BS-X technical discussion

Archived bsnes development news, feature requests and bug reports. Forum is now located at http://board.byuu.org/
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

Anyone here mind me trying to make any sort of contribution?

I just wanted to ask what everyone may have thought about this thread where I mess around with a BS Zelda title.

I wanted to note that the latest BSNES is the only emulator in which the ROM behaves in -quite- that fashion. Many others simply display what appears scrambled in those as "black", with the exception of SNESGT (which has a sort of similar look, except the player is unable to move even to fall down a hole.)
Panzer88
Inmate
Posts: 1485
Joined: Thu Jan 11, 2007 4:28 am
Location: Salem, Oregon
Contact:

Post by Panzer88 »

interesting, I wonder what caused the change in this version?

byuu?

hmm, we should check all other known bs-x games for differences too.
[quote="byuu"]Seriously, what kind of asshole makes an old-school 2D emulator that requires a Core 2 to get full speed? [i]>:([/i] [/quote]
Verdauga Greeneyes
Regular
Posts: 347
Joined: Tue Mar 07, 2006 10:32 am
Location: The Netherlands

Post by Verdauga Greeneyes »

As far as I can tell from his post it's not that the latest version of bsnes changes the behaviour, he just happened to try it with bsnes right after the new version was released.
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

I ginuea-pigged around with some BS-X ROMs before, but that was quite a bit ago. I should probably try it again.

I recall on my last check there were a decent amount that seemed to do "Error 09" even from what looked like a good "original" dump (Albeit not quite -verfied- good dumps... but some hacked and bad dumps get past this and boot. Hrm.)

Also, for Soundlink games like Sekiban the header needs to be modified for the game to appear on the BS-X Bios menu (Because it's apparently not meant to load that way.) In this case simply changing a single byte in the hex editor did the trick. (Set number of plays to "00" instead of the setting that "locks" it).
byuu

Post by byuu »

I recall on my last check there were a decent amount that seemed to do "Error 09" even from what looked like a good "original" dump
I always seem to get that white error screen. Wish I knew what it was expecting.
Also, for Soundlink games like Sekiban the header needs to be modified for the game to appear on the BS-X Bios menu (Because it's apparently not meant to load that way.) In this case simply changing a single byte in the hex editor did the trick. (Set number of plays to "00" instead of the setting that "locks" it).
It is a hassle to have to enable games like that. I couldn't find a way to automate the header patching safely (as one image file can contain multiple BS-X games), and I also felt it was pretty hacky to modify ROMs like that.

Ideally, we should come up with the shortest possible Game Genie code to disable the header byte check in the BS-X BIOS.
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

Actaully, I think the most ideal (but also most farfetched and unlikely) solution would be to figure out how to get the BIOs to think the ROM has been put up by St. Giga to download, and then "download" and launch it, like I've seen in many of the videos I collected (BS Super Mario USA, BS Shin Onigashima, and BS Tantei Club would be good ROMs to test such a thing with.)
henke37
Lurker
Posts: 152
Joined: Tue Apr 10, 2007 4:30 pm
Location: Sweden
Contact:

Post by henke37 »

Good idea, too bad that it would require faking a full received broadcast from the satellite. And I don't think those where dumped very well, if at all.
Panzer88
Inmate
Posts: 1485
Joined: Thu Jan 11, 2007 4:28 am
Location: Salem, Oregon
Contact:

Post by Panzer88 »

maybe you wouldn't need to if you could find out what triggered events within the bs rom
[quote="byuu"]Seriously, what kind of asshole makes an old-school 2D emulator that requires a Core 2 to get full speed? [i]>:([/i] [/quote]
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

henke37 wrote:Good idea, too bad that it would require faking a full received broadcast from the satellite. And I don't think those where dumped very well, if at all.
Some were dumped better than others, but it was tough to call a long time ago when no one understood the Satellaview and thought that every dump was bad (when in actuality many of the issues were just poor emulation.)

If it helps to resolve the matter of which dumps are bad, the only two dumps going around I'm dead certain are "Bad" are the current dumps of BS Kirby no Omachahako - Guru Guru Ball and Hoshi Kuzushi.

The rest? It's tough to say - there's definitely something about the Sekiban ROMs that seem odd, but they actually boot and seem to have all the relevant data in them - just apparently not in the right places or so...? tough call.

And the BS Zelda MAP2 ROM the BS Zelda Shrine got apparently has some hacks on it, but if anything that's a sign that a good dump is potentially going around (And I've been attempting to try to un-do the hacks myself - I've apparently succeeded in making the clock behave more like an actual Satellaview clock than hack clocks in that St. Giga bios calls can overwrite the default value in the ROM (Although I apparently can't get it set back to "uninitialized" yet, but perhaps that's not too large an issue...?). It's not the prettiest or most genuine solution, but it may be the only option if the Good dumps don't surface. Thank God Map 2 is not too different from Map 1 (Just some bug fixes and polishes, most of the data that needed hacking was apparently in the same locations, even, which was how my timer un-hack was so easy to accomplish.)

All the other ROMs AFAIK are "Unverified but should operate as though good". I've gotten every one to boot on at least one emulator (Even if it's not a very widespread one - BS Fuurai no Shiren dai-2-wa, dumped recently, apprently only boots in SNES9XSE, but on that emulator it seems to run fine.)

However, one thing to note from the videos I collected - a lot of the games will have missing data (Non-essential to the gameplay but some add to the atmosphere of the game and some help to interface with the BIOs itself). The BS Zeldas have intros and score tallies that I see in the videos I downloaded but not in the final game (Actually, let me test that again - there's always a slim chance the score tally just needs a bios call... the intro is definitely gone though.), as do BS Fuurai no Shiren and a good amount of others (The ones I suggested previously are ones I believe -won't- have this issue, as they have their entire game package sans streamed music in the ROM, and should logically just boot, play, and kickback to the bios when done.)
henke37
Lurker
Posts: 152
Joined: Tue Apr 10, 2007 4:30 pm
Location: Sweden
Contact:

Post by henke37 »

I did not refer to the chip dumps, I meant recordings of the live broadcast.
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

Hah, good luck with that. :P I considered it a Goldmine when I found even the video recordings I have. I would assume we'd need to find whoever got St.Giga's audio archives to see if they'd possibly have the audio in a good format.
byuu

Post by byuu »

Ah, where are my manners? Thanks for stopping by, Kiddo! :)
Hopefully someone here can be of assistance to you.

For those who don't know, he runs Satellablog, which has a lot of info on how to play the various BS-X dumps from Matthew Callis et al.
If it helps to resolve the matter of which dumps are bad, the only two dumps going around I'm dead certain are "Bad" are the current dumps of BS Kirby no Omachahako - Guru Guru Ball and Hoshi Kuzushi.
I complain about the dumps for the following reasons:

- they do not exist in read-only form
- they cannot be obtained any longer and are very, very rare
- many of the games "expired", setting a hidden "erase" bit in the headers
- many of the games were "deleted" and then recovered, mostly same as above
- many of them were hacked to run in emulators. Header changes, re-enabling the disabled bit, stuck loop disables, etc

While I've no doubt most of them are legitimate and clean, given there's practically no way for any third party to truly verify most of the data (eg Nach's team with NSRT; we can get some to verify, but definitely not all), and we don't even know where a lot of them initially came from ... it's just kind of sad is all.

With the base SNES carts, we have multiple dumpers for each game, CRC/MD5/SHA1/SHA256 checksums, dumper names, PCB info etc all logged into databases with multiple trusted central authorities. I'm a lot more confident when NSRT says my copy of Zelda 3 is legit than when I'm playing BS Zelda.

Still, what we have is certainly better than nothing :D
If Nintendo had their way, zero BS games would still exist. And on the bright side, it's a good reason why we should care, a lot, about preserving physical SNES carts while we still can, before bit rot takes them from us and we have the same problem we do now with BS-X games. Precisely the thing Nach, FitzRoy et al are working on at the moment.
FitzRoy
Veteran
Posts: 861
Joined: Wed Aug 04, 2004 5:43 pm
Location: Sloop

Post by FitzRoy »

Sure, we're not likely to redump this stuff, but they have internal checksums at least. Faked checksums can't be that common, I'm not aware of a verified case myself.

Every game should probably be archived with its date cleared and bits reset. Then maybe the emulator can use user input settings at runtime. Unless, of course, you want to dick with your roms constantly to get them to work.
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

byuu wrote: I complain about the dumps for the following reasons:

- they do not exist in read-only form
- they cannot be obtained any longer and are very, very rare
- many of the games "expired", setting a hidden "erase" bit in the headers
- many of the games were "deleted" and then recovered, mostly same as above
- many of them were hacked to run in emulators. Header changes, re-enabling the disabled bit, stuck loop disables, etc

While I've no doubt most of them are legitimate and clean, given there's practically no way for any third party to truly verify most of the data (eg Nach's team with NSRT; we can get some to verify, but definitely not all), and we don't even know where a lot of them initially came from ... it's just kind of sad is all.

With the base SNES carts, we have multiple dumpers for each game, CRC/MD5/SHA1/SHA256 checksums, dumper names, PCB info etc all logged into databases with multiple trusted central authorities. I'm a lot more confident when NSRT says my copy of Zelda 3 is legit than when I'm playing BS Zelda.

Still, what we have is certainly better than nothing :D
If Nintendo had their way, zero BS games would still exist. And on the bright side, it's a good reason why we should care, a lot, about preserving physical SNES carts while we still can, before bit rot takes them from us and we have the same problem we do now with BS-X games. Precisely the thing Nach, FitzRoy et al are working on at the moment.
I understand those complaints, although for all of them sans the "hacked ROMs" issues, there's really very little possible to do - any game released exclusively on the Satellaview or a Satellaview-specific variant of such a game can only be obtained from dumping from those rewritable Memory Packs (unless some magical stash of cartridges/prototypes conveniently comes up...). It's not ideal - and perhaps Nintendo had this in mind when setting it up (in retrospect, this is probably the most effective anti-piracy method they've ever produced. >_>), but regardless, we have to work with what we can.
As for the hacked ROMs, Header edits aren't quite as bad as, say, timer hacks and other Satellaview-protocol hacks which were specifically done to get the games to play on emulators (A header edit apparently does not even affect the Checksum check in the BIOs, thank goodness), but it's still understandable that you'd rather not mess around with a "pure/clean" dump, even if it's rendered itself no longer operable on the original hardware due to purposeful design, for the sake of integrity/proper archival.

As for where they came from... I'm working on that. I need to question some people more, basically - I've been trying to track down someone who I heard dumped the original ROMs only to have a "friend" leak them (Typical ROM drama, more or less), and I'm trying to find who this person is as well as what ROMs these were. Unfortunately it seems at least for the latter part the people I interrogate on this matter have poor memory.

EDIT: adding to this. Sorry. ^^;;
FitzRoy wrote:Sure, we're not likely to redump this stuff, but they have internal checksums at least. Faked checksums can't be that common, I'm not aware of a verified case myself.

Every game should probably be archived with its date cleared and bits reset. Then maybe the emulator can use user input settings at runtime. Unless, of course, you want to dick with your roms constantly to get them to work.
There are a few ROM hacks I've tested in the BS-X BIOs that I've gotten to boot by modifying the headers to Satellaview-proper format and "fixed" checksums via Ucon644. Nothing I'd ever think to send to anyone, though, unless they for some reason want to test them on an actual cart. (Which I don't even think is an option at the moment, as no one has ever written software to write back -into- a BS-X Memory Pack... and -assuming it's theoretically possible- as long as the carts are collectible, there would be backlash against such an idea.)

It would be rather funny to try to write a "Homebrew" specifically for the Satellaview though... alas, I am such a nerd. It wouldn't be very practical for the modern ROM hacker as they'd have to restrict themselves to the 1024kb size limit (in a time where common practice is to make every hack 4MB regardless of whether that amount of data is necessary) and modify their SRAM system if the game has one... that's a tangent on my end though.

As for how they should be archived - I'd much rather those dates be kept around somewhere as well, as I feel it's important to check to verify an actual Satellaview release by checking to see if it's date matches up with verified Broadcast Schedules. (although I don't necessarily have a complete one of those...)
Sometimes having the date of the broadcast also helps separate otherwise identical ROM dumps from different dumpers, or, in the case of my fiddling around, it'll remind me that I hacked the ROM.
shorthand
New Member
Posts: 4
Joined: Mon Jan 12, 2009 8:12 pm

Post by shorthand »

These are cheats for the BSX BIOS:

Code: Select all

80CD6700 BSX HiROM - maker ID check
80CD6D80 BSX HiROM - # starts check
80CA9500 BSX LoROM - maker ID check
80CA9B80 BSX LoROM - # starts check
BS Treasure Conflix runs very slow!

Code: Select all

BS Treasure Conflix (trace)
[C0:59FB] W08 = 80   [085000]
[C0:59FF] W08 = 80   [0E5000]
[C0:5A17] W08 = 00   [085000]
[C0:5A1D] W08 = 80   [0E5000]
[C0:5A17] W08 = 00   [085000]
[C0:5A1D] W08 = 80   [0E5000]
[C0:5A17] W08 = 00   [085000]
[C0:5A1D] W08 = 80   [0E5000]
[C0:5A17] W08 = 00   [085000]
[C0:5A1D] W08 = 80   [0E5000]
[C0:5A17] W08 = 00   [085000]
[C0:5A1D] W08 = 80   [0E5000]
[C0:5A17] W08 = 00   [085000]
[C0:5A1D] W08 = 80   [0E5000]
[C0:5A17] W08 = 00   [085000]
[C0:5A1D] W08 = 80   [0E5000]
[C0:5A17] W08 = 00   [085000]
The mapping state remains 'unchanged' often. :o


EDIT:
For 'Error 09' (bad ROM), you'll need to add these cheats to the BIOS:

Code: Select all

80CC3F00 BSX - psram checksum
80CE9A80 BSX - psram # starts
Another thing to note is that while BS Marvelous works, the game does not work as if it was connected to the satellite.

When 'real' time data is being fed via the 'base' unit, the intro is kinda different. All the campers are waiting around for the gate to open at ~x:10. At that moment, the kiddies run out and the game normally begins. My game started at 15:35.. :yikes:

(Oh bugger: BS Dragon Quest gets 'Error 09'. Meh - look into that one later)

EDIT2:

Code: Select all

80CCC900 BSX - psram checksum
That fixes BS DQ making it through the BIOS. Afterwards, I think it's looking for that clock data to continue.
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

I'd generally prefer trying to hack the Bios to see features hidden within that may not normally be seen than for trying to force-boot other ROMs. Still, interesting. It checks quite a few things, I guess.

As for the timer - IIRC the Timer on BSNES is linked to your Windows clock. Assumedly a decision Byuu made, you'll need to ask about that. I'd suggest an editable timer like SNESGT's.
shorthand
New Member
Posts: 4
Joined: Mon Jan 12, 2009 8:12 pm

Post by shorthand »

Kiddo wrote:I'd generally prefer trying to hack the Bios to see features hidden within that may not normally be seen than for trying to force-boot other ROMs. Still, interesting. It checks quite a few things, I guess.
That's way out of my league. ;p
The cheats are a nice workaround for me.
As for the timer - IIRC the Timer on BSNES is linked to your Windows clock. Assumedly a decision Byuu made, you'll need to ask about that. I'd suggest an editable timer like SNESGT's.
Just tried it with Marvelous - exactly like you said! Dragon Quest probably works the same way (waiting for the magic time).

Hmm.. Tantei Club looks like it needs work on the 'base' unit.
Wonder if there are other games in similar 'condition'.
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

If it helps, all the ROMs you mentioned up to this point play on SNESGT OK. So hopefully whatever problems we got trying to boot these aren't with the software. Or something.

EDIT: Idea on what ROM to Force-boot: the ROM labeled "BS Wai Wai Check 3/7" in most of the Goodsets apparently has both 3/7 and 3/14 data in the set of headers on BSNES. They all error 09 when I attempt access.
shorthand
New Member
Posts: 4
Joined: Mon Jan 12, 2009 8:12 pm

Post by shorthand »

Kiddo wrote:EDIT: Idea on what ROM to Force-boot: the ROM labeled "BS Wai Wai Check 3/7" in most of the Goodsets apparently has both 3/7 and 3/14 data in the set of headers on BSNES. They all error 09 when I attempt access.
The "BS checksum" is failing for BS Wai Wai / BS Dragon Quest. Zapping that check, BS Wai Wai will boot but shows nothing with BSNES (SNESGT shows random garble). Tested on all three of them. BSDQ does boot questionable code.

BIOS startup - doesn't do anything practical. Except BS Tantei.
218C/218B reads in tons of data when walking around town.

Code: Select all

mmio_read
    case 0x218b: return regs.r218b;
    case 0x218d: return regs.r218d;

mmio_write
    case 0x218c: {
      regs.r218c = data;

      regs.r218a = 0x14;
      // this locks up bsx bios with infinite modem reading
      //regs.r218d = 0x10;
    } break;

    case 0x218d: {
      regs.r218d = data;
    } break;

    case 0x218f: {
      regs.r218e >>= 1;
      regs.r218e = regs.r218f - regs.r218e;
      regs.r218f >>= 1;
      regs.r2190 = 0x80;
    } break;

    case 0x2192: {
        case 17: return 0x00; //???
        default: return 0x00;
      }
    }
Kiddo
Rookie
Posts: 18
Joined: Thu Dec 11, 2008 7:13 am
Location: ON AIR
Contact:

Post by Kiddo »

Hm. Dang. Perhaps the WaiWai Check ROM is corrupt. Hard to tell really..

(EDIT: As for the BSDQ ROM, I recall booting that a couple times and thinking the boot-up was... very un-Satellaview like. You apparently start off with a menu of what week to play in (So it's essentailly all four episodes in a single ROM), as well as a few debug-like options. I don't know whether this was hacked in, a result of opening it in an emulator, or this is in fact a Debug ROM dump from an unknown source.)

(EDIT 2: There's benen some BS ROMs I've been trying to open that for whatever reason BSNES and SNESGT do not detect as valid Satellaview ROMs. what's up with that? Perhaps we'll need to reinstate the manual ROM load for those...?)
CaptainN
New Member
Posts: 3
Joined: Sun Jan 18, 2009 12:27 pm

Post by CaptainN »

Hi all,

I own a Satellaview (with Yosshi no Panepon) and some memory cards. Most cards are empty though, unfortunately. I have been reading into dumping and stuff. Sorry for my lack of knowledge, but I was wondering how this dumping is done. And, for me personally more interesting, is it possible to "reverse dump" games. So put dumps onto empty memory cards? Would be quite neat if that is possible...
d4s
Rookie
Posts: 28
Joined: Wed Sep 08, 2004 12:05 pm

Post by d4s »

CaptainN wrote:Hi all,

I own a Satellaview (with Yosshi no Panepon) and some memory cards. Most cards are empty though, unfortunately. I have been reading into dumping and stuff. Sorry for my lack of knowledge, but I was wondering how this dumping is done. And, for me personally more interesting, is it possible to "reverse dump" games. So put dumps onto empty memory cards? Would be quite neat if that is possible...

The fact that the bios doesn`t show any files when inserting memory packs into the bsx-cart doesn`t mean that the pack is empty, it just means that there is no file that passed the various security and integrity checks.
Actually, the opposite may be the case:
I bought a couple of never-used NOS memory packs some time ago and all of them came preloaded with expansion data for one of the Ascii Tsukuru games.

I donated a special satellaview dumping cartridge to matthew callis that makes dumping the memory pack with a normal backup unit such as the game doctor/dx2/tototek flashcart possible. If you need something like that aswell and already own a backup unit, let me know.

If have to admit that while i love to give out stuff for free, it usually takes me ages to actually build and ship it. (sorry byuu)

Rewriting memory packs is not an issue technically. However, making a tool for that available to the public would probably severely hinder our efforts to get new original dumps.
CaptainN
New Member
Posts: 3
Joined: Sun Jan 18, 2009 12:27 pm

Post by CaptainN »

Hmm... I knew about some limits (like startup limits, or game that can only be played in certain time periods or something like that), but I didn't knew that those games were not visible in the BS-X menu then.

I do own a copier (Game Doctor SF7), so if you could make another dumping cartridge, that would be amazing. I would gladly dump all my Satellaview carts (I have four I think) and make them available for all to use. I would need some instructions if there are very technical procedures involved in dumping them.
Panzer88
Inmate
Posts: 1485
Joined: Thu Jan 11, 2007 4:28 am
Location: Salem, Oregon
Contact:

Post by Panzer88 »

would having an actual satellaview in hand help at all in any of this research or is everything dependent on the bs-x games themselves and the satellite information that was broadcast.
[quote="byuu"]Seriously, what kind of asshole makes an old-school 2D emulator that requires a Core 2 to get full speed? [i]>:([/i] [/quote]
henke37
Lurker
Posts: 152
Joined: Tue Apr 10, 2007 4:30 pm
Location: Sweden
Contact:

Post by henke37 »

Well, given that the actual hardware is poorly understood, yes having access to the real deal could help.
Locked