Tuesday, September 06, 2011

Space Harrier: Enduro Racer Edition

This is a customized version of Space Harrier, modified to run on Enduro Racer hardware.


This means that the game is fully playable on the Enduro boardset without the programmed security i8751 CPU.

Normally, if you try to run Space Harrier on Enduro Racer hardware, the game controls will not function and therefore the game is unusable.

I'd like to thank Mark at retroclinic.com for performing the hardware testing. Without him, this wouldn't have been possible as I don't own either boardset. Please note that currently this requires Enduro Racer hardware with the earlier YM2203 sound board.

Download here: sega_enhanced_v201.zip

Version 2.0.1: Incorporated into Sega Enhanced package. Fixed lives bug. 
Version 1.0.1: JunoMan from Sega Resurrection suggested a more elegant solution. Results should be the same. Thanks! 
Version 1.0.0: Initial Release

Please note that no portions of the original game code are included in this package.

13 comments:

JunoMan said...

An easier way to do this is to patch the rom to use the existing routines which happens to be in front of the vblank code. (I guess it's triggered by the 8751 or done in the mcu code)

Patch the RTI @ $1228 to NOP so the first interrupt routine falls though to the 2nd

Patch the VBLANK vector ($0072) to point to $1228 instead of $1268

Then you only need to re-program the epr7184 rom with 2 changed bytes.

Great work on the Outrun code btw..

Junoman

edit: my bad.. check hex addrs before publishing

yt said...

Interesting. Will look into that at some point this week and make the adjustment if it seems sound.

I had assumed that the entire routine was contained within the 8751 and wasn't in the 68k code.

Either way, it won't make too much difference to the end user. My solution also autopatches the checksums to be correct as well btw :)

JunoMan said...

The code was left over from when the game was developed and never removed when sega implemented the security. I remember now, as there is no interrupt vector pointing to the code.

Changing $FF0 to A57C would fix the checksum test.

The SHARRIR1 set needs $FF0 changing to A894.

Also missing is the countdown the mcu does at the start. It halts the 68000 and displays the count down. Not sure exactly what it's doing but it doesn't seem important.

The main different to the end user is that only 1 rom (ignoring the rom test) would need re-programming/buying.

This patch has been tested on real hardware too.

yt said...

If this solution works, it is certainly more elegant so thanks for pointing me towards it.

However, some questions: looking at the code in the Space Harrier routine you referenced, it is slightly different to the Enduro routine.

For example, the Enduro routine has a bunch of NOP delays after writing to $140021 and $140031 (effectively selecting the ADC, then writing to it).

Have you tried this on Enduro Racer hardware? Just naturally wary to go from something that is proven to work, to something new.

yt said...

PS I might be ordering a Turbo OutRun kit off you shortly... will see what state the boardset I just bought is in once I make it to the post office. :)

RetroClinic said...

The countdown is the MCU doing a checksum of the ROMs. There are two versions of the ROMset, and two different programs in the 8751, and they're not compatible. So using A version ROMs with non-A 8751 will hang after the countdown. Mark.

yt said...

I updated the release with your patch JunoMan.

Any other interesting discoveries you fancy sharing? :)

JunoMan said...

After some discussion on the UKVAC facebook page with fellow coder Adrian Smethurst, SH World Champ Philip Campbell and myself, we have come up with a fix for the automagical crediting after 512 seconds of play thats been a bug in mame since 2008

The fix for the game code is to eliminate this move of a trigger ram location to the game work flag.

00004E86 : move.b $400f1.l, $124307.l ; 13F9 0004 00F1 0012 4307

to

00004E86 : move.b $400f1.l, $400f1.l ; 13F9 0004 00F1 0004 00F1

patch epr-7184a.ic84 to

$2746 = 04
$2747 = f1

and patch epr-7188a.ic97 to

$2747 = 00

A driver patch has been submitted to Mame

Chris

JunoMan said...

As always, many ways to skin a cat..

An alternative patch from Adrian is to change

patch offset $3ae8 from $67 to $60

Chris

Video Archive said...

Does this solution still require "Enduro Racer hardware with the earlier YM2203 sound board"?

Markus Steinbacher said...

can i use this patch on an bootleg enduro racer too ?
there is no fd1089 on this pcb.

greetings
markus

yt said...

Good question. I don't know unfortunately as I haven't investigated the bootleg hardware or ROMs. Chances are there will be some differences.

I'd recommend getting the latest version of the patch which is here:
http://reassembler.blogspot.com/2011/08/outrun-enhanced-edition.html

Markus Steinbacher said...


does the readout from the prom help you ?

i found an YM2151 on the original pcb, is this possible too ? if not, whats the differeence to the other Sound ic ?
Maybe I can burn the mame rom to the Audio CPU ?