Pang/Super Pang music driver stuff
by unknownfile, 2008
Super Pang runs a single Z80 CPU which executes encrypted code which I can't decrypt.
There are two soundchips: a YM2413 (OPLL), and an OKI which is not required to run music.
This document pertains to the YM2413 part of the driver.
Important subroutines:
0x788E - init address. Song ID is stored in a.
0x7803 - play address?
Sound Init appears to be running 7303, with A=40
Sound effects come before Music, of course. A=30 it probably first.
I have a copy of Debug Mame that let me dump what appears to be the CPU 0 code for 0-7FFF(Music Code), and 8000-BFFF(Music Data)
It needs to be parsed into HEX, but that's not much of an issue. It may also need to have the bytes flipped by the word, but I'm sure that with the right hex utils, you could finish that off yourself, should it be neccesary.
Talk to me if you decide you don't want to do this part yourself.
I don't add much, but I'm also satisfied with whatever improvements offgao tries to implement, as he's done quite a number of improvements that make it worth the effort to rip GBS files.
More important than any GUI options, is the improved music emulation. Anyone can work with the GUI if they don't mess with the guts of the emulation. Very few actually know how to improve the machine emulation.
very cool
I like how Nez sounds better than NSFPlug... well, I need to mess with the volume, I think it's too quiet now again. But I think it'd be awesome to have that info in a snappable config like SNESAmp. It'd also be very cool if there was an option box you could check to split the keyboard up into each channel, like some midi programs do with each track.
NSF is just begging for that stuff. And SNES, GBS, Genesis, GG, etc. I had a Genesis emulator that showed what each instrument channel was doing, very neat.
edited 3:28 AM EDT July 11, 2008
Patch_Kabuki(0x2abf,0x2abc,0xf880);
require hacking the bejeebus out of the games.
suprnova.c and ssv.c would be fine too look at as well (mostly for Vasara 1/2 and Cyvern). IIRC RB had done some work on one of those ages ago (song select codes or such).
deco_mlc.c games look interesting as well if Hoops '96 is anything like the NeoGeo game.
I haven't worked with SuperH assembly code before, so it looks like I'm in for a bit of a challenge.
OFF TO SPACE BOMBER I GO
----
OOPS EXCUSE ME, THE MAME DEBUGGER SUCKS:
-----------------------------------------------------
Exception at EIP=009A3326: ACCESS VIOLATION
While attempting to read memory at 001AA6E0
-----------------------------------------------------
EAX=00000000 EBX=00000001 ECX=10321000 EDX=001AA6E0
ESI=02850994 EDI=021AA6E0 EBP=02CDEBCC ESP=02CDEBA4
edited 8:27 PM EDT July 27, 2008
Time to get working on Genesis music hacking again. I'm doing it for M1 this time around, and I have a single game working right now. Impressive!
Too bad the PCM is all corrupted and suck.
UF's done some awesome work lately on the single-Z80 games. Hopefully he can work out the goofy PCM on SMPS games (something I've chased on and off since I got Sonic 2 running).
SSV seemed to have a weirdly isolated sound driver in many of the games last time I looked at it (the main code ROMs were one place in the memory map and the sound driver was elsewhere in a separate ROM) so it may be a possibility. No promises though.
http://www.spritesmind.net/_GenDev/forum/viewtopic.php?t=386&postdays=0&postorder=asc&start=0
I will resume work on the driver later today when I get sick of playing TF2.
I also added some support for the Sound Images driver found in games such as Blaster Master 2.
So far, I have added 5 Genesis games to M1. I'm willing to add some 32X but I'm not in the mood for swaying too far from the ultimate goal of the project.
71 Genesis games are supported as of this writing.
And given how easy is to add some games, it should be much, much more soon.
Trouble is that it requires interrupt vectors working correctly, a feat that M1 doesn't have yet, which explains why Sonic 1 isn't working.
Here are notes that I'm throwing out anyway:
Sound signature is 64 bytes: 0x4EFA0006 0x4EFA????
Call soundsig+4 to initialize the driver, and call soundsig on vblanks to update the sound driver.
Write to 0xFFFFF80A to play a sound.
（こちらにも来てみました。しかし、俺には英語があまり分からない…）
I would like it if I could discuss improvements with Offgao, instead of just handing him bits of code where any added comments are nearly useless. It doubles the interpertation needed, at least.
@nensondubois I'm not following you, but OffGao's build of nezplug is at http://offgao.no-ip.org/program/nezplug++.html
There is not the problem if you look like this image.
（NEZPlug++メモリビュアーのフォントが、外国版Windowsでこの画像のように見えているかが心配です。）
edited 3:44 PM EDT August 12, 2008
(I know quote tags aren't supported, but still...)
Godspeed, UF.
I wish you the best of luck completing your Genesis/Mega Drive sound format driver, we're all counting on ya!
I'm sure it could go unsaid, but thanks for all of your efforts!!! :D
Speaking of which, any driver requests? They need to be running on a Z80/68k CPU.
Oh, and the only Genesis games I can add are those that use only the Z80 for music (and sadly, quite a few of the better ones use 68k).
edited 2:21 AM EDT August 13, 2008
i wonder if he's done music for these other mahjong games you mention.
Init address: 0x8003 (pass song value to accumulator)
Vsync address: 0x8006
1B78 = ??13
Since I tend to rely rather heavily on BGB to tell me if a GBS is working right, I would have deduced those to be blank. I should also note that I likely wouldn't have gone to the effort to include those voice tracks anyways, as the SFX after the music was just conveniently available.
unsigned int sintable_rom[256] = {
2137, 1731, 1543, 1419, 1326, 1252, 1190, 1137, 1091, 1050,
1013,979,949,920,894,869,846,825,804,785,767,749,732,717,701,
687,672,659,646,633,621,609,598,587,576,566,556,546,536,
527,518,509,501,492,484,476,468,461,453,446,439,432,425,418,411,405,
399,392,386,380,375,369,363,358,352,347,341,336,331,326,321,316,311,307,
302,297,293,289,284,280,276,271,267,263,259,255,251,248,244,240,236,233,
229,226,222,219,215,212,209,205,202,199,196,193,190,187,184,181,178,175,
172,169,167,164,161,159,156,153,151,148,146,143,141,138,136,134,131,129,
127,125,122,120,118,116,114,112,110,108,106,104,102,100,98,96,94,92,91,89,
87,85,83,82,80,78,77,75,74,72,70,69,67,66,64,63,62,60,59,57,56,55,53,52,
51,49,48,47,46,45,43,42,41,40,39,38,37,36,35,34,33,32,31,30,29,28,27,26,
25,24,23,23,22,21,20,20,19,18,17,17,16,15,15,14,13,13,12,12,11,10,10,9,
9,8,8,7,7,7,6,6,5,5,5,4,4,4,3,3,3,2,2,2,2,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,
};
source
edited 9:42 PM EDT August 16, 2008
I'll post the Notsofatso source later.
http://www.shakal.net/lunar/temp/mahjong/ that's what i have for mahjong PV
819F9A??
It loaded the music number with a PEA, which took a bit to determine. Rip the music if you still feel like it.
BTW, any tutorial on how to go around determining the song select code in SNES games? Took me half of yesterday looking at RAM writes in MESS debugger, and I wasn't even close to the address you provided. :|
Also, the data you provided for SMRM PIV... Is that for the arcade game, or the SNES version? If the latter, how do I exactly go around using it? Edit the offset in ZST file?
edited 1:32 AM EDT August 18, 2008
As the Sega CD never sees the Genesis' memory, writes are made to the SCD's memory space.
Even more interesting is the fact that the Z80 is not used, but its memory is used for loading sequences in from memory (from FMWR.BIN or whatever, switched in 0x1e00 chunks).
Next step is to patch this beast to run the way I want it to in Gens, and I also need to wait until R. Belmont gets the 68K interrupt vectors working in a less screwy way.
I generally follow a very simple method of determining how the game loads music.
In Geiger's debugging SNES9X
Attempt 1:
A little before music is loaded(as in, something like the title screen music), put a watch on 002142, then when it breaks, disable the breakpoint, and use the Step Out command, and disassemble back to the address that was just run. If this is believed or proven to not be the deciding address, step out further. There's usually a single value pushed/loaded to a variable. It's also common for the load address to be close to/at ???000.
Attempt 2:
Same as above, but use address 002140.
Note that in SMRM PV, after stepping out, I had to look forward a bit to find the title loader, while the address I stepped out of was using the same routine to do something other than song selection by initing an unusual song value. You may still have to breakpoint and test the value inits/addresses of several routines you jump out of. It's just not as straight-forward as some other projects.
edited 9:00 PM EDT August 18, 2008
Oh, man, thanks a lot. It's kinda easy in some games, here's 5 minutes worth of work with Dragon Slayer - Eiyuu Densetsu II (J).smc.
Search for string 0xa90222bd in ROM, modify the second byte (0x02) to have other songs play during the introduction.
Should have the basic SPC pack ready in a jiffy.
edited 10:45 AM EDT August 19, 2008
*forehead*
Here's Soul & Sword, and now I really need some sleep. :D
ROM should be deinterleaved (NSRT Checksum 0x772A). Search ROM for string 0xa92c22f3e00020. Change the second byte to have different songs play during the intro screen.
ugetab, small question. Is there a possibility that stepping out wrong number of times will result in sequence playing with the wrong sample bank, or is that generally handled by SPC Init function?
edited 6:34 PM EDT August 19, 2008
As for the SPC specifics, I don't know. I generally see sound generation in Sound Init/Song Init/Play specifications from ripping NSFs/GBSs. Wario's Woods has this overall setup, GBSs from many flavors of companies will use this, and in my experience, only very rarely will a game become too tangled up with the sound generation to adequately isolate the pieces into those 3 categories. Rayman GBC is like this, and an NSF I ripped also had a very iffy sound setup.
ROM should be deinterleaved (NSRT Checksum 0xA944). Search ROM for string 0xc0a91d22ce. Change the third byte to have different songs play during the intro screen.
Best thing I got was changing the intro song for Angelique, but that only worked with one other song select (all other either crashed the game or didn't change anything). Pity, nice music there from what I could gather. :|
C0C0AF = C0BA
C0C124 = C12F
1870 area is where things get inited
002142
001802
C0C110
C095E6
DC014D
Narrowed it down to 33 by watching memory, tracking changes with memory BPs, and watching continually fewer memory changes until I got to the first change. That first change, (after sound init, which setup the 1800 area) turned out to be the song select. A good log should show the origin of the song value, which can be traced back to the origin visually.
The 1830 write tracks back to being read from 0054 at C0/C0A4, so, I'll just change it to an absolute read, and see if that works. Nope.
DC01F6 has an AND #$007F instruction. Make it A9?? for music track
DC01F6A9
DC01F7??
Edit:
I watched writes, traced back farther, and ended up just jumping in during the right routine, so I could jump out and find something better.
000054 is written from 0008E2, which is the stack, so I timed my freeze(clicking the memory window) to be pretty close to the write, which ended up allowing me to step out and recognize a PEA $0070 I saw on the stack, preceeded by a push and further preceeded by an AND #$00FF. Putting in a code to change this allowed for the second song to be used, which goes in at full volume. Tracking writes to 7E37F4 should allow further specifications for specific songs by the area.
Use this to get full-intro-volume rips from basically anywhere.
C905E7A9
C905E8??
As it turns out, I was being too cautious, and it was actually about 4 or 5 step-outs farther than I thought was practical. I don't exactly do SNES song select codes more than once every 3 months.
edited 8:47 PM EDT August 21, 2008
ROM containing above music along with a Mega Man themed player.
Both courtesy of Acmlm. I hope that he finishes them after the game comes out. The music is really accurate.
edited 8:24 PM EDT August 21, 2008
edited 10:27 AM EDT August 24, 2008
edited 11:11 AM EDT August 24, 2008
If you want to dabble some more in SNES stuff, the Most Requested sets list at SNESMusic.org (http://snesmusic.org/v2/wiki.php?iRequest=wiki/ViewPage&iPage=MostRequested) is a good place to look for undumped games (though some of the ones there have basic dumps done, will need to speak with the guys about making them show up differently or something).
Also, other Koei games should be pretty easy to hack using Angelique as a basis. I've looked a bit at Winning Post 2 and it even seems to use the same addresses for the music call.
edited 2:58 AM EDT August 25, 2008
Bakumatsu Korinden ONI 2(May be called 'Bakumatsu Korinden Oni', but will have the internal name S-ONI2.) Leave it off until the last line of intro text to make ripping easy, so you can just edit the codes and restore the save state. This worked for Dark Law, which had a nasty habit of dropping leading notes when ripping.
C02F06A9
C02F07??
Other games listed there that have SPC sets (not necessarily complete):
Dragon Ball Z: Chou Gokuu Den: Kakusei-hen
Monster Maker 3: Hikari no Majyutsushi
Super Wagan Land 2
Idea No Hi
Shin SD Sengokuden Taisyo Retsuden
Dragon Slayer: Legend Of Heroes 2
Wizap!
Battle Dodgeball: Tokyu Gekitotsu
Captain Tsubasa 4
Koutetsu No Kishi 3
YUUYUU Hakusho 2: Kakutou no Syo
Captain Tsubasa 5
Mahoujin Guru Guru
Captain Tsubasa J
Super Fire Pro Wrestling 1
Mahoujin Guru Guru 2
Bomberman B-Daman
Super Fire Pro Wrestling Special
Soul & Sword
Super Fire Pro Wrestling 3
Magical Drop 2
Super Fire Pro Wrestling Queens Special
Super Fire Pro Wrestling 2
Edo No Kiba
Appleseed
J League Excite Stage '95
Kido Senshi Gundam V
Nintama Rantarou 1
Super Fire Pro Wrestling 3 Easy
Kunio No Oden
Dragon Slayer: The Legend Of Heroes (already on the main site, BTW)
Super Real Mahjong P5: Paradise
edited 2:16 PM EDT August 25, 2008
29 sets, includes music from:
Dragon Slayer - Eiyuu Densetsu 2 [ドラゴンスレイヤー英雄伝説2] (1993)(Falcom, Epoch)
Hana no Keiji - Kumo no Kanata ni [花の慶次 雲のかなたに] (1994)(Tose, Yojigen)
Hebereke no Oishii Puzzle wa Irimasen ka [へべれけのおいしいパズルはいりませんか] (1994)(Sunsoft)
Hissatsu Pachinko Collection [必殺パチンココレクション] (1994)(Sunsoft)
Hisshou! Pachi-Slot Fan [必勝パチスロファン] (1994)(POW)
Honke Sankyo Fever - Jikki Simulation 2 [本家･SANKYO FEVER 実機シミュレーション2] (1995)(Boss Communications)
Honke Sankyo Fever - Jikki Simulation 3 [本家･SANKYO FEVER 実機シミュレーション3] (1996)(Boss Communications)
Hyper V-Ball [スーパーバレー2] (1992)(Video System)
Idea no Hi [イデアの日] (1994)(Office Koukan, Shouei System)
Inazuma Serve da!! Super Beach Volley [稲妻サーブだ!スーパービーチバレー] (1995)(Virgin)
J.League Excite Stage '95 [Jリーグ エキサイトステージ'95] (1995)(A-Max, Epoch)
Jammit (1994)(GTE Entertainment)
Jissen Pachi Slot Hisshouhou! [実戦パチスロ必勝法] (1993)(Sammy)
Jissen Pachi Slot Hisshouhou! 2 [実戦パチスロ必勝法2] (1994)(Sammy)
Jissen Pachi Slot Hisshouhou! Classic [実戦パチスロ必勝法クラシック] (1995)(Sammy)
Jissen Pachi Slot Hisshouhou! Twin [実戦パチスロ必勝法! TWIN] (1996)(Nihon Syscom, Sammy)
Jissen Pachi Slot Hisshouhou! Twin 2 [実戦パチスロ必勝法! TWIN 2] (1997)(Tose, Sammy)
Jissen Pachi Slot Hisshouhou! Yamasa Densetsu [実践!パチスロ必勝法 山佐伝説] (1996)(Sammy)
JWP Joshi Pro Wrestling - Pure Wrestle Queens [JWP女子プロレス ピュア･レッスル･クイーンズ] (1994)(Jaleco)
Keiba Eight Special - Maru hi Baken Kounyuu Jutsu [競馬エイト スペシャル マル秘馬券購入術] (1993)(C-Lab, Misawa Entertainment)
Kidou Senshi V Gundam [機動戦士Vガンダム] (1994)(Tose, Bandai)
Kinnikuman - Dirty Challenger [キン肉マン DIRTY CHALLENGER] (1992)(Yutaka)
Kunio no Oden [くにおのおでん] (1994)(Technos Japan)
Lock On [スーパーエアダイバー] (1993)(Copya System, Asmik)
Magical Drop 2 [マジカルドロップ2] (1996)(Data East)
Mahou Poi Poi Poitto! [魔法ぽいぽい ぽいっと!] (1994)(Metro, Takara)
Soul & Sword [ソウル アンド ソード] (1993)(Pandora Box, Zamuse)
Super Real Mahjong PV - Paradise All Star 4-nin Uchi [スーパーリアル麻雀P5 パラダイス オールスター4人打ち] (1995)(Seta)
Wizap! - Ankoku no Ou [ウィザップ 暗黒の王] (1992)(Sakata SAS, ASCII)
I've put ugetab as dumper in the sets he found the song selects for (heck, without his work they wouldn't be dumped, so it's only proper to give credit).
I'll see about having pack #3 done a little faster.
edited 6:12 PM EDT August 25, 2008
msxplug-ufmix-09122008.zip
Be sure to extract to the root of your drive, it has long file paths.
edited 11:01 AM EDT October 28, 2008
I don't know what this program is, but this sounds absolutely moronic.
[edit]
In light of guest's comment below, it looks like I'm the moron here. Sorry.
edited 7:11 PM EDT October 28, 2008
Armored Warriors
Eco Fighters
cU mana
Now we just need to figure out how Audio64 works, and we'll probably have at least 90% of the Dreamcast's sequenced music covered.
Anyone have some Audio64 files on hand? I have the driver file itself, but no clean sound data files to go along with it.
edited 4:51 AM EDT November 1, 2008
Pretty sure that's not doable with DSF though.
edited 6:22 AM EDT November 1, 2008
In short, yes. The Dreamcast did use Windows CE for certain things. Mouser X over and out.
CE is harder to emulate because it uses the SH-4 MMU (which is hard to get correct in emulation) while the Sega OS doesn't.
Thanks ugetab.
edited 7:32 AM EST November 5, 2008
edited 8:30 PM EST November 5, 2008
http://foobar2000.xrea.jp/up/
This version is required for pretty much all of the latest rips posted here:
http://dsf.hcs64.com/
edited 11:53 AM EST November 6, 2008
Added some code to handle marginally shorter Intros to Loop times. If the Intro is at most 0.010 seconds shorter than the loop point before processing Intro times, the difference will be nullified, and it should report more accurately after processing.
A little bit more stuff added. 10 second spread between loop time and intro time, if it includes both, 1 loop + intro amount. Only if it's a 5 second or higher loop time. Added a loops-used counter to the results, and added an option to change base loop number used.
http://www.angelfire.com/nc/ugetab/SPC_Timer_Ugetab_Update.zip
edited 10:42 PM EST November 6, 2008
Now if manakoAT could just get that Sonic Shuffle rip finished...