Patching Daytona in m2emulator

[SailorSat]

Hi folks.

I'm working on rom-patches for daytona to enable some of the "hidden" stuff missing in m2emulator.

So far I have two jobs I'm working on.

• enable the "special type" inputs in dayontas/se - DONE
• remap the lamp outputs for daytona - DONE

daytonas.lua

Code: [Select]

require("model2"); -- Import model2 machine globals

function Init()
Patch_SpecialInputs();
Patch_LampOutputs();
end

function Patch_SpecialInputs()
-- first, disable old read
Romset_PatchDWord(0, 0x1E504, 0x5CA01E00); -- MOV g4,0x00 (NOOP?)

-- now jump to our patched read
Romset_PatchDWord(0, 0x1E508, 0x090219F8); -- CALL 0x0003FF00

-- read io port
Romset_PatchDWord(0, 0x3FF00, 0x80A03000);
Romset_PatchDWord(0, 0x3FF04, 0x01C00012); -- LDOB g4,0x01C00012

-- read patched mask
Romset_PatchDWord(0, 0x3FF08, 0x80B83000);
Romset_PatchDWord(0, 0x3FF0C, 0x00500820); -- LDOB g7,0x00500820

-- and em
Romset_PatchDWord(0, 0x3FF10, 0x58A50097); -- AND g4,g4,g7

-- restore old mask
Romset_PatchDWord(0, 0x3FF14, 0x8CB800FF); -- LDA g7,0xff

-- return
Romset_PatchDWord(0, 0x3FF18, 0x0A000000);  -- RET
end

function Patch_LampOutputs()
-- reroute 0x01C0001E to 0x00500824
for offset = 0x00000000, 0x0003FFFF, 4 do
if Romset_ReadDWord(0, offset) == 0x01C0001E then
Romset_PatchDWord(0, offset, 0x00500824);
local opcode = offset - 1;
if Romset_ReadByte(0, opcode) == 0x80 then
Romset_PatchByte(0, opcode, 0x90) -- replace LDOB with LD
end
if Romset_ReadByte(0, opcode) == 0x82 then
Romset_PatchByte(0, opcode, 0x92) -- replace STOB with ST
end
end
end
end

function PostDraw()
if I960_ReadByte(RAMBASE + 0x00000820) == 0x00 then
I960_WriteByte(RAMBASE + 0x00000820, 0xFF);
end

-- 0xFF = normal
-- 0xFD = force beginner
-- 0xFB = force advanced
-- 0xF9 = force expert

-- 0xF7 = emergency/remote start

-- 0x7F = ex.start; as long as hold down, the track selection stays on (even after the 15 second countdown)

-- 0x3E = DIK_F4
-- 0x3F = DIK_F5
local data = 0xFF;
data = XOR(SHL(Input_IsKeyPressed(0x3E), 0x07), data); -- F4 for ex.start
data = XOR(SHL(Input_IsKeyPressed(0x3F), 0x03), data);  -- F5 for emergency/remote start
I960_WriteByte(RAMBASE + 0x00000820, data);

Video_DrawText(0,0,HEX8(I960_ReadByte(0x00500824)),0xFFFFFF);
end


"special type" inputs
the special type inputs are used on the control tower. i traced the lines in the shematics / manual of the special type daytona.
the tower is seen at the beginning of
there seems to be some additional logic in the control tower to trigger the ex.start and emergency lines.
- the ex.start signal keeps the track selection up as long as hold.
- the emergency/remote start signal causes the game to start (if in attract mode), and forces the hydraulic seats to stop moving (if in game)
- the track selection signals (2 lines) can force selection of a specific track.


lamp outputs
the lamp outputs are triggered by reads/writes at 0x01C0001E. i hooked up the control register in mame and have nice outputs.
as m2em is closed source, i tried to patch all reads/writes there to some area in the RAM area, so we can access the data.
the original code uses LDOB/STOB opcodes which for some reason don't seem to work.
I've replaced them with LD/ST and now it works.

[Howard_Casto]

AFAICT, the output pcb that ran the outputs in Daytona is not emulated in model2 emulator.  Ramjet, Outrun and I have already created "fake" outputs via reading some other memory locations.  I have a few of them hooked up in troubleshooter 2 which will send them directly to the latest version of mamehooker.  The ini file in memcfg is fairly self-explanatory if you know what you are doing so if you want, you can add the rest from ramjet's borderless app and you are done.  No patching necessary. 

[twistedsymphony]

Howard, if M2E doesn't have AFAICT emulated then how was it possible to get lamp output in test mode?

If needed for reference here's a good video demoing the lights for the non-race-leader lamps: http://youtu.be/a101qgl8Ncs?t=1m4s

[Malenko]

Howard, if M2E doesn't have AFAICT emulated then how was it possible to get lamp output in test mode?

Thought AFAICT meant "As Far As I Can Tell"?

[Howard_Casto]

It does. 

A few sega games seem to do this, I've seen it in mame before.  Test mode will often send a totally different range of values to the output memory region than the game itself.  As most of these games don't have the output hardware emulated either, I can only assume that the boards either had some sort of two-way communication, or some sort of watchdog is set periodically that's ignored in the test menu. 

(It's been a few years since I've messed with this so excuse me if the info is a bit inaccurate, I'm going completely on memory.  )

The thing is earlier Sega games just don't care, so I was able to hook up a lot of outputs anyway.  For example I've got a driver lying around somewhere that gives you force-feedback on Afterburner II, but it often just stops after stage 1.  I think this is due to a memory byte that's supposed to be flipped by the hardware not being present.  I'm by no means an expert on Sega hardware though, I just play around with it until I figure it out. 

Also one of the racing games in mame did something similar. (Can't remember which, it was a early 90's 2d racer)  In the test menu it gave crazy big values for the outputs in the test menu, but more standard "sega style" bit masking in-game.  I did a work-around by simply checking for either value, but in all honesty this isn't proper procedure. 

If whatever byte that needs to be set can be found, that's great, but I'm doubtful there is enough code in there to do it.  I looked for about a month and god knows how long RamJet looked prior to me.

[twistedsymphony]

Thought AFAICT meant "As Far As I Can Tell"?

lol... of course it does, I guess I'm just an idiot this morning; when I read it I thought that's what you were calling the output board

Thanks for the insight, Howard  that actually makes a lot of sense.

[Jitterdoomer]

The special tower buttons require 8 computers to be connected to the LAN like the one in the video, am I correct? I've seen this similar feature in Outrun 2 SP SDX for Lindbergh where it controls the player and the motion cabinet.

[Howard_Casto]

Yeah, although I'm fairly certain that it also works in single player mode if you are in first place.  That's how ramjet faked it btw... check the leader pos... if you are in first blink the lamp.  Sat's multiplayer hacks could do something similar..... check the car position for each car, the car with the lowest value is the race leader... blink their lamp.

[SegaOutrun]

the nearby dave and busters has an 8 player special edition. I had no idea they made daytona cabs with motion control seats. Being toss around in the seat threw me off my game and i was lucky i didnt tell the people i was with " i play this game all time at home all the time" since i did poorly. lol

[Jitterdoomer]

The Special Type inputs are going to be based on this?

[SailorSat]

AFAICT, the output pcb that ran the outputs in Daytona is not emulated in model2 emulator.  Ramjet, Outrun and I have already created "fake" outputs via reading some other memory locations.  I have a few of them hooked up in troubleshooter 2 which will send them directly to the latest version of mamehooker.  The ini file in memcfg is fairly self-explanatory if you know what you are doing so if you want, you can add the rest from ramjet's borderless app and you are done.  No patching necessary. 

The lamps (and coin chutes) are handled by two 7 channel darlington drivers; no cpu doing anything. Also, the IO pcb (which contains those darlingtons) is exactly the same as on Model1 hardware.
The only difference between Virtua Racing / Daytona and the "other" games is the fact that VR and Daytona read the current lamp state before trying to update it. WingWar for example does not, and simply writes there.
For that reason lamp outputs in Virtua Racing didn't work for a long time.

I know the ramjetvr script, however I'd prefer the real thing

The Special Type inputs are going to be based on this?

Yup. currently looks something like this.

A few sega games seem to do this, I've seen it in mame before.  Test mode will often send a totally different range of values to the output memory region than the game itself.  As most of these games don't have the output hardware emulated either, I can only assume that the boards either had some sort of two-way communication, or some sort of watchdog is set periodically that's ignored in the test menu.

Actually it is very simple once you figured out how it works
I recently did with Virtua Racing / Virtua Formula and all the custom ---steaming pile of meadow muffin--- (airbag control, hydraulic cabinet etc.).
Now I can feed the game with dip switches on the addon hardware, feed data of the VR pot etc.

Still a long way to go though. Getting the "wheel" feedback working simple enough.

Just as example:
VR (as does daytona, like said, same IO board) sends various commands to 0xC00011 and reads from 0xC0000A.
Now for the catch... there is a "feature select" command that controls what can be read from 0xC0000A.

// vr drive bd commands
// 0x10 = spring (do nothing)
// 0x2x = clutch (0x20 - 0x2f)
// 0x3x = centering (0x30 - 0x3f)
// 0x4x = uncentering (0x40 - 0x4f)
// 0x5x = roll left (0x50 - 0x5f)
// 0x6x = roll right (0x60 - 0x6f)
// 0x8x = feature select - 81 = drive board dip bank 1, 82 = drive board dip bank 2, 83 = drive board wheel pot etc.

the "deluxe" VR has 2 pages of airbag registers (and control).
the virtua formula has 3 pages of hydraulic control.

back to topic. I just want to redirect the lamp control to some other memory location, as the m2emulator masks the "real" location. should not be too complicated

[Howard_Casto]

Not to argue semantics or anything, but if a feature select byte has to be written and it currently isn't then what I said was true... the game requires two way communication and a portion of the output hardware isn't emulated, namely the write ability.  Yet you responded as if I'm incorrect. 

I apologize if this comes off as rude, I've had about 2 hours of sleep in the past day or so. 

Regardless I'm glad you figured it out.  By your explanation rail chase, Jurassic Park and a couple other problem games are probably doing the same thing.  I might look into it when I get time.   

[SailorSat]

I apologize if this comes off as rude, I've had about 2 hours of sleep in the past day or so. 

No problem, know that problem well ^^

Regardless I'm glad you figured it out.  By your explanation rail chase, Jurassic Park and a couple other problem games are probably doing the same thing.  I might look into it when I get time.

Maybe. Poking around in various bits'n'bytes and trying to get it certainly feels like "watching the matrix" ^^

[Howard_Casto]

Heh tell me about it. 

I still have nightmares about Terminator 2 and Operation Wolf 3.  The damn things strobed a set of values so fast and for some reason if you tried to step through a frame at a time, the data either froze or fell off.... I had to write a logger in mamehooker for those.  I'm still not 100% certain op Wolf 3 is 100% correct, but thankfully it's Operation Wolf 3 so absolutely nobody will ever notice as nobody will ever play it. 

I'm hoping I can find the X,Y,Z values of the car in Outrun 2006 as well.  The values are in vectors and seem to be in the same general area as the camera values, so it's like looking for a needle in a pile of needles.  I think I might be able to get some help on that one though. 

If I can get that working and you can get the stuff working in Daytona it almost might be worth it to make a motion sim cab. 

[Jitterdoomer]

Hopefully someone will find a code for the getting hit lamp for Terminator 2, I don't remember Operation Wolf 3 has a lamp where you get hit by an enemy or something. On an off-topic note, have you played Real Puncher so that you can poke around the code for the camera feature? I just want to take a snapshot of Bieber and put it into the game

[Howard_Casto]

The hit lamps are already hooked up in T2... I did it myself. 

I hooked up the gun recoils, the red and green indicator leds on the guns and all the flash targets (hit lights) that light up the bezel.  According to the manual that's all there is.

[Jitterdoomer]

Does the Red and Green LED on the gun represents your gunpower? Green is where your ammo is full while red is empty, you have to pick up the Extended Cooler or a Clip to reload and it gets back to green.

[Howard_Casto]

No, the green led means you have locked onto a target and you can fire at will.  The red led means the opposite... an enemy on the screen has locked onto you and they are firing.

We probably need to quit hijacking poor old SailorSat's thread though. 

[Jitterdoomer]

Alright Howard, so Sailorsat, do I have to get another computer to control the players and the track selection?

[SailorSat]

You can run it on the same machine too. No explicit need for another machine.

As for the lamp outputs. Funny enough, either there is something I've missed, or there is a "bug" in the i960 emulation (which i doubt).

Neither MAME, nor M2EM can read the lamp state.
I can see the read in MAME, however the i960 R-register used stays 0x00000000 all the time.
If I patch the code to use a G-register, everything works as expected... Oo

[Jitterdoomer]

Waaaa? I thought that Model 2 emu doesn't have i960 bug that we need to run lamp inputs, what's going on? Well, I just go with my laptop to emulate it as a tower for controlling the game.

[Jitterdoomer]

the nearby dave and busters has an 8 player special edition. I had no idea they made daytona cabs with motion control seats. Being toss around in the seat threw me off my game and i was lucky i didnt tell the people i was with " i play this game all time at home all the time" since i did poorly. lol

Same goes with Outrun 2 SDX, which was a replacement for the old Daytona USA cabs back in the day, they added two steering wheels on one car so that you or your buddy would drive at the same time, when you crash or kissing the grass, your partnert will drive and gladly it was bigger than Daytona Special Cabs.

[SailorSat]

got it.
replaced all those LDOB/STOB opcodes with LD/ST and now everything works.

grab the script in the first post and give daytona (saturn ads) a try
RAMBASE + 0x824 got the lamp data

0x01 - coin chute 1
0x02 - coin chute 2
0x04 - start
0x08 - view 1
0x10 - view 2
0x20 - view 3
0x40 - view 4
0x80 - leader

[SailorSat]

updated the script again. smaller and (simpler) now.

[Howard_Casto]

Great work man. 

[Jitterdoomer]

GG   

[baritonomarchetto]

Ok, it's "stupid questions" time: how can this script be effectively used in a cabinet?

I mean: you place the script in the right folder in M2Emu, then is a program like Mamehooker needed? Troubleshooter maybe?

(thanks  )

[Howard_Casto]

I'm sure SailorSat is going to use a custom solution BUT.....

You would use the new script along with troubleshooter 2 and mamehooker. 

A new troubleshooter memcfg file would have to be made for Daytona which reads the new memory address of rambase+0x824 and bitmasks all the lamps into outputs (pretty easy). 

It would pass those along to mamehooker and it would work as normal. 

Natively m2 emulator doesn't support outputs.  We can read their states via the lua scripts, but something external has to be called.  RamJet's app and TS2 are the only applications that do memory reads to actually do something with the memory locations afaik. 

 

[SailorSat]

I'm sure SailorSat is going to use a custom solution BUT.....

ME? Nah xD

I figured out what EX.START (F4 in my script) does.
It means "extended start" and as long as it is pressed down, it will keep the game in track selection screen (so other ppl can join in) without the 15 second countdown.

Also I found to additional lamps (used on special type cabinets) for "ready for tower" (OFF in attract, ON if ingame [trackselection +]) and "ccd priority" (used for video cameras). I haven't rewrote them yet, as they are mixed in the force feedback stream (command 0xE0-0xE3) and I personaly don't need em (yet).

[Jitterdoomer]

Did ramjet made a Hydraulic Seat LUA? BTW, the "live cam" feature will be programmed with your video capturing device. Right now, MAME doesn't support camera feature as of now.

If it's done on an actual special cabinet, it'll be like two years of conversion.

[SailorSat]

Well I think to control a real special type cabinet from either M2EM or MAME will require some extensive tweaking. A simple PacDrive (or any other 16+ channel lamp/led driver) should be enough though.

first 8 channels for the Lamps & Chutes.
seconds 8 channels for the 6 hydraulics and the 2 additional lamps.

the ccd cameras are handled by control tower. actually these are standard ntsc cameras and the control tower is a big 8 channel switcher. they will show the players on additional screens (usually on top of the game screens). nothing to spectacular...

my live cam "hack" is something different as it aims towards an ingame spectator mode.

[AMG KC]

Is there going to be a repair for the network problem?

[BigPanik]

  Great job girl!

I have already buid a program than hook the force feedback command byte to send it to the genuine SEGA Drive board via an arduino.

Now, we can light the lamps, with the same Arduino and same ULN2003 chip than used on I/O board.

I already try to modify my program, but your lamp byte is locate inside the emulator RAM. I need to read your magical byte from an external program, do you have any tips for me?

[BigPanik]

I reply myself to my question.

Posted by Howard_Casto in Feb 2013:

On the programmer side:

1.  Use a convoluted api like CreateToolhelp32Snapshot to help you find the base address of model 2, it's always 0x400000 - this step takes a bit of elfin magic, but I found some example code. 

2.  In a art money table, there's a section for all the relative spaces, the first one, which is the 50000 we added to our table looks like this:

"WorkRAM 1Mb","00500000","emulator_multicpu.exe+P0018F930,100h,

Ignore the workram bit, that's just a label.  The 500000 will be our reference point as I said before, emulator_multcpu.exe means the base address of the exe (again 40000), the P00.... is a POINTER to an address that contains yet another pointer to our value.  The 100h means once we find that address add 0x100 and that's the address to the final pointer.

3. Knowing all of that above we now use a get memory function to read 8 bytes (long) from the address 40000+0x18F930, that'll get us our first pointer

4.  Now we read a long at the address we just found +0x100, this is the  physical address  to 50000, or the work ram for model 2.

5.  Remember all of those offsets that you were supposed to determine on the user end?  You can now get the actual value of any of those addresses by reading with teh address found in #4 + the offset. 

Yeah that's about as simple as riding a unicycle. 

Thanks a lot, now my code is able to control FFB and lamps:

[retrorepair]

Fantastic work guys 

I can't tell you how long I spent looking for the lamp values in Daytona.

I did speak with ElSemi at some point and apparently the values should have been where they are in every other game but a bug prevented it with Daytona.

[SailorSat]

Mhm... That arduino interface sounds interesting

[baritonomarchetto]

Why i feel like the only one here not having fun with the lamp control, even if it was explained how to use it in some previous post? Because probably i AM the only one that understand half of what you are writing when "memory regions" and "masks" pops up 

[RamjetR]

Hi all, I was just talking to a friend about my arcades today and got me thinking I should log back in and see what the community has been getting up too... and wow have you all been busy. Great work hacking daytona and model 2 more...

Apparently new versions of the emulator too! It's been 16months since I've done anything arcade and looking forward to getting to put them back together to finish some off and play a bit more now that I've moved house officially.

Studying my dual bachelor of IT and electrical engineering and had 2 other jobs since I was last here and alot of catching up to do... So I'll get to reading pages of backstory hey?

Ramjet

[supernono]

You would use the new script along with troubleshooter 2 and mamehooker. 

A new troubleshooter memcfg file would have to be made for Daytona which reads the new memory address of rambase+0x824 and bitmasks all the lamps into outputs (pretty easy). 

It would pass those along to mamehooker and it would work as normal. 
 

hi all,  is someone trying to write this new troubleshooter memcfg file or can tell me how to do this ?

[Howard_Casto]

I'm finishing up my racing rig as we speak.  If you'll be patient, I'll add the ini myself later this summer.