Author Topic: Dreamcast and 3DO firmware updates  (Read 149 times)

Offline Maddog

  • Moderator
  • Full Member
  • *****
  • Posts: 122
Dreamcast and 3DO firmware updates
« on: July 10, 2017, 10:10:11 AM »
Did some work on the Dreamcast and 3DO firmware dats, adding emulator usability and some unique brand new files in the process.
Hope you guys enjoy the additions.

Yours truly dumped the Treamcast BIOS and FLASH. For those not in the know, Treamcast is a (nowadays rare, expensive and sought-after) chinese region-free clone with built-in screen. The BIOS and FLASH were dumped in software form, using httpd-ack. There are minimal changes in the BIOS compared to the standard 1.01d, only 4 bytes were changed. It is currently not known if there's an actual new chip in there or just a modchip changing on the fly the standard chip's output. The latter is more likely. I am too chicken/useless to open my console up, never been a hardware guy!
With the always excellent help of MetalliC, these files were added to MAME and also verified to be working on actual Dreamcast hardware, meaning the modified BIOS passes the HOLLY checks (purely out of luck as the protection algorithm is known to have weaknesses). So here's your perfect chance to mod your DC with a region-free BIOS.
While I was at it, I decided to add FLASH dumps to the dat as well. These are required for emulators' use, as emus need both BIOS and FLASH in order to work. They contain some console settings and games are also allowed to store information in there. There's no way to get a standard dump, as FLASH chips are not ROM and their contents change. Even getting a brand new console and setting it up with an IP address to use httpd-ack would modify the FLASH contents. Due to the massive variety possible, I decided to go with the same dumps that exist in MAME. This means that anyone wishing to emulate the DC, has all the necessary files available in one dat increasing usability.

Significant changes were made, adding new files and functionality.
By far the most significant is the addition of a PAL BIOS. Until now, all BIOSes in the TOSEC dat and also in MAME were NTSC. This BIOS (found floating around the Internet as "Anvil" BIOS) comes from a European FZ-10 unit apparently. It runs at 50Hz on Phoenix emulator (unlike all previous known BIOSes that run at 60Hz) and by using it you can boot many games that previously were having problems or even not booting at all. Note it is strongly recommended to use Phoenix emulator as it seems to be the most accurate out there. The other known emus try to force 60Hz even when running with the PAL BIOS, resulting in games stuttering.
Some examples of games not working unless using the proper PAL BIOS are Alone in the Dark (EU), Powers Kingdom (EU) και Sampler CD for PAL System (EU). An example of a game running smoothly in Phoenix but stuttering in 4DO due to wrongly forced 60Hz is Super Wing Commander (EU).
Of course all these findings go against the pretty common opinion/misconception that 3DO is a fully region-free console. While there are no checks for region protection in place, compatibility is not 100% regardless of region! It also means we are probably missing BIOS dumps from PAL Goldstar and FZ-1 BIOS. Sanyo AFAIK was Japan only. Hardware guys, take note.  ;)
Also, someone should add this BIOS to MAME as the current 3DO driver shows even the PAL consoles using the previously known NTSC BIOS, which appears plainly wrong.

Further additional functionality was obtained by adding the Kanji ROM. This exists only in Japanese models and there are a handful of Japanese games that will not work without it, making them unplayable in Western consoles or emulators where this dump is not present. Ones I have confirmed to require its' presence are Blue Forest Story/Monogatari (JP), Sword & Sorcery (JP) and Twinkle Knights (JP). The dump was again found floating around the Internet, known as "ROM2". Copyright found in the binary appears to point to Panasonic origin of this particular dump. However, the dump has an odd size (933636, doesn't even divide by 8 or 16!) and no further info is known. Since it works properly in emus, it was added as-is, but it's very unlikely to be a correct proper-sized dump. Decided against marking it as bad unless a proper-sized version appears.

A final addition was proper identification of the previously existing [h] of the FZ-10 BIOS. This is actually a cracked version that disables the RSA security, which allows booting only when code is encrypted. Using this BIOS, I was able to boot the American Laser Games arcades (Shootout at Old Tucson, Mad Dog Mc Cree II, Orbatak) and also the Killing Time unencrypted beta. All these will end up in the "insert disc" screen if booted with the regular BIOS. Only 2 bytes are changed in the cracked version by the way. As the Goldstar and Sanyo BIOS also contained the same byte sequences, it was fairly trivial to produce RSA-disabled versions of these BIOSes as well. They were successfully tested with the same disc images reported above. Note that in arcade games you can only see the attract sequence, as there's no way to insert coin in current emulators.

All these changes will appear in the next version of the dats and I hope that people that actually play games instead of just collecting ROMz enjoy these new additions as they open up some interesting possibilities as described above.  8)

Offline PandMonium

  • Administrator
  • Hero Member
  • *****
  • Posts: 1304
Re: Dreamcast and 3DO firmware updates
« Reply #1 on: July 10, 2017, 03:12:49 PM »
Excelent work  O0