Aleck64 on Retail Consoles PoC

Now that all the released titles are complete, here's direct links to all of them.

Eleven Beat
http://www.mediafire.com/download/dvds8q5dvduymte/11beat.zip

Hanabi de Doon! Don-chan Puzzle
http://www.mediafire.com/download/uax64uc3m12x5nm/doncdoon.zip

Hi Pai Paradise
http://www.mediafire.com/download/4np68pf9lo69vgd/HiPai.zip

Kurukuru Fever
http://www.mediafire.com/download/zq9bqbxib62mtb6/Kurukuru_Fever.zip

Magical Tetris Challenge
http://www.mediafire.com/download/9t162n8zsb99ayq/Magical_Tetris_Challenge.zip

Mayjinsen 3
http://www.mediafire.com/download/9kt5qb894fjo49q/majinsen3.zip

Star Soldier: Vanishing Earth
http://www.mediafire.com/download/oqeha22aooco5s6/starsldr.zip

Super Real Mahjong VS
http://www.mediafire.com/download/pgferlf0yyj6zc8/Super_Real_Mahjong_VS.zip

Tower & Shaft
http://www.mediafire.com/download/ij6clnhozbjx0sq/Tower.zip

Vivid Dolls
http://www.mediafire.com/download/s7c8kimf58mrstt/Vivid.zip

The readmes outline controls and the DIP switch settings for each and where they're located in the bootstrap.

[original post]
The Aleck64 was an arcade N64, sort of like the VS System. This is a proof-of-concept patch to enable Vivid Dolls to run on a retail console N64.
Be sure to read the readme, as it explains how the unique CIC works. I did not alter the bootstrap; it can then be run using a bootloader and the values given in the readme and writeup. You can obviously alter the bootstrap to use another, more common one.
invalid url, use one above

Vivid Dolls isn't exactly my cup of tea. It's one of those truck-stop nudie titles. You reveal parts of a picture by drawing boxes while aliens try to blast you. One of them is a somewhat phallic-looking Moldorm that shoots white, sticky blobs at you. Real winner here.
It's only redeeming point it's a single-chip ROM and took all of half-an-hour to patch it runnable. Most other titles use multiple chips, with more than one bootable image.

Aleck titles use a unique CIC. The algorithm is the same as Diddy. The seed byte is 0xAC.
Depending on the boot address is how much data gets read in. If the address is 80100400 (actually 80000400) it reads in 0x3FE000 from 0x1000. Any other address reads the typical 0x100000.
LaC's bootloader can force the seed value, allowing you to boot the game off a flashcart.

-Zoinkity

 

I love those shitty Qix clones.

 

It seems to run with a 6102 header just fine even though only the first 1meg is DMAd instead of 4 megs. I couldn't get the patched rom to boot otherwise (even with bootemu seed).

 

Wow I never knew there was N64 based arcade HW!?
Any good titles, anyone ever got retail n64 games to run on it?

 

According to the MAME project the CIC is NUS-CIC-5101.

http://www.mediafire.com/download/ij6clnhozbjx0sq/Tower.zip

Tower & Shaft only uses the jammastick. (Pretty sure that's what it is) It reads in all connected controllers but ignores their input.
So, here's a patched version that dual-maps controller input. Be sure to set 4K eeprom and you'll (possibly) need an 8MB pak unless you want to remap some addresses. Controls are:

• movement +pad
• button 1 B button
• button 2 A button
• P1 start start
• test mode L button
• service mode R button
• coin 1 slot c-down
• coin 2 slot c-up

Don't hold the coin buttons down for more than half a second or the thing will probably return a coin error. Honestly, just turn on free play from the service menu. Eeprom saves the setting.
Also, they only used digital movement. I'm not mapping analog just to make it digital. That's a lot of work for absolutely no benefit.

It's using the Aleck bootstrap with a single opcode alteration so it passes the correct seed value through. Also, the DIP settings are written to 0xC00, an unused portion of the bootstrap, so you can edit them easily without having to recalc the checksum.
Surprisingly this one works properly emulated if you ignore the writes to ROM and give it a name.

Regs in Tower & Shaft. Italicized ones are read but unused.
0800000 DIP switches. &7 for coin options
E0800002 jammastick

• 0001 P1 up
• 0002 P1 down
• 0004 P1 left
• 0008 P1 right
• 0010 P1 button 1
• 0020 P1 button 2

E0800004

• 0001 start P1
• 0002 start P2
• 0020 test
• 0010 service
• 0004 coin 1
• 0008 coin 2

ZSIJ is a bootloader used by the Aruze Corporation for all their titles. It isn't necessary for our purposes.


!An Important Note About Eleven Beat!
The "good" dump listed in MAME is not a good dump!
80002264() is a file decompressor. It decrements the length of each write from the output size until it equals zero. The loop point is at 80002468.
Problem is several files have bad data in them, and since equality is tested any bad run will cause the algo to run forever. The first example of this is right at the start of the attract demo.

A simple fix to force booting would be to change 80002468 (0x3068) to:
1D00FF9C BGTZ T0,800022DC
The resultant file is still buggered to snot, but copying will stop at an overrun. Most files are little more than images, and outside of bad images looking corrupted there's no harm. However, other files (display lists, for example) will still cause a crash. First example of that is at the end of the attract demo.
The only plus side here is you have time to add a coin, which would bump you to the title screen. There's a bad graphic here, but non-fatal.

The same files throwing errors in-game throw errors in static decompression. I'd suggest a redump of the title.

 

Impressive advance Zoinkity . Could these Aleck64 roms run in everdrive flashcart? or only in 64drive units???

I can´t run it using ips patches provided in zip, maybe bad dump, or flashcart limits. Would be cool one step by step tutorial ;-)

 

How can I get an unbyteswapped copy of this rom?

I have tired to patch the MAME rom but it doesnt work, the file is wrong.

 

^ You can unbyteswap. It's 16bit byteswapping. Some hex editors (hexedit 4.0, free) can do it, there's tools made to do it, and you can use simple scripts like this in python:
from array import array
with open(filename, 'rb') as f:
a = array("H", f.read())
a.byteswap()
with open(filename, 'wb') as f:
f.write(a.tobytes())


Triple whammy today. Here's conversion patches for Kuru Kuru Fever, Hanabi de Doon! Don-chan Puzzle, and the Aleck version of Star Soldier: Vanishing Earth.


Kuru Kuru Fever, the sort of disturbingly-cute puzzle game only Japan can deliver.
http://www.mediafire.com/download/zq9bqbxib62mtb6/Kurukuru_Fever.zip


Hanabi de Doon! Don-chan Puzzle, same engine as KuruFev. A roulette matching game where you have to clear out bombs.
http://www.mediafire.com/download/uax64uc3m12x5nm/doncdoon.zip


Star Soldier: Vanishing Earth, which is probably fairly close to the N64 version. Typical SHMUPS with secret branches.
http://www.mediafire.com/download/oqeha22aooco5s6/starsldr.zip


All require 8MB expansion paks. KuruFev and DoncDoon also requires a 4K eeprom if you want to save settings and scores.
Read the readmes for info on controls and DIP switch settings.


Controls on those mahjong games are going to be difficult to say the least.


Annoyingly, hacked the controls into Mickey in about 5 minutes. It's vastly easier than the others, since they mapped the joystick over the controller registers. Also implemented the S2D save. For whatever reason there's either some kind of anti-piracy or DL priority issue that prevents pieces from being drawn in the play area. Working on it ;*)

 

Thank you very much for these patches.

Someone could patch all these games and share roms?

Thanks in advance.

 

[edit]
False alarm? Let me know if anyone experiences a coin error on boot.

http://www.mediafire.com/download/s7c8kimf58mrstt/Vivid.zip
Amended the Vivid patch so now it's more standardized and uses button controls for the hardware switches.
The big improvement in Vivid is it now accepts both stick and +pad for movement.

The special controls are:
L test
Z service
c-up coin slot 2
c-down coin slot 1
They don't reset state so try to press them quickish. You can get a coin error though holding down the button.

Added a DIP switch setting to force the jammastick. Otherwise, changed their mask+equality test into a mask to seemlessly switch between +pad and stick based on input. DIP settings are at 0xC00 in ROM and changes do not require recalculating the checksum.

Another piece of trivia: the way the +pad is disabled indicates the type of directional input used. It can be disabled two ways:
0C00 up+down
0300 left+right
That said, most titles simply check if all directions are set high (0F00). When they are the stick or joypad is used instead.
Here, they distinguish between the 3D stick (0300) and jammastick (0C00).

For those interested it will (normally) fail the SDRAM test. SDRAM is a 4MB save file at C0000000. It has no relation to rdram or eeprom at all. It isn't used in this title, but you should probably know this.
It's been implemented here as a part of cart ROM--0x400000 through 0x800000--for no reason other than I thought it was funny. If your cart ROM space is R/W capable (i.e.: via 64drive or v64jr.) the test will pass. There is no advantage to this other than bragging rights (lame ones at that). why anyone woudl need that kind of data is questionable, unless it was alternate ROM space or for dumping rdram.
The TLB mapping 01000000 in Aleck titles is always going to point at it, even though it usually isn't present ;*)

I may have to make some changes to the other patches in turn.

 

going to try this out this morning. super job Zoinkity

 

Running these Aleck64 ROMs is quite great Also, this runs on my Everdrive 64 1.0 OS 1.28, it might be a bug in later versions, too much CRC checking or auto-correction.

 

I tried patching Tower and Shaft several times and wasn't sure what I was doing wrong. Then I tried it in the old ED64 OS 1.28 and the game worked perfectly. Booting it in the latest OS 2.08 just gives the error "Corrupted ROM - BAD CRC". I don't suppose anything can be done about this? Most Everdrive users use the latest version.

 

Can you share patched games guys?
Thanks.

 

Just go to any MAME rom site and grab the games from there. There's detailed instructions on what to do then inside every patch zip file - it's not hard at all.

Re: your earlier requests - get ucon64 to byteswap, and also to apply ips patches.

 

Don't have an Everdrive, but from that error it's trying to recalc the checksum which, well, it can't.

http://www.mediafire.com/download/dvds8q5dvduymte/11beat.zip
Here's Eleven Beat. Same as usual: 8MB, NTSC. It's really a 4MB game but having someplace for that hardware is nice.
MAME just recognised a new "good" ROM dump, so verify yours against theirs. Patches are for unbyteswapped files, so unswap them if they are.

I've received a couple questions about the hacked bootstraps and why a bootloader is necessary. Aleck titles use a different CIC chip--the 5101--and naturally have a unique bootloader. Now when normally booting the CIC, PIF, and bootstrap all work in parallel. The CIC generates a seed byte used for checksum algorithms. The PIF uses this seed to generate a sort of checksum for the bootstrap, and if bad locks the CIC chip. Otherwise, it passes the seed to the bootstrap that then does the cartridge checksum with it.
A bootloader avoids steps one and two entirely. It loads itself normally, then restarts the boot sequence part way when loading the second ROM. It simply passes settings of your desire to a partial version of the PIF code and the bootstrap.
Aleck titles aren't currently supported by the normal bootloaders, so a single opcode was added to the bootstrap to set the seed byte to the originally expected value. If run through the whole boot sequence it would fail the bootstrap check, but the alternative would be to completely swap bootstraps entirely. That isn't hard, but since bootloaders also happen to avoid checksums that makes the bootstrap a convenient place to stuff the initial hardware state. If the bootstrap is already getting hacked, might as well go all the way.

So, the irony here is that completely accurate emulation of the console would fail on these, despite them working on hardware. Voodoo codework at its finest ;*)

Haven't worked out the issue with Magical Tetris just yet. Just like MAME the play field is occluded. I don't think there's a difference in the RCPs, but haven't spotted any obvious software protection either. Time for some serious display list comparisons with the console version.
Mayjinsen is...confusing? It's currently chasing its tail waiting for a function pointer it never receives. Internal structure is equally annoying. Problem is, it's the last title that doesn't involve special combinations to emulate a field of ~20 buttons before hardware switches. Otherwise, both mahjong games boot without issues on a retail N64.

 

Welcome back everyone. In the last while Krikzz added OS 2.09 which now makes these Everdrive 64 compatible.

Just want to confirm with you Zoinkity, there isn't a good dump of the Eleven Beat ROM out there? Your instructions say to find nus-zhaj-0 but all I've been able to find is nus-zhaj. I've applied your patch to the latter and it seems to work just fine so far.

 

There is a new good dump, very recently. (as a result of this actually)
For the bps to apply it would have to be identical, and if it were the bad dump it would enter an infinite loop trying to decompress a broken file right at the beginning of the attract demo.

So huzzah! You have the right one.

There are still three ROMs with bad internal checksums:
1) Magical Tetris
2) Mayjinsen
3) the funky bootloader thing ZISJ

Magical Tetris still runs but certain images and audio have minor corruption. For example, on the right of the large "1" is a stray pixel. It follows a regular period and certain rules, so I think this patch should adapt the ROM currently recognised by MAME as the "good" one into what will match a good dump. Can't say for certain since there isnt' a good dump yet though ;*)
[edit]
A good dump was finally taken and surprisingly matches the patch above. o.0

Should be able to fix the problem with the play field in Magical Tetris. It's drawing it to a spare buffer that normally hardware overlays to the screen. Writing the data works fine, but need to add in some code to manually draw these to the framebuffer or something. Busy with a different project at the moment though.

 

Big thanks for getting these roms patched, have enjoyed playing the 6 available so far on an Everdrive64!

 

Thanks again Zoinkity for releasing these patches. I highly doubt I would've even known about these games otherwise. I've played all 6 titles for about or hour or so each now and with the exception of Vivid Dolls they're all pretty fun. Gotta say I like the puzzle games Kuru Kuru Fever and Donchan Puzzle the best.

I just did a page the 6 games: http://micro-64.com/database/aleck64.shtml I'll update the page if you get those other games working.