Posted by barry on 21 October 2014 at 21:24:56
About a month ago Caius dumped a bootleg version of Varth. A had a quick look at the time but never got it going. I've had another look over the last couple of days and the game is now working.
Initially I didn't get very far, the game was halting when reading from the 68K address 0x100280. Initially I thought there was some simple protection, but didn't find anything that worked. I mapped some of the 68K program ROM into the space, and the game did do a little more, but never started.
At this point, I realised there were two more ROMs in the dump. These two ROMs matched data from the end of main 68K ROMs in the original set, but were much smaller. Mapping this data into the space at 0x100000 to 0x1fffff and the game boots and works fine. It looks like the bootleggers used a subset of the 68K ROM as protection data, or maybe they needed to be able to return the original data in the area where they added their code.
The game doesn't appear to write the scroll 3 RAM offset anywhere (the usual address is now the sound command), so I have hard-coded it on boot. However, the game does write the value at boot to 0x800188 (which is normally the PSound fade command). The game promptly overwrites this again though. Is it feasible that the first write to this address sets up the scroll 3 RAM offset, and subsequent writes are used as the fade command as usual?
This bootleg is taken from the 920612 etc version. I can't see any differences in-game but the following hardware differences are observed (as well as the previously mentioned 68K data, and scroll 3 RAM offset handling);
This is another CPS-1 bootleg emulated and documented. Look out for it in an FB Alpha release soon.
OlderNewer