Play your favorite classic games and more with the GameEx front end. Read more.

kbash: MAME ROM Information.

History:

Knuckle Bash (c) 1993 Toaplan.

3 wacky characters go after the Bulls and others who would dare threaten the peace of the city!

- TECHNICAL -

Game ID : TP-023

Main CPU : 68000 (@ 16 Mhz)

Sound Chips : YM2151 (@ 3.375 Mhz), OKI6295 (@ 7.575 Khz)

Control per player: 8-way joystick

Buttons per player: 3

- TRIVIA -

Released in May 1993.

Licensed to Atari Games for European and North American distribution.

- TIPS AND TRICKS -

* Hidden Functions : If the 'Invulnerability dip switch' is enabled, you are invulnerable but you may also 'Pause' the game with P2 Start and restart with P1 Start.

- SERIES -

1. Knuckle Bash (1993)

2. Knuckle Bash 2 (1999)

- STAFF -

Designer : Junya Inoue

- SOURCES -

Game's rom.

MAME Info:

0.36RC1 [Quench]

WIP:

- 0.141u4: Alex Jackson corrected Knuckle Bash rom names, thanks to information from Charles MacDonald.

- 0.141u1: Alex Jackson found a lot more Knuckle Bash opcodes by matching code with Batsugun. Corrected m68k and v25 address maps for Knuckle Bash.

- 0.135u1: David Haywood cleaned up Toaplan2 V25 support. Added V25 (16 MHz) CPU2 to Knuckle Bash.

- 1st June 2008: Charles MacDonald - V25 research: There are a number of instructions which delay interrupt and exception processing, allowing one more instruction to be executed before the interrupt is taken. For the prefixes, this prevents an interrupt from being taken after the prefix byte has been fetched but before the instruction it applies to has been executed. Likewise for segment register loads, if an interrupt occurred after SS was changed, SP would be invalid. By delaying interrupts the following types of sequences become uninterruptible. It seems less important to have DS and ES register loads delay interrupts as well, I did not expect this behavior. I have been looking at the MCU code for other games and it seems that they use similar, if not identical instruction encodings, despite using differently labeled MCUs. V-Five in particular seems to match the Knuckle Bash opcodes quite closely, and when/if I can get Knuckle Bash decrypted, I'll see how much of V-Five can be decrypted.

- 12th April 2008: Charles MacDonald - I recently acquired a Toaplan "Knuckle Bash" PCB. It's a fairly impressive system, based around a custom graphics chip which displays three tiled background layers and two 512x512 12-bit framebuffers for double buffered sprites. It has a 68HC000 running at 16 MHz that handles all the game related tasks, and a V25S MCU that manages inputs, sound effects, and music playback. The music for this game is quite good and definitely a notch above the rest. A lot of other Toaplan games use the same graphics chip, so I'm intending to run tests on it and get all the timing and other details worked out. The V25S microcontroller is a 80186 clone manufactured by NEC. Unlike the V25 it has no usable internal ROM and no 8080 emulation mode, the latter of which has been modified to add a new 'secure' operating mode. In secure mode a lookup table translates opcodes fetched from memory with their V25S equivalents. This allows the opcode-to-instruction mapping to be changed as the customer (Toaplan) sees fit, making the program code unusable unless the table contents are known. Luckily operands and data are not encrypted, and examination of the operands such as the ModR/M byte can reveal what category of instructions a particular opcode might fit in to. NEC intended for the V25S to be used as a drop-in replacement for the V25, to accomplish this it uses one of the unused V25 pins as a mode select input. When tied high or floating (due to an internal pull-up resistor) the CPU runs in normal mode, where the lookup table is bypassed and opcodes are processed normally. When tied low, the CPU is in secure mode and the lookup table is utilized. This pin is sampled during a reset, interrupt, or exception, and bit 15 of the PSW can be modified through select instructions to change the operating mode regardless of the pin state as well. These features allow a V25S to start in normal mode and selectively execute encrypted programs while still interacting with a unencrypted BIOS, operating system, and device drivers, or vice-versa. I modified the Knuckle Bash board to start the V25S in normal mode, and developed a program that sets the MCU to a known state and enters secure mode with the instruction trap feature enabled. This forces just one encrypted instruction to be executed before control is passed back to my unencrypted code, at which point the potentially modified state of the MCU is saved and examined. The behavior of all encrypted opcodes (except BRKS which sets up an unrecoverable state) can therefore be examined. I can see things like what data was pushed or popped from the stack, which registers were loaded, exchanged, or modified, and which instructions triggered an I/O or floating point exception. A lot of information can be gathered about the encrypted instructions, which narrows down or completely identifies which unencrypted instructions they map to. Best of all this technique should work for any V25S based system, such as the other Toaplan games. I'm looking forward to trying it on my Golden Axe 2 security board to see how effective it is after finishing with Knuckle Bash, though right now it's too early to give any indication of progress. Toaplan did an excellent job with the protection. The program ROM is filled with valid Z80 code and garbage data to throw off statistical analysis of the ROM, such as observing the frequency of occurence for particular bytes and byte sequences. The MCU has no manufacturer marking and has ambiguous names printed on it like "NITRO" and "DASH". Furthermore, the lookup table maps many opcodes to the same instructions so certain easily identifiable instructions can simply never be executed, increasing the number of potential matches any encrypted instruction might have. If this technique is applicable to the V35S, we'll have to see what Irem did with their games.

- 0.88: Changed MSM6295 clock speed to 7575 Hz.

- 11th May 2003: Guru - Knuckle Bash (Toaplan) arrived from Randy.

- 0.37b10: Changed OKI6295 clock speed to 20454 Hz.

- 0.37b9: Changed OKI6295 clock speed to 20000 Hz.

- 0.37b6: Changed YM3812 clock speed to 3375000 Hz.

- 0.36RC1: Quench added Knuckle Bash (Toaplan 1993). Working, but no sound. MCU dump exists, but it needs investigation.

- 12th January 2000: Quench sent a driver for some later Toaplan games such as Teki Paki, Ghox, Dogyuun, Knuckle Bash, Pipi & Bibis / Whoopee!! and Snow Bros 2.

LEVELS: 10

Other Emulators:

* FB Alpha

* Raine

Recommended Games (Heroes Fighter):

Knuckle Joe

My Hero

Renegade

Trojan

Trojan (PlayChoice-10)

Avengers

Black Panther

Double Dragon

Double Dragon II

Double Dragon 3

Double Dragon (PlayChoice-10)

Double Dragon (Neo-Geo)

Ginga NinkyouDen

Kyros

Shinobi

Shinobi (Mega-Tech)

Shinobi / FZ-2006

The Revenge of Shinobi (Mega-Tech)

Shinobi III (Mega Play)

Bad Dudes vs. Dragonninja

Shadow Warriors

Vigilante

Crime Fighters

DownTown

Final Fight

Gang Wars

Last Battle (Mega-Tech)

Ninja Gaiden (PlayChoice-10)

Ninja Gaiden Episode II (PlayChoice-10)

Ninja Gaiden Episode III (PlayChoice-10)

Shadow Dancer

Shadow Dancer (Mega-Tech)

Tough Turf

The Combatribes

Crude Buster

Growl

Mug Smashers

64th. Street

Brute Force

Burning Fight

Captain Commando

D. D. Crew

Karate Blazers

Riot City

Streets of Rage (Mega-Tech)

Streets of Rage II (Mega Play)

Vendetta

B.Rap Boys

Big Fight

Guardians of the 'Hood

Legionnaire

Silent Dragon

Thunder Hoop

TH Strikes Back

Undercover Cops

Cadillacs and Dinosaurs

Denjin Makai

Knuckle Bash

Knuckle Bash 2

Ninja Baseball Batman

The Punisher

Violent Storm

Zero Team

Pretty Soldier Sailor Moon

Black Touch '96

Final Fight 2 (SNES bootleg)

Ghost Chaser Densei (SNES bootleg)

Iron (SNES bootleg)

Osman

Sonic Blast Man 2 Special Turbo

Gaia Crusaders

Vamp 1/2

Jue Zhan Tian Huang

Thunder Heroes

Demolish Fist

Romset: 8992 kb / 7 files / 3.13 zip

MAME XML Output:

<description>Knuckle Bash</description>

<manufacturer>Toaplan</manufacturer>

</input>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</dipswitch>

</game>

Developed by: Spesoft Headsoft Terms of use Privacy Advertise