted voltage.

Whilst displaying a random region on boot and in the test menu (AAA) the game boots and plays through the whole game (even winning the finals). Entering credits doesnt freak it out anymore etc.

Such an odd thing though. If this has fixed it i dont understand why voltage would cause blanking of a region to *** ...

Anyway i do need to keep testing but very positive result thus far!


Thanks all
« Last Edit: June 25, 2018, 05:32:23 am by mrjamma2 »

  
 

Sitemap 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31