freekickb2: MAME ROM Information.
MAME Info:
0.63 [Tomasz Slanina]
WIP:
- 0.143u5: Charles MacDonald and The Dumping Union fixed Free Kick - Game now playable. Added maincpu rom (ns6201-a_1987.10_free_kick.cpu - 52k).
- 8th October 2011: Charles MacDonald - I've been running a lot of tests on Free Kick to understand how various functions of the NS6201 security module work. Here's a complete description of it: http://cgfm2.emuviews.com/txt/freekick.txt
- 5th September 2011: Charles MacDonald - Free Kick dumped: I ran Free Kick in single-step mode up until a point where the stack pointer was initialized to a known value, than triggered repeated NMIs to push the stack pointer down past zero, wrapping around the address space into the external memory area. This is the only place where activity on the Z80 bus can be monitored. The NMI routine was allowed to finish instead of being interrupted again. At a point where it calls a leaf function, the return address was modified to point to a fragment of the IRQ handler which pops several registers off the stack before returning. This let BC, DE, and HL to be set to user-specified values, followed by another modified return address that pointed to a single LDIR instruction. A block transfer was performed that copied the internal RAM data to the external memory area in 4K chunks, and the process was automated to dump the entire content of security module correctly. It's satisfying to have this game dumped after working on it for quite some time, and this outcome certainly justified the time spent developing the Z80 analysis board. Here's hoping Counter Run can be dumped in a similar way. Does anyone have an original (non-bootleg) version of Counter Run they could lend for attempted dumping?
- 20th June 2010: Charles MacDonald - I've been investigating Free Kick, an arcade game that uses a security module in place of the CPU. Currently the bootleg version is emulated in MAME. Photos of a disassembled module show four, possibly five chip dies on one side and what is likely a Fujitsu MB3771 on the other side. One of the dies has an exceptionally high pin count and connects directly to the Z80 related pins, so it may be a Z180 (HD647180). Because of these direct connections there are probably no buffers in place to isolate internal bus activity from the outside world. However monitoring the data and control bus has not yielded any clear results. The module has an internal CR2032 battery that powers some SRAM which contains the game's program code. If the battery dies the module still functions and will print a "PROGRAM ERROR" message, so there must be internal ROM (the HD647180 has 16K of built-in ROM) that contains a start-up program which validates the SRAM before passing control to it. Typically for high score retention, the work RAM of a game is powered by a battery. Free Kick has such a battery, but it only connects to the module and not to any of the RAMs. If you consider that the bootleg games replace the security module with a daughterboard that has an EPROM for the program code and a 8Kx8 RAM, it seems likely that the work RAM is inside the module and is powered by the external battery. Since the power supplies are split across two batteries, I don't think the work RAM and program code RAM are the same chip but are two separate ones. When the module is removed from the board a number of pins have measureable voltages on them. These pins may have pull-up resistors to the internal battery. RSTOUT# is the output of the MB3771 which resets the 82C255 and a '259 latch on the PCB. The PCB has a RC reset circuit which connects to the reset input of the module. The MB3771 is probably used to disable the write inputs of the work RAM (and program RAM) when no +5V source is supplied. All Z80 address and data pins as well as RD#, WR#, MREQ#, and what I believe is IORQ# measure 0.009V which could be due to some kind of leakage, say from the program code RAM through the ESD protection diodes of the Z180 data and address bus. The pin that should be M1# is used to directly set a flip-flop which triggers the 120 Hz video interrupt. If this signal was a combination of IORQ# and M1# then that would indicate an interrupt acknowledge cycle and this connection would make sense. If it is just M1# directly then the interrupt acknowledge won't work as intended, instead any opcode fetch after the interrupt flip-flop has been set will clear it. It's hard to tell if that is intentional or not. For some reason one bootleg drives this same signal when a specific memory range is read or written which does not seem like compatible behavior. I made a circuit that requested the bus using the BUSREQ# and BUSACK# pins, and was able to halt the CPU while it ran the internal ROM program. In addition the WAIT# input is usable as it connects to the four SN76489s on the main board to cause wait states to lengthen PSG writes. I think these can be used to probe the internal memory space of the module, or if that failed, log internal bus activity. I'm developing some hardare to assist with that but it is still at an early phase. Assistance needed: If anybody has a bootleg of Free Kick or Counter Run with a daughterboard, I need to get some connections verified by using the continuity test function of a multimeter. It doesn't matter if the game works or not, and you don't have to power it up. Any bootleg will work, there are several different types. Please contact me if you can help.
- 0.136u3: Renamed (freekcb2) to (freekickb2) and (freekckb) to (freekickb).
- 0.126u5: David Haywood added clone Free Kick (bootleg set 2). Changed 'Free Kick (bootleg)' to clone 'Free Kick (bootleg set 1)'.
- 0.126u3: Brian Troha verified Free Kick PROMs and improved documentation. Fixed proms names.
- 0.105u5: Sonikos cleaned up the Free Kick driver, added 2nd button to Free Kick and matched the Z80 chip MHz to the "confirmed" MHz of Gigas (3072000 Hz).
- 8th February 2005: f205v dumped Free Kick (bootleg set 2).
- 0.63: Tomasz Slanina added Free Kick (Nihon System 1987 (Sega license)) and clone (bootleg). NOTES: Currently only the freekick bootleg roms are included the Free Kick bootleg roms are the same as one of the other sets + an extra 64k ram dump from protection device. The main program rom is unused, is it a dummy or just something to active the protection device? The sound ROM contains a Z80 program, but there isn't a sound CPU and that program isn't executed. Instead, the main CPU reads the sound program through an 8255 PPI and plays sounds directly.
- 28th December 2002: Nicola Salmoria added sound and fixed inputs and flip screen in Free Kick.
- 23rd December 2002: Tomasz Slanina added a bootleg of Free Kick that works unlike the original which is missing some program code.
- 21st February 1999: Malcor dumped Free Kick.
Recommended Games (Breakout):
Gee Bee
Super Breakout
Tournament Table
Bomb Bee
Cutie Q
Field Goal
Straight Flush
Wall Crash
Cannon Ball (Pacman Hardware)
Flying Ball (DECO Cassette)
Wink
Arkanoid
Tournament Arkanoid
Arkanoid - Revenge of DOH
Arkanoid Returns
Gigas
Gigas Mark II
Riddle of Pythagoras
Block Gal
Free Kick
Super Free Kick
Goindol
Mahjong Block Jongbou
Quester
Reaktor
Thunder & Lightning
Block Block
Ghox
Off the Wall
Twin Squash
Block Carnival / Thunder & Lightning 2
Play Girls
Peek-a-Boo!
Blocken
Wiggie Waggie
Cuby Bop
Zip & Zap
Bal Cube
Domino Block
Pop 'n Bounce
Puchi Carat
Puzzle Break
VS Block Breaker
Bestri
Mad Ball
Jumping Break
The Block Kuzushi
Gunbarich
Recommended Games (Soccer):
Tournament Table
Atari Soccer
Dribbling
Exciting Soccer
Exciting Soccer II
Pro Soccer
Pro Soccer (DECO Cassette)
Indoor Soccer
Power Play
Tehkan World Cup
Vs. Soccer
Kick and Run
Dynamic Shooting
Fighting Soccer
Kick Off
Last Striker / Kyuukyoku no Striker
Great Soccer (Mega-Tech)
Tecmo World Cup (Mega Play)
Tecmo World Cup '90
Tecmo World Cup '94
Tecmo World Soccer '96
Tecmo World Cup '98
Tecmo World Cup Millennium
World Championship Soccer (Mega-Tech)
World Trophy Soccer (Arcadia)
Football Champ
Super Football Champ
Nintendo World Cup (PlayChoice-10)
World Soccer Finals
Soccer Brawl
Big Striker
Seibu Cup Soccer
Super Sidekicks
Super Sidekicks 2 - The World Championship
Super Sidekicks 3 - The Next Glory
Super Soccer (Nintendo Super System)
Grand Striker
Grand Striker 2
Premier Soccer
Super Cup Finals
Taito Cup Finals
Dream Soccer '94
International Cup '94
J-League Soccer V-Shoot
Soccer Superstars
Super Visual Football
Taito Power Goal
V Goal Soccer
Virtua Striker
Virtua Striker 2
Virtua Striker 2 '98
Virtua Striker 2 '99
Virtua Striker 2 Ver. 2000
Virtua Striker 3
Five a Side Soccer
Goal! Goal! Goal!
Kick Goal
World PK Soccer
World PK Soccer V2
Back Street Soccer
Pleasure Goal
Prime Goal EX
The Ultimate 11
Versus Net Soccer
Capcom Sports Club (Soccer)
Libero Grande
Neo-Geo Cup '98 - The Road to the Victory
World Kicks
Evolution Soccer
-
Stone Ball
Free Kick
Super Free Kick
PK Scramble
X the Ball
Kick '4' Cash
Romset: 182 kb / 14 files / 62.8 zip
MAME XML Output:
| | <game name="freekickb2" sourcefile="freekick.c" cloneof="freekick" romof="freekick"> |
| | | <description>Free Kick (bootleg set 2)</description> |
| | | <manufacturer>bootleg</manufacturer> |
| | | <rom name="15.bin" size="65536" crc="6569f2b0" sha1="9306e316e6ae659bae3759a12a4e445b555a8893" region="maincpu" offset="0"/> |
| | | <rom name="1.bin" merge="11.1e" size="32768" crc="a6030ba9" sha1="f363100f54a7a80701a6395c7539b8daa60db054" region="user1" offset="0"/> |
| | | <rom name="2.bin" size="32768" crc="96aeae91" sha1="073ca6c9fbe14760ee10293791254da3bcb43940" region="gfx1" offset="0"/> |
| | | <rom name="3.bin" size="32768" crc="489f538c" sha1="47e5b3db1bb9efe0e432be83220d9fc09695fdf1" region="gfx1" offset="4000"/> |
| | | <rom name="4.bin" size="32768" crc="73cdb431" sha1="97f62d8cb21dfd905713b40d54da270d9ff275b9" region="gfx1" offset="8000"/> |
| | | <rom name="5.bin" size="32768" crc="7def1c52" sha1="dbe8c7b7c45ea681870b2039cb80728530a057c3" region="gfx2" offset="0"/> |
| | | <rom name="6.bin" size="32768" crc="59d1b3e7" sha1="de82dcbaa0fa4f5b5f0cb0c925c12fac8828fa01" region="gfx2" offset="4000"/> |
| | | <rom name="7.bin" size="32768" crc="95c19081" sha1="d8abc6f8da9188ca7b322f17c16e0494d771df39" region="gfx2" offset="8000"/> |
| | | <rom name="24s10n.8j" merge="24s10n.8j" size="256" crc="53a6bc21" sha1="d4beedc226004c1aa9b6aae29bee9c8a9b0fff7c" region="proms" offset="0"/> |
| | | <rom name="24s10n.7j" merge="24s10n.7j" size="256" crc="38dd97d8" sha1="468a0f87a704982dc1bce1ca21f9bb252ac241a0" region="proms" offset="100"/> |
| | | <rom name="24s10n.8k" merge="24s10n.8k" size="256" crc="18e66087" sha1="54857526179b738862d11ce87e9d0edcb7878488" region="proms" offset="200"/> |
| | | <rom name="24s10n.7k" merge="24s10n.7k" size="256" crc="bc21797a" sha1="4d6cf05e51b7ef9147eeff051c3728764021cfdb" region="proms" offset="300"/> |
| | | <rom name="24s10n.8h" merge="24s10n.8h" size="256" crc="8aac5fd0" sha1="07a179603c0167c1f998b2337d66be95db9911cc" region="proms" offset="400"/> |
| | | <rom name="24s10n.7h" merge="24s10n.7h" size="256" crc="a507f941" sha1="97619959ee4c366cb010525636ab5eefe5a3127a" region="proms" offset="500"/> |
| | | <chip type="cpu" tag="maincpu" name="Z80" clock="3072000"/> |
| | | <chip type="audio" tag="mono" name="Speaker"/> |
| | | <chip type="audio" tag="sn1" name="SN76496" clock="3000000"/> |
| | | <chip type="audio" tag="sn2" name="SN76496" clock="3000000"/> |
| | | <chip type="audio" tag="sn3" name="SN76496" clock="3000000"/> |
| | | <chip type="audio" tag="sn4" name="SN76496" clock="3000000"/> |
| | | <display tag="screen" type="raster" rotate="270" width="256" height="224" refresh="60.000000" /> |
| | | <input players="2" buttons="2" coins="2"> |
| | | | <control type="joy" ways="8"/> |
| | | | <control type="dial" minimum="0" maximum="255" sensitivity="30" keydelta="15" reverse="yes"/> |
| | | <dipswitch name="Lives" tag="DSW1" mask="1"> |
| | | | <dipvalue name="3" value="1" default="yes"/> |
| | | | <dipvalue name="5" value="0"/> |
| | | <dipswitch name="Bonus Life" tag="DSW1" mask="6"> |
| | | | <dipvalue name="2-3-4-5-60000 Points" value="6" default="yes"/> |
| | | | <dipvalue name="3-4-5-6-7-80000 Points" value="2"/> |
| | | | <dipvalue name="20000 & 60000 Points" value="4"/> |
| | | | <dipvalue name="ONLY 20000 Points" value="0"/> |
| | | <dipswitch name="Difficulty" tag="DSW1" mask="24"> |
| | | | <dipvalue name="Easy" value="24" default="yes"/> |
| | | | <dipvalue name="Normal" value="16"/> |
| | | | <dipvalue name="Hard" value="8"/> |
| | | | <dipvalue name="Hardest" value="0"/> |
| | | <dipswitch name="Allow Continue" tag="DSW1" mask="32"> |
| | | | <dipvalue name="No" value="0"/> |
| | | | <dipvalue name="Yes" value="32" default="yes"/> |
| | | <dipswitch name="Cabinet" tag="DSW1" mask="64"> |
| | | | <dipvalue name="Upright" value="0" default="yes"/> |
| | | | <dipvalue name="Cocktail" value="64"/> |
| | | <dipswitch name="Flip Screen" tag="DSW1" mask="128"> |
| | | | <dipvalue name="Off" value="128" default="yes"/> |
| | | | <dipvalue name="On" value="0"/> |
| | | <dipswitch name="Coin A" tag="DSW2" mask="15"> |
| | | | <dipvalue name="5 Coins/1 Credit" value="0"/> |
| | | | <dipvalue name="4 Coins/1 Credit" value="12"/> |
| | | | <dipvalue name="3 Coins/1 Credit" value="14"/> |
| | | | <dipvalue name="2 Coins/1 Credit" value="5"/> |
| | | | <dipvalue name="3 Coins/2 Credits" value="6"/> |
| | | | <dipvalue name="4 Coins/3 Credits" value="4"/> |
| | | | <dipvalue name="1 Coin/1 Credit" value="15" default="yes"/> |
| | | | <dipvalue name="4 Coins/5 Credits" value="8"/> |
| | | | <dipvalue name="3 Coins/4 Credits" value="10"/> |
| | | | <dipvalue name="2 Coins/3 Credits" value="9"/> |
| | | | <dipvalue name="3 Coins/5 Credits" value="2"/> |
| | | | <dipvalue name="1 Coin/2 Credits" value="7"/> |
| | | | <dipvalue name="2 Coins/5 Credits" value="1"/> |
| | | | <dipvalue name="1 Coin/3 Credits" value="11"/> |
| | | | <dipvalue name="1 Coin/4 Credits" value="3"/> |
| | | | <dipvalue name="1 Coin/5 Credits" value="13"/> |
| | | <dipswitch name="Coin B" tag="DSW2" mask="240"> |
| | | | <dipvalue name="5 Coins/1 Credit" value="0"/> |
| | | | <dipvalue name="3 Coins/1 Credit" value="224"/> |
| | | | <dipvalue name="2 Coins/1 Credit" value="80"/> |
| | | | <dipvalue name="3 Coins/2 Credits" value="96"/> |
| | | | <dipvalue name="1 Coin/1 Credit" value="240" default="yes"/> |
| | | | <dipvalue name="3 Coins/4 Credits" value="160"/> |
| | | | <dipvalue name="2 Coins/3 Credits" value="144"/> |
| | | | <dipvalue name="3 Coins/5 Credits" value="32"/> |
| | | | <dipvalue name="1 Coin/2 Credits" value="112"/> |
| | | | <dipvalue name="2 Coins/5 Credits" value="16"/> |
| | | | <dipvalue name="1 Coin/3 Credits" value="176"/> |
| | | | <dipvalue name="1 Coin/4 Credits" value="48"/> |
| | | | <dipvalue name="1 Coin/5 Credits" value="208"/> |
| | | | <dipvalue name="1 Coin/10 Credits" value="192"/> |
| | | | <dipvalue name="1 Coin/25 Credits" value="64"/> |
| | | | <dipvalue name="1 Coin/50 Credits" value="128"/> |
| | | <dipswitch name="Manufacturer" tag="DSW3" mask="1"> |
| | | | <dipvalue name="Nihon System" value="0" default="yes"/> |
| | | | <dipvalue name="Sega/Nihon System" value="1"/> |
| | | <dipswitch name="Unused" tag="DSW3" mask="2"> |
| | | | <dipvalue name="Off" value="2" default="yes"/> |
| | | | <dipvalue name="On" value="0"/> |
| | | <dipswitch name="Unused" tag="DSW3" mask="4"> |
| | | | <dipvalue name="Off" value="4" default="yes"/> |
| | | | <dipvalue name="On" value="0"/> |
| | | <dipswitch name="Unused" tag="DSW3" mask="8"> |
| | | | <dipvalue name="Off" value="8" default="yes"/> |
| | | | <dipvalue name="On" value="0"/> |
| | | <dipswitch name="Unused" tag="DSW3" mask="16"> |
| | | | <dipvalue name="Off" value="16" default="yes"/> |
| | | | <dipvalue name="On" value="0"/> |
| | | <dipswitch name="Unused" tag="DSW3" mask="32"> |
| | | | <dipvalue name="Off" value="32" default="yes"/> |
| | | | <dipvalue name="On" value="0"/> |
| | | <dipswitch name="Unused" tag="DSW3" mask="64"> |
| | | | <dipvalue name="Off" value="64" default="yes"/> |
| | | | <dipvalue name="On" value="0"/> |
| | | <dipswitch name="Coin Slots" tag="DSW3" mask="128"> |
| | | | <dipvalue name="1" value="0"/> |
| | | | <dipvalue name="2" value="128" default="yes"/> |
| | | <driver status="good" emulation="good" color="good" sound="good" graphic="good" savestate="supported" palettesize="512"/> |
|
|
