TOSECdev Forum

TOSEC Project => TOSEC ISO => Topic started by: Maddog on July 10, 2017, 10:10:11 AM

Title: Dreamcast and 3DO firmware updates
Post by: Maddog on July 10, 2017, 10:10:11 AM
Did some work on the Dreamcast and 3DO firmware dats, adding emulator usability and some unique brand new files in the process.
Hope you guys enjoy the additions.

Yours truly dumped the Treamcast BIOS and FLASH. For those not in the know, Treamcast is a (nowadays rare, expensive and sought-after) chinese region-free clone with built-in screen. The BIOS and FLASH were dumped in software form, using httpd-ack. There are minimal changes in the BIOS compared to the standard 1.01d, only 4 bytes were changed. It is currently not known if there's an actual new chip in there or just a modchip changing on the fly the standard chip's output. The latter is more likely. I am too chicken/useless to open my console up, never been a hardware guy!
With the always excellent help of MetalliC, these files were added to MAME and also verified to be working on actual Dreamcast hardware, meaning the modified BIOS passes the HOLLY checks (purely out of luck as the protection algorithm is known to have weaknesses). So here's your perfect chance to mod your DC with a region-free BIOS.
While I was at it, I decided to add FLASH dumps to the dat as well. These are required for emulators' use, as emus need both BIOS and FLASH in order to work. They contain some console settings and games are also allowed to store information in there. There's no way to get a standard dump, as FLASH chips are not ROM and their contents change. Even getting a brand new console and setting it up with an IP address to use httpd-ack would modify the FLASH contents. Due to the massive variety possible, I decided to go with the same dumps that exist in MAME. This means that anyone wishing to emulate the DC, has all the necessary files available in one dat increasing usability.

Significant changes were made, adding new files and functionality.
By far the most significant is the addition of a PAL BIOS. Until now, all BIOSes in the TOSEC dat and also in MAME were NTSC. This BIOS (found floating around the Internet as "Anvil" BIOS) comes from a European FZ-10 unit apparently. It runs at 50Hz on Phoenix emulator (unlike all previous known BIOSes that run at 60Hz) and by using it you can boot many games that previously were having problems or even not booting at all. Note it is strongly recommended to use Phoenix emulator as it seems to be the most accurate out there. The other known emus try to force 60Hz even when running with the PAL BIOS, resulting in games stuttering.
Some examples of games not working unless using the proper PAL BIOS are Alone in the Dark (EU), Powers Kingdom (EU) και Sampler CD for PAL System (EU). An example of a game running smoothly in Phoenix but stuttering in 4DO due to wrongly forced 60Hz is Super Wing Commander (EU).
Of course all these findings go against the pretty common opinion/misconception that 3DO is a fully region-free console. While there are no checks for region protection in place, compatibility is not 100% regardless of region! It also means we are probably missing BIOS dumps from PAL Goldstar and FZ-1 BIOS. Sanyo AFAIK was Japan only. Hardware guys, take note.  ;)
Also, someone should add this BIOS to MAME as the current 3DO driver shows even the PAL consoles using the previously known NTSC BIOS, which appears plainly wrong.

Further additional functionality was obtained by adding the Kanji ROM. This exists only in Japanese models and there are a handful of Japanese games that will not work without it, making them unplayable in Western consoles or emulators where this dump is not present. Ones I have confirmed to require its' presence are Blue Forest Story/Monogatari (JP), Sword & Sorcery (JP) and Twinkle Knights (JP). The dump was again found floating around the Internet, known as "ROM2". Copyright found in the binary appears to point to Panasonic origin of this particular dump. However, the dump has an odd size (933636, doesn't even divide by 8 or 16!) and no further info is known. Since it works properly in emus, it was added as-is, but it's very unlikely to be a correct proper-sized dump. Decided against marking it as bad unless a proper-sized version appears.

A final addition was proper identification of the previously existing [h] of the FZ-10 BIOS. This is actually a cracked version that disables the RSA security, which allows booting only when code is encrypted. Using this BIOS, I was able to boot the American Laser Games arcades (Shootout at Old Tucson, Mad Dog Mc Cree II, Orbatak) and also the Killing Time unencrypted beta. All these will end up in the "insert disc" screen if booted with the regular BIOS. Only 2 bytes are changed in the cracked version by the way. As the Goldstar and Sanyo BIOS also contained the same byte sequences, it was fairly trivial to produce RSA-disabled versions of these BIOSes as well. They were successfully tested with the same disc images reported above. Note that in arcade games you can only see the attract sequence, as there's no way to insert coin in current emulators.

All these changes will appear in the next version of the dats and I hope that people that actually play games instead of just collecting ROMz enjoy these new additions as they open up some interesting possibilities as described above.  8)
Title: Re: Dreamcast and 3DO firmware updates
Post by: PandMonium on July 10, 2017, 03:12:49 PM
Excelent work  O0
Title: Re: Dreamcast and 3DO firmware updates
Post by: Boojakascha on March 16, 2018, 07:40:25 PM
Dear Maddog

I would like to make Shootout at Old Tucson running on a real console. Do you have the BIOS as well as a hex file, which I could try to burn on to a ROM? I am thinking of removing my BIOS chip, give it a socket and then swap chips for my needs in order to play this beauty.

With kind regards
Title: Re: Dreamcast and 3DO firmware updates
Post by: Maddog on March 17, 2018, 07:30:31 AM
Dear Ben,

TOSEC is not sharing the actual files as they are still copyrighted. We make only dats with hashes so others can identify the files they have. However, there are several other places on the web that have the actual files so I suggest Googling for this. The BIOS you are after can be found on the 3DO Interactive Multiplayer - Firmware dat. In the current version, look for any of the BIOS marked [RSA disabled]. If you run into an older version of the dats, find the [h] one-it's the same thing. AFAIK, this will boot Shootout at Old Tucson. Or at least I was able to do it under emulators like Phoenix this way.

Unfortunately for you and all of us wishing to sample the game, this is not enough to actually play the game. This game is an actual arcade, so when the game boots it runs through its' attract mode and waits for coin input. The normal 3DO consoles do not have this functionality and you can't "insert coin" so you can't start the game. I suppose this could somehow be hacked, but this is far beyond my knowledge and ability.
Title: Re: Dreamcast and 3DO firmware updates
Post by: Boojakascha on March 17, 2018, 11:14:50 AM
Dear Maddog

No problem, thanks to your descriptions in the upper text I was able to remove RSA myself in a FZ-1 BIOS (you see I need a FZ-1 bios as the arcade cabinet used those).

And it works splendidly. Never edited roms before. Thanks a lot =) Now it runs the attract mode. You see, I don't think I will ever get an emulator to insert coins, but I am quite confident that I will be able to do so with real hardware. I have lots of ideas to tinker around with this thing^^
Title: Re: Dreamcast and 3DO firmware updates
Post by: Maddog on March 18, 2018, 06:20:56 AM
That's lovely news, it's always a very nice feeling if someone finds a post I did useful.  :)
If you do manage to get it to playable state, I would appreciate seeing a video or something...
Good luck!

PS: the FZ-1 BIOS (and your RSA-disabled crack of it) can be added to the TOSEC dats if you are so inclined. I think they are not available right now.