The Last StarPak (A Tale Of Rare Cartridges)
Let me get back to the recent post about the Galaxy Games cartridges, because we have a nice update!
About a week ago programmer Keith M. Kolmos (@KeithMKolmos)
managed to locate, among his archived data, the development files for the only remaining undumped cartridge, StarPak 4.
Thus, while no production StarPak 4 cartridge has been spotted to date, we do now have all the data needed
to emulate these elusive games. That includes the PIC program used for protection, which might have been impossible to extract from the real hardware anyway. Kudos to Keith for sharing.
The development cartridge had eight 8Mbit EEPROMs, so we got 8 binary image files, plus an hex file for the PIC.
For production, the game data was copied into two 32Mbit FLASH parts.
The PIC code appears functionally identical to that from cartridge #3, but the bytes returned during the initial handshaking were changed.
Here's the selection of games in StarPak 4:
Prominent among the lot is the remake of Stern's Berzerk, which greets the player with (samples of) the well known synthesized speech:
Neon Nightmare is a cute test for your coordination skills as you try, as a humble moth, to avoid getting zapped in a maze of neon lights:
Orbit is a color-matching game set in space. Moons have to be skillfully inserted into the orbits of the circling planet with the right tint:
Some nice rendered graphics in Deep Sea. Your submarine and its torpedoes against a fleet of enemy ships:
Another classic board game, Reversi (aka Othello), is presented with an Egyptian flavour in Scarab:
Orbit Freefall is a variation of the previous planets game with some additional twists:
We got to the last two games. As you can see there are major issues. Most of the moving graphics are garbled.
It's probably the emulation at fault rather than the data, but I couldn't spot an obvious cause yet (e.g. in the blitter logs).
Anyway the titles are:
Star Tiger, a spaceships battle with Asteroids-like controls (thrust and fire):
Finally Battle Checkers, features tanks in place of the usual round pieces, and a short-tempered sergeant to keep you on your toes:
Thanks to Keith M. Kolmos, Brian Troha and The Dumping Union
Tekken Card World
ShouTime is on a dumping spree and so we got a Tekken-themed coin pusher today!
It's a Namco medal game similar to Pac-Slot and Tobikose! Jumpman.
It uses super deformed Tekken characters in the same vein as Super Puzzle Fighter or Pocket Fighter.
The title is Tekken Card World (鉄拳カードワールド) and like the other games it runs on cave.cpp hardware (Namco EMG4 or N-44EM PCB):
As you'd expect from a medal game, not much skill is required (read: none at all) to play this game.
Anyway, below are some images of the cabinet, borrowed from here:
There are videos of the real game in action on the net, like this one:
Thanks to ShouTime, Rob Carr and The Dumping Union
StarPak 3 (A Tale Of Rare Cartridges)
The Galaxy Games system by CES (Creative Electronics & Software) is a cartridge based PCB in a two-player
cocktail cab, with trackballs and buttons as inputs. It offers a series of mini-games targeted at the casual player (think bartops:
you can see a video of the thing in action here).
The base system includes a number of games in the BIOS while the cartridges — up to 4 can be fitted at the same time — can add plenty more.
I emulated this system and the base games several years back.
The StarPak 2 cartridge was added shortly after, but required an hack to run.
The hardware uses a blitter, implemented in a Xilinx FPGA, which was also featured in Midway's Touch Master series of games
(thus, the CES guys were clearly behind those titles too).
It's pretty rare to see these titles auctioned, i.e. only one such PCB (with StarPak 2) and one cab had been seen for sale in the last 10 years.
Yet BrianT spotted one that also came with two carts: StarPak 2, already dumped, and StarPak 3,
which was not!
The BIOS roms were also an undumped revision (v1.80 as opposed to the previously dumped v1.90).
So the The Dumping Union moved in to acquire the lot and, with the help of several
fellow MAMErs, they got it.
Coolmod dumped and documented it (with the help of Ken), here are some pictures:
Now, looking at the photos of the cartridges, you can see they contain the game code/graphics/data on SMT flash chips (center), a serial EEPROM to store the game audits/options
(tiny 8-legged chip at the bottom right) and a PIC cpu (the larger chip on the right side, different models between the carts) that is basically used for protection.
It performs an needlessly complicated handshaking with the main cpu to acknowledge it's fitted in one of the 4 slots
and that it's authentic.
In our previous StarPak 2 sample, the PIC program was not readable (protected), so in order to get to the game
I had to bypass this handshaking by patching the BIOS code. But this time we were lucky and the PIC hadn't been protected,
so we could read the program correctly.
Alas, the same could not be said for the other cartridge, the PIC in StarPak 3 was protected. Worse, this cart contained bigger roms,
thus requiring some ROM banking to be performed by the PIC itself. The BIOS knows nothing about this feature which is internal
and specific to the cart: it's all done by the game code when read in RAM by the main cpu (a 68000) and executed. It talks to the PIC to switch the higher part
of the roms in.
I started by writing a simulation of the handshaking algorithm, so that we could try and simulate the StarPak 3 banking properly,
sound and graphics would be wrong in some of its games otherwise.
The BIOS initially sends a 1-byte command (FF hex) to see if the slot is populated and by which cart.
It expects a 32-byte response from the PIC, starting with "CES1997" and followed by some bytes from the flash chips
at some fixed addresses (one byte is the cart ID).
The main cpu can read from the flash too, so it checks that the response matches the contents of the cart.
Throughout the game the PIC is challenged with sequences of 32-byte commands (not starting with FF). The bytes are random
and conceal a 4-byte key at variable offsets (depending on the value of the bytes preceding the key).
The PIC has to compute the correct 1-byte response, a hash based on the key and, optionally, on the sum of the command bytes.
If this challenge/response dance fails at any time, the games from the cartridge abruptly vanish from the menu.
And this is when something great happened... we were able to get the help of Keith M. Kolmos (@KeithMKolmos), lead programmer
on this software. He could gather from his archive the PIC code for all of the StarPak cartridges (including the yet undumped #1 and #4).
Now MAME could emulate the carts without hacks or simulations, so I ditched the old code and wrote some more to emulate and abstract
the carts as proper devices with communication (i.e. parallel-to-serial and back), switching and banking. I hooked up the PIC code and...
it didn't work!
Turns out there was a bug in the PIC core emulation related to the flags handling, which was preventing the correct answer
from the cart to the main cpu. Having just written a simulation of the handshaking in C++ it was easy to spot.
With the new code in place, even though the driver has taken a bit of a speed hit, StarPak 3 works correctly.
It features a grand total of 8 new mini-games:
It includes a licensed rendition of Atari's Centipede (by the way, here's the programmer's site):
Astro Blast is instead a Space Invaders clone with rendered alien ships:
A Mine Sweeper clone, Sweeper (same programmer as Centipede):
Word Sleuth is a word cross puzzle:
A puzzle game involving numbers, played against the computer or another player, called Ker Chunk:
Great Wall is a Mahjong solitaire with the option of using symbols instead of the traditional tiles:
You must play as batter and then pitcher in the baseball game Diamond Derby:
Finally Pull! is a skeet shooting simulation:
Thanks to Keith M. Kolmos, Rod_Wod, Sean Sutton, Soren Skou Nielsen, Russell Howard, Francis Ramirez, Tourniquet, BrianT, coolmod, Smitdogg and The Dumping Union
Read posts from last year