NEW Midway Wolf Unit PCB "Any U64" Mod

zenomorp

Well-known member

Donor 2015
Joined
Apr 5, 2008
Messages
9,065
Reaction score
3,937
Location
Wichita, Kansas
Hey all. One of our fellow KLOV'ers (nazerine) has successfully modified ALL 7 of the Wolf Unit games' revision roms to no longer require each games' individual, corresponding security chip. What this means is that if you have any of the 7 Wolf Unit games (MK3, UMK3, Rampage World Tour, WWF Wrestlemania, Open Ice, NBA Hangtime, NBA Maximum Hangtime) and you want to change out your current game to one of the other 7, all you'll need to do is burn the new game's complete rom set and the new modified revision roms and you'll be in business!

Before, if you wanted to change out the game, you'd need that game's corresponding security chip. With these modified revision roms, as long as you have ANY security chip installed, you can use any game's rom set you want. Below you will find a video showing what I've mentioned above. I have been authorized to talk about and showcase these changes by nazarine himself.

I don't want to directly link the modified revision roms (unless the mods say it's ok) so just PM me if you want a particular set. Here is the video. Interested in hearing thoughts and opinions on this...


 
Last edited:
:-/ .

edit: I like that someone can do this, unfortunately the purist in me likes to keep things original, and not have a bunch of bootlegs.

Nicely done Naz i gotta say that.
 
Last edited:
:-/ .

edit: I like that someone can do this, unfortunately the purist in me likes to keep things original, and not have a bunch of bootlegs.

Nicely done Naz i gotta say that.

I agree completely but you'll clearly know whether it's the original game or not if it says "ANY-U64" on the rom check screen.
 
Well done. I'm with Brood on this but it's good for the non purists. Especially if they want MK3 now since it does not require the security chip.
 
Last edited:
I think I asked this before in another thread, but do we have enough info to recreate the security chip with an open firmware or patch out he need for the security chip entirely?
 
I think I asked this before in another thread, but do we have enough info to recreate the security chip with an open firmware or patch out he need for the security chip entirely?

Yes, in theory U64 can be duplicated. It is a MCU, and the MAME source explains how it works.

Each game has multiple layers of security checks, some are the same, some are different between the games. The patch I implemented leaves most of the security checks intact, as they were all through the rom.

I specifically patched the roms to indicate they were not original, to protect collectors and purists.

Maybe down the road this can lead to a Wolf unit multi board
 
Yes, in theory U64 can be duplicated. It is a MCU, and the MAME source explains how it works.

Each game has multiple layers of security checks, some are the same, some are different between the games. The patch I implemented leaves most of the security checks intact, as they were all through the rom.

I've briefly viewed the MAME source a while ago and it seems like you might be able to follow that. I didn't look at in detail to see if there is anything complex within the checks.

zenomorp mentioned another person may have the actual source code to some of the games. That may mean they have the source for the security chip as well which may make it easier to implement a generic security chip to use with your firmware. Even if the source isn't released, but just general information or description of each check could go along way.

If you can say which checks you left in place then it would be easier to implement as well.
 
I've briefly viewed the MAME source a while ago and it seems like you might be able to follow that. I didn't look at in detail to see if there is anything complex within the checks.

zenomorp mentioned another person may have the actual source code to some of the games. That may mean they have the source for the security chip as well which may make it easier to implement a generic security chip to use with your firmware. Even if the source isn't released, but just general information or description of each check could go along way.

If you can say which checks you left in place then it would be easier to implement as well.

My interest level in cloning U64 is low. The source code has some of the security code found in the prg rom, but not the mcu. This patch came from zeno asking if it was possible, so my motivation level to get complex is rather low.

When tracing through the code, I found this routine that checks the calculated value returned from U64:

Code:
FFB0A770: 42 0B EF FD        CMPI   210h,A2                 ; check calculated value
FFB0A790: 05 CA              JREQ   FFB0A7F0h               ; jump if valid
FFB0A7A0: 42 0B 48 FE        CMPI   1B7h,A2                 ; check calculated value
FFB0A7C0: 02 CA              JREQ   FFB0A7F0h               ; jump if valid        
FFB0A7D0: 00 C0 FE FF        JR     FFB0A7D0h               ; jump to endless loop - stop cpu execution

Looking at other wolf unit games, the first value (0x0210) is found in all the other games which indicates, that yes it is possible to make a single U64 that works with all games. Midway most likely had a "universal u64" on their dev boards. Patched JREQ to JR, and that was that. Solving the checksum was the most difficult part of this project.
 
Now if we could only somehow get all those games on to each ROM and a way to select them on screen...

;)
 
My interest level in cloning U64 is low. The source code has some of the security code found in the prg rom, but not the mcu. This patch came from zeno asking if it was possible, so my motivation level to get complex is rather low.

When tracing through the code, I found this routine that checks the calculated value returned from U64:

Code:
FFB0A770: 42 0B EF FD        CMPI   210h,A2                 ; check calculated value
FFB0A790: 05 CA              JREQ   FFB0A7F0h               ; jump if valid
FFB0A7A0: 42 0B 48 FE        CMPI   1B7h,A2                 ; check calculated value
FFB0A7C0: 02 CA              JREQ   FFB0A7F0h               ; jump if valid        
FFB0A7D0: 00 C0 FE FF        JR     FFB0A7D0h               ; jump to endless loop - stop cpu execution

Looking at other wolf unit games, the first value (0x0210) is found in all the other games which indicates, that yes it is possible to make a single U64 that works with all games. Midway most likely had a "universal u64" on their dev boards. Patched JREQ to JR, and that was that. Solving the checksum was the most difficult part of this project.

Thanks for the info. I have no desire or hurry to clone U64 anytime soon. I'm thinking more for repairs and keeping boards running. If/When my U64 goes, I want to be able to create one or run without one.
 
Wolf Unit PCB

If I had a Wolf Unit pcb the chances of that would go up exponentially. Having the source code to an existing game to build a menu loader helps a ton too

I've got a Maximum Hangtime PCB that was working a while back and then something happened to cause C107 to "poof!". Shelved it for a couple years and was in the process of looking for Wolf Unit schematics when I came across this post.

Since you are working on a cool project (and since I don't know squat about surface mount repairs), would be happy to sell you the PCB for the cost of the EEPROMS (I estimate it would cost around $60 to replace them). Just went and pulled each chip and verified that the code is good on an Eprom burner. Also trimmed the ic legs on the bottom of the PCB to make sure nothing was shorting on the backside.

Link to high-res pics
http://s1283.photobucket.com/user/robmcraf/library/wolf unit pcb

Let me know if you are interested.
 

Attachments

  • DSC04547.jpg
    DSC04547.jpg
    100.6 KB · Views: 63
  • DSC04549.jpg
    DSC04549.jpg
    101.2 KB · Views: 61
Reviving this old post to see if there exists an "Any-U64" version for UMK3 Juggernaut ?

I have the Any-U64 mod for the "vanilla" UMK-3 v1.2,
but the Juggernaut hack requires replacing the two games roms
and I don't believe there exists a Juggernaut version with the Any-U64 patch.

Can someone shed any light on this ?

Thanks,
Steph
 
Re-viving this old thread to see if anyone knows if an Any-U64 has been created
for UMK3 Juggernaut.

LMK,
Thanks,
Steph
 
Do you need a UMK3 Security Chip? I might have a spare, I have to check.

No , I don't need one, but thanks for offering.

It's just that I get the occasional request to convert a Wolf board into a UMK3 Juggernaut,
but the Any-U64 only works on the "standard" UMK3 roms.

Thanks.
Steph
 
Let's pump some life into this @nazerine.

I'm currently looking into something related this to extend the GFX banks for a project I'm working on. I originally thought U64 held the contents of which banks to use, but after reading about this bypass it seems that may not be true.

But I find it unusual that the revision roms would hold this info, but they just may.

MK2 was a little different, I'm able to build valid checksums on my hacks with it, but the GAL seems to come into play with which banks are to be used for GFX.
 
Back
Top Bottom