OutRun Toolchain & Bootloader

Here's an amazing project from blog reader Alex Bartholomeus (aka deadline). It's a hardware interface, gcc based toolchain and software bootloader for the OutRun boardset. It allows you to upload and execute C or assembly based software on the original hardware.

The Hardware

The connecting hardware is veroboard/prototyping board based, and uses simple TTL buffers/inverters (74HCT04). The interface partially implements the IEEE1284 spec as the basis for communication. The hardware utilises the unused digital input pins on the port that has the start and coin inputs. There are 16 in total, and these can be read as is done in the game. Output is achieved through bits connected to the start light, brake light and external mute. 

The Bootloader

The bootloader is coded in 68000 assembly and must be programmed to the master CPU eproms. It implements the protocol without using any RAM (not even the stack), so that everything can be overwritten by the uploaded code. It also forwards interrupts from ROM to the same locations in RAM, so it's transparent to build binaries for uploading or plain eprom images. The interface only supports uploading code into RAM so it's limited to 2x32kb banks, minus the actual memory one would need. So uploading a complete outrun image would be impossible. But splitting the data (if there is any) and keeping that in the upper 2x256kb of ROM would be feasible.

The Toolchain

The toolchain consists of cross-gcc (C only), some linker scripts and a basic supporting library. The bootloader source code offers a nice example of how to code a basic program to run on the hardware. 

Some videos of the setup can be found here and here. Alex plans to release the package including schematics and source code at some point soon. Then we can have an oldskool demo coding competition or similar! 

Sega System 16 Sprite Viewer

Edit: These instructions are now dated, but please follow the link below for the latest version and instructions.

Here's a quick and dirty tool to view sprites stored in Sega's System 16 format. I searched for something similar, but couldn't find anything, so coded my own.

To use the tool, you will need to place the appropriate sprite files in the roms subdirectory.

The easiest way to determine which rom filenames you require, is to look at the relevant MAME driver file. Here are some links:

System16A & System16B

OutRun and Super HangOn

Afterburner & X-Board titles

Y-Board titles

Find the section where the sprites are loaded. You must load the files in blocks of four. Some games have multiple banks of sprites. Here's an example for OutRun:

For example, in this case, to load the first batch of sprites you would run the tool as follows:

s16GfxViewer mpr-10371.9 mpr-10373.10 mpr-10375.11 mpr-10377.12

And for the second sprite bank:

s16GfxViewer mpr-10372.13 mpr-10374.14 mpr-10376.15 mpr-10378.16

One thing to note is that the sprite data does not contain palette information. By default the tool displays the files using a pseudo-greyscale palette. 

However, for OutRun I've extracted the sprite palettes from the 68000 program files. And you can toggle through all 255 palettes by using cursor left and cursor right. Unfortunately, there is no automatic way of determining which palette goes with which sprite. This information is hardcoded by the game at runtime. Some sprites can use more than one palette. 

One cool use for this tool will be to search for unused graphics in Sega titles. Please comment below and post a screenshot if you find any.  For example, here is an unused start banner from OutRun that is revealed by palette switching (using palettes 41 and 42):

I will be posting the source code to this tool when I release the Cannonball source code before the end of the year. Maybe someone wants to have a go at locating and including the other palettes. 

Download here

Page Up/Page Down: Scroll Page

Cursor Up/Cursor Down: Fine Scroll

Cursor Left/Cursor Right: Change Palette (OutRun palettes only) 

Space: Save a BMP

Power Drift Easter Egg

Ding Ding Round Two! This time, we're pulling Power Drift apart. A crazy game, with some amusing secret messages, that I don't think have ever been revealed.... After 20 years, it's surely time to see what the developers were smoking.

As I realised during my OutRun work, AM2's titles contain weird and wonderful content. Power Drift it no exception, and I soon found text about elephants and various smells by examining the memory in MAME.

Then it was a case of tracing through tons of code to figure out how it was used. To complicate matters, there was a nasty red herring. If you enter SEX on the high-score table, you will see the message DANGER DANGER!

I thought I'd solved the puzzle, as searching for the string 'SEX' in memory revealed the following location:

You'll notice that the first three characters spell SEX, followed by various other letters. I recognised some of these initials as belonging to the AM2 development team, so I presumed entering the other names would invoke the other messages. Unfortunately, this wasn't quite correct. The fragment of code I'd uncovered that used the above table didn't seem to be called when I entered a name. 

Instead, I found a manual check against 'SEX' hard coded elsewhere. Here is some of my commented disassembly: 

What was going on? By examining the code, I realised that if you held BRAKE and pressed START when entering a special name, a separate function would execute. Bingo, this was the section that read the larger initial table. And now, we can display messages regarding elephants written in somewhat dubious English:

Not only that, but for each special name entered, you generally receive a different message dependent on which gear you are in. Here are some others, that amused me:

Well, finding other messages becomes easier when you've decompiled the code. A summary of the messages follows :)

When Brake & Start Button Depressed:

SEX: DANGER !! DANGER !!

When Brake & Start Button Pressed (Select one of two messages with gear):

SEX:  LAKE YOU ? ME TOO ! & MACHINE T.K.G.!!

KEY: I LOVE MAKIKO. & I LOVE CYNDI.

TKG:  I LOVE RAY CHAN. & I LOVE RIE CHAN.

GAK: SAKICHI !! KITARO !! & I LOVE CHISAKI !

OKA: I AM TALLER THAN T.K.G. ! & KIM SAN ISSHOU TUITE IKIMASU.

REE: HALLO !! LETS FIND ANOTHER MESSAGES. & ARE YOU M2C2 MENBER?

NAK: NIGASITA SAKANA WA DECOI.

AKI: LUCY IS MINE! & EMILY IS MINE!

MAT: DO YOU KNOW ELEPHANT SMELL??

SAD: I LOVE KAYURI CHINA & NS400 IS FARSTEST BIKE IN THE WORLD.

HIR: MUSIC DESIGN BY HIRO. & SOUND DESIGN BY MY DESHI.

Afterburner Easter Egg (Dev Credits)

Today I decompiled a portion of Afterburner II's code to investigate some unused developer text I found in the ROM.

I traced the usage of these strings back through the code, with some manual IDA work. In the end I landed on the following function which enables the related block of code:

This revealed that the text could be triggered on the Continue Play screen, providing the player hadn't already inserted a coin.  On this screen you must press the cannon button (fire 1) four times, the missile button (fire 2) twice, followed by the cannon button again. 

On inserting a coin and resuming the game, a (c) SEGA 1987 message will now be shown:

Message 1: (c) SEGA 1987

But what of the other text strings? Unfortunately, it appears that you can only display them using the Mame debugger. The routine to display them is present in the code, but the counter to select the message (which should increment each time you do the cheat), is broken as it resets when the Continue Play screen initializes. I think the original intention was to cycle the message each time the player entered the cheat code, but for whatever reason that never happened. 

You can manually set the counter (0x3F9126) to override this behaviour. Let's take a look: 

Message 2: Presented By Sega

Message 3: I Love Momoko

Message 4: Programmer Credits

What's interesting is Satoshi Mifune's name appears in the credits here, who later programmed titles including Shenmue and Virtual Striker. It's very difficult to find out the dev team members of these early AM2 titles, so great to have this proven. I wonder who Momoko was... 

I also investigated Afterburner I. It contains a similar routine, but is tougher to activate. This is because after pressing fire1 x4 and fire2 x2, you must almost simultaneously coin-up and start.

Gamest Issue 4 - November 1986

Check out this issue of the Japanese magazine Gamest, that covers the 1986 Amusement Machine (AM) show, where Sega previewed OutRun. Gamest is an amazing publication although it would be even better if I understood Japanese.

I've scanned the colour pages relating to OutRun below. I love the cover advert; it's similar in style to the Japanese flyer. Click the images for a full-size version.