Upgrading from Area 51 (68020-based) to Area 51 / Maximum Force Duo

DarrenF

Well-known member
Joined
Jan 7, 2011
Messages
5,855
Reaction score
526
Location
Florida
Upgrading from Area 51 (68020-based) to Area 51 / Maximum Force Duo

I'm researching the subject upgrade. Rumor has it that it is possible to use hacked EPROMs which eliminate the need for the "security chip." Is this true? If so, can someone point me to the hacked ROMs??

Also, can anyoneone point me to an idiot's guide to making a CF card image from the MAME chd file?
 
Last edited:
I have yet to hear of a set that eliminates the need for the secituty chip. THat would be sweet though.


If you have the dual layer pcb the kit isnt really that much money for less than $100 youll have what you need to convert. FYI its worth it to have both games in one cab.

if you cant get a hold of toplessz to get what you need, ive gottan mine from arcade services on ebay (and bought drives for other games from them as well)
 
I haven't heard of a set that works without a security PIC

I have yet to hear of a set that eliminates the need for the secituty chip. THat would be sweet though.

It doesn't look like MAME emulates the security chip, and I see this in the driver:
Code:
2431  DRIVER_INIT_MEMBER(cojag_state,area51mx)
 2432  {
 2433      jaguar_hacks_enabled = true;
 2434      cojag_common_init(machine(), 0x0c0, 0x09e);
 2435  
 [B]2436      /* patch the protection */
 2437      m_rom_base[0x418/4] = 0x4e754e75;
[/B]

...which makes it look to me like perhaps a single byte hack in each of the 4 EPROMs might do the trick (unless there's more to it I'm not seeing). I was hoping someone else had already tried this, and proven if it works or not.

If it does, then I can program my own EPROMs, and I won't need a security chip... so all I'll need to buy is the CF card & IDE adapter = much cheaper upgrade.
 
there maybe a routine in code that "reads" code from the security chip.

that maybe the code to jump the sec chip read/check.
 
Yeah, the hacked in code (0x4e754e75) is a pair of rts opcodes. I haven't taken a look yet to see what code it replaces, but it presumably diverts to checking of the security chip.

I think I'll take a shot at hacking the area51mx rom set... Now I just need to get myself a CF card & IDE adapter thingy.
 
This is the process I used to make CF drives for my Mamimum Force (which has a "For Sale" thread, plug plug) and Area 51 boards : http://www.thekillerinstinctproject.com/kiproject/chdman.html

Now I just need to get myself a CF card & IDE adapter thingy.

OK, I've read the above linked page, and this one too: http://www.multigame.com/CF.html

However, I still have some questions about the process of creating a CF-card image from a MAME .chd file:

1) Do I have to do it via an IDE adapter (putting the CF card into an the IDE adapter, then connecting that to my PC with an IDE-to-USB adapter)? Or can I simply use a PC I've got with a CF reader built-in to put the image onto the CF card (then install it into the IDE adapter and install to the PCB)?

2) Seems like I've read about people recommending using a CF card at least 2x the size of the .chd file. Is that an old or wrong recommendation? Or will a 2GB card be fine to the (1.65GB) area51mx.chd?

3) Will pretty much any old cheap-ass CF card work fine? Or do I need to worry about a minimum xfer speed (e.g. 20MB/s, etc.)?

4) Are all CF/IDE adapters created equal, or are there certain features I need to look for? (I.e., will this one be fine?: http://www.compusa.com/applications/SearchTools/item-details.asp?EdpNo=4803492&CatId=109) Anyone have a recommended model?
 
I do mine with a 32-1 USB Memory card reader through a USB 2.0 port on an old Windows XP box. I use a CF card that is closest in size to the extracted .chd and haven't had any issues yet.

I put the Area 51/Maximum Force .chd on a 4 Gig card since that is what I had sitting around.

Brian.
 
Thanks for all the help, so far, fellas.

I now have:
-CF/IDE adapter
-2GB CF card
-old PC with IDE bus
-hacked the ROMs per the MAME driver

The only thing I seem to lack is a way to power the CF/IDE adapter on the Area 51 board. It has a standard HDD (larger) 4-pin molex connector on both ends. The CF/IDE adapter has a power jack like a floppy drive (little 4-pin connector). This won't be a problem when I'm imaging the thing in the old PC, as I'm sure the power supply has at least one of those. However, right now I have to way to power it on the Area 51 board... I guess I'll need to hack apart an old power supply and frankenstein an adapter together...

Anyhow, one way or ther other, I should know this week if the security-chip-free hack works or not.
 
That won't work. The Roms are the actual ones from the PCB and contain no hacks. The driver cojag in Mame is what contains the hack to allow it to pass the pic check not the Roms.

Only way it works is if you unknowing had the pic for the duo upgrade already on the PCB.
 
Last edited:
That won't work. The Roms are the actual ones from the PCB and contain no hacks. The driver cojag in Mame is what contains the hack to allow it to pass the pic check not the Roms.

Only way it works is if you unknowing had the pic for the duo upgrade already on the PCB.

I'm not going to use the MAME ROMs directly. I'm using MAME ROMs I have hacked to permanently include the run-time hack in the MAME driver (see post #4 of this thread)...
 
Got it. It should at least let you boot something. They're isn't any ROM checks at boot. Anything in the code telling it which specific pic to look for?
 
Got it. It should at least let you boot something. They're isn't any ROM checks at boot. Anything in the code telling it which specific pic to look for?

I actually looked at the disassembled code for the orignal, and the way MAME hacks it. A jump opcode (and the associated address) are overwritten by a pair of RTS opcodes. I ran it in the debugger with a watchpoint set for that address, and it seems to start calling it about 15-20 seconds into each game. I'm presuming this to be the protection check subroutine which is being disabled so MAME will run the code.

You'll need at least a 4gb cf for duo.

:) Yeah, I just figured this out about an hour ago... the hard way. Turns out I was only considering the size of the CHD... and the needed size of the UNCOMPRESSED drive image is larger. Luckily I've got a 4GB card too ;)
 
Well, everything is working fine of the test bench. Don't have any guns on the bench, so all I can test is attract mode and playing a game w/o shooting (including continuing). So far, no issues.

I'll put it in my cabinet and try playing it for a bit over the next few days...

Oh, and there is no security chip on my PCB, just an empty 8-pin socket.

Does anyone know what normally happens when running Duo roms and HDD w/o a security chip??
 
I'd love to see video of this working.

A video? What, my word is no good for you? ;)

In all honesty, whoever put the hack in MAME (presumaly a developer) did the hard work of finding where it calls the security check. I just recognized how they were doing it, and knew enough about MAME drivers to figure out how to properly apply it to the EPROM images.


I'll see if I can figure out how to upload to youtube later, to satisfy the doubters... :p
 
I haven't heard of a set that works without a security PIC, I just ordered a PIC from ToplessZ.

This is the process I used to make CF drives for my Mamimum Force (which has a "For Sale" thread, plug plug) and Area 51 boards : http://www.thekillerinstinctproject.com/kiproject/chdman.html

Brian.

I used the same guide, worked flawlessly. Just used a cheap multi card reader.

Glad to hear you got it working! I might try it on my board now!
 
Last edited:
Back
Top Bottom