ukVac.com Homepage
Forum Home Forum Home > Technical > Tech, Maintenance & Repairs
  New Posts New Posts RSS Feed - Sega 8751 what does it do exactly?
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Skin:


Sega 8751 what does it do exactly?

 Post Reply Post Reply Page  12>
Author
Message
karlcdoe View Drop Down
Senior Members
Senior Members
Avatar

Joined: 22 Jan 1999
Location: United Kingdom
Status: Offline
Points: 2959

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote karlcdoe Quote  Post ReplyReply Direct Link To This Post Topic: Sega 8751 what does it do exactly?
    Posted: 20 Apr 2011 at 5:17pm
Hello,

I notice from various battery of death sites that when resurrecting Sega boards some apparently  need an '8751' in place. More to the point I have a couple of Space Harrier boards, one working and one of which won't boot at the end of it's ten second countdown. Now, I know the whole board works fine because it is/was a functioning Enduro Racer.

Now here's the thing: if I take the 8751 from the working board and put it in the non booter it still wont boot, if I put the 8751 from the 'non booter' into into the working board that won't boot either (I haven't compared the roms from both boards yet to see if they are the same revision). If I remove it entirely it comes up with garbage, however, if I put the 8751 replacement module from enduro racer  (which just seems to be a pcb with some connected tracks and something like a 74LS04) it boots fine without any countdown but some of the graphics are corrupted and it doesn't look playable.

Sooo, looking at the datasheet I think it's a microcontroller with some ram and a 4K eprom. Is this being used as a security chip or something? Can they be copied or programmed? My 'new' progarmmer can't do 40 pin devices... The graphics artifacts on Space Harrier running with the Enduro module look like they must be fairly easy to work around. I had a look through the mame source and I haven't been through it all yet but I assume there is a way round this chip by virtue of the following procedure in 'segahang.c':

/*************************************
 *
 *  Per-game I8751 workarounds
 *
 *************************************/

static void sharrier_i8751_sim(running_machine *machine)
{
    workram[0x492/2] = (input_port_read(machine, "ADC0") << 8) | input_port_read(machine, "ADC1");
}


The chip causing me a headache is IC32 and is actually labelled C8751H-88 / L5310039 /
Intel '80
So can I burn a new set of ROMS and ditch the 8751 or am I stuck?

Cheers

Karl.

Back to Top
Guests View Drop Down
Guest Group
Guest Group

Please Register!

Feedback: 0
Post Options Post Options   Thanks (0) Thanks(0)   Quote Guests Quote  Post ReplyReply Direct Link To This Post Posted: 20 Apr 2011 at 5:48pm
your best bet might be junoman for one of his kits, i dont believe the're any unencrypted SH romsets around

Edited by Conners - 20 Apr 2011 at 5:50pm
Back to Top
karlcdoe View Drop Down
Senior Members
Senior Members
Avatar

Joined: 22 Jan 1999
Location: United Kingdom
Status: Offline
Points: 2959

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote karlcdoe Quote  Post ReplyReply Direct Link To This Post Posted: 20 Apr 2011 at 6:01pm
Yes, I had thought about the Sega ressurection site. However, Space Harrier doesn't use any battery backed modules so it's not on the list of kits whereas Enduro Racer uses one 'normal' 68000 and one of those horrible epoxy lumps in place of the other.

 
Back to Top
Macro View Drop Down
Senior Members
Senior Members
Avatar

Joined: 13 May 1999
Location: Norfolk, UK
Status: Offline
Points: 2955

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote Macro Quote  Post ReplyReply Direct Link To This Post Posted: 20 Apr 2011 at 7:15pm
based on the line you have copied, it just reads two ADC registers and dumps them into shared memory for the main code to read. So, without the chip I would guess the controls would not work. (plus if you say you get a countdown, it probably writes something to that memory location and then checks to see if it changes to make sure the chip is doing something!

I would not have thought it would affect the graphics based on that, although on system 16 hardware, the 8751 protected games have all of the screen registers etc. setup by the 8571, so maybe it does that as well!
Back to Top
karlcdoe View Drop Down
Senior Members
Senior Members
Avatar

Joined: 22 Jan 1999
Location: United Kingdom
Status: Offline
Points: 2959

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote karlcdoe Quote  Post ReplyReply Direct Link To This Post Posted: 20 Apr 2011 at 9:33pm
Interesting. I'll have to plough through the rest of the code and try and understand it properly. Would I be right in assuming that whatever is written to the eprom section on the 8751 is hard/impossible to retrieve and program onto another unit? I figured the fact that it's a windowed IC suggests I can at least erase the contents...

Cheers

Karl.
Back to Top
PaulSwan View Drop Down
Senior Members
Senior Members
Avatar
ZZZ

Joined: 12 Mar 1999
Location: Seattle, WA
Status: Offline
Points: 1575

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote PaulSwan Quote  Post ReplyReply Direct Link To This Post Posted: 20 Apr 2011 at 10:49pm
It contains a protection bit to prevent the contents from being re-read, but you can erase it and reprogram it if it's the window version. It's used for copy protection on a few game platforms for this reason.
ZZZ
Back to Top
Equites View Drop Down
Senior Members
Senior Members
Avatar
Chief Sheesher®

5 Years of Supporting ukvac.com!

5 Years of Supporting ukvac.com!



Joined: 28 Jun 2010
Location: Liverpool
Status: Offline
Points: 21508

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote Equites Quote  Post ReplyReply Direct Link To This Post Posted: 20 Apr 2011 at 11:12pm
Originally posted by Macro Macro wrote:

So, without the chip I would guess the controls would not work.
 
Completely correct - the controls do not work nor does the coin input.
Back to Top
karlcdoe View Drop Down
Senior Members
Senior Members
Avatar

Joined: 22 Jan 1999
Location: United Kingdom
Status: Offline
Points: 2959

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote karlcdoe Quote  Post ReplyReply Direct Link To This Post Posted: 21 Apr 2011 at 2:11am
Grrrrr......
Back to Top
karlcdoe View Drop Down
Senior Members
Senior Members
Avatar

Joined: 22 Jan 1999
Location: United Kingdom
Status: Offline
Points: 2959

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote karlcdoe Quote  Post ReplyReply Direct Link To This Post Posted: 26 Apr 2011 at 9:32am
I find it hard to believe there is no workaround for this. I assume there could be one (can't the workaround from mame be implemented in hardware and bodged onto the board?), if there were sufficient interest and someone with sufficient skills and time was willing to undertake the project Smile
Back to Top
guddler View Drop Down
Admin Group
Admin Group
Avatar
Busting vectors like it's 1982!

5 Years of Supporting ukvac.com!

5 Years of Supporting ukvac.com!



Joined: 24 Sep 2000
Location: W.Somerset
Status: Offline
Points: 39492

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote guddler Quote  Post ReplyReply Direct Link To This Post Posted: 26 Apr 2011 at 1:11pm
I've just had a quick scout through the mame code and whether it could be transplanted to hardware or not is really more than can be just ascertained in a 30 second browse through the code.

Having said that, if it's logic and or lookup table type stuff then yeah, I imagine it would transplant to a hardware solution but...

Would the mame 'fix' be accurate enough to work in real hardware??

Would it be cost effective (probably not).

You can get 40 pin DIL FPGA devices as we've seen before, but they run to about £70 when all is said and done. Somehow I doubt anyone would be willing to pay that. Obviously if you were making them up yourself then they'd probably come in a lot cheaper but then you're getting into the realms of would anyone even be interested in doing it? (again, probably not).

Bit of a case of pretty much anything's possible. Doesn't mean it's worth doing.
Back to Top
karlcdoe View Drop Down
Senior Members
Senior Members
Avatar

Joined: 22 Jan 1999
Location: United Kingdom
Status: Offline
Points: 2959

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote karlcdoe Quote  Post ReplyReply Direct Link To This Post Posted: 26 Apr 2011 at 2:06pm
Well. At the moment Space Harrier boards are failry pricey and Enduro Racers fairly cheap -though now I've said that they've probably just gone up 25%

I'm somewhat irritated that having programmed the two different ROM revisions that I could find and transplanted them to a known good board I appear to have a toasted 8751 on my spare boardset. Mind you, having played Enduo Racer on a real cab again after many years it's not quite as sh*te as i thought it was so maybe I'll keep it.... damn this hobby Wink



Edited by karlcdoe - 26 Apr 2011 at 2:07pm
Back to Top
Macro View Drop Down
Senior Members
Senior Members
Avatar

Joined: 13 May 1999
Location: Norfolk, UK
Status: Offline
Points: 2955

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote Macro Quote  Post ReplyReply Direct Link To This Post Posted: 27 Apr 2011 at 7:51pm
well, grab an 8571, write some code to do the read/write and give it a try.

for someone else to do it, they need the cab, an 8571, access to the internet and the inclination.

have a tech-meet, maybe you can convince someone to look then (whilst plying them with beer and food)
Back to Top
dj_yt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 Sep 2011
Location: United Kingdom
Status: Online
Points: 1497

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote dj_yt Quote  Post ReplyReply Direct Link To This Post Posted: 06 Sep 2011 at 11:29pm
Hello, just searched and found this thread.

Good news - it's done!

Now where's my beer and food :)


Edited by dj_yt - 06 Sep 2011 at 11:31pm
Back to Top
Macro View Drop Down
Senior Members
Senior Members
Avatar

Joined: 13 May 1999
Location: Norfolk, UK
Status: Offline
Points: 2955

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote Macro Quote  Post ReplyReply Direct Link To This Post Posted: 06 Sep 2011 at 11:57pm
neat.

sounds like a good excuse for a piss up
Back to Top
karlcdoe View Drop Down
Senior Members
Senior Members
Avatar

Joined: 22 Jan 1999
Location: United Kingdom
Status: Offline
Points: 2959

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote karlcdoe Quote  Post ReplyReply Direct Link To This Post Posted: 07 Sep 2011 at 9:46am
You've no idea what fantastic timing that is :-) Beer and food sounds reasonable to me....

I shall give this a try when I have a moment lthough sorting through my dead boards to find a working one with the right sound board may take a while.

Cheers

K


Edited by karlcdoe - 07 Sep 2011 at 9:50am
Back to Top
dj_yt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 Sep 2011
Location: United Kingdom
Status: Online
Points: 1497

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote dj_yt Quote  Post ReplyReply Direct Link To This Post Posted: 07 Sep 2011 at 10:57am
Great, let me know how you get on! 
Back to Top
karlcdoe View Drop Down
Senior Members
Senior Members
Avatar

Joined: 22 Jan 1999
Location: United Kingdom
Status: Offline
Points: 2959

Feedback: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote karlcdoe Quote  Post ReplyReply Direct Link To This Post Posted: 28 Sep 2011 at 12:11pm
Well, a quick update. It seems the graphical artifact I was seeing in my original post was actually a board fault (sprite scaling error?) and not a result of trying to run without the 8751 (doh!). It took me  ages to realise this but I have now got as far as confirming the patched game runs, coins up and the controls work using the first version of the patch and running with the enduro racer module (I think just a 74LS04 rather than an 8751). I haven't tested it in a 'moving' cabinet yet and it appears the PCM on the sound board is not working as I have garbage samples so it looks like I have at least two board faults to investigate but it's close.... 
Back to Top
cmonkey View Drop Down
Senior Member
Senior Member
Avatar

Joined: 10 Jan 2013
Location: Leeds, West YKS
Status: Offline
Points: 7730

Feedback: 5
Post Options Post Options   Thanks (4) Thanks(4)   Quote cmonkey Quote  Post ReplyReply Direct Link To This Post Posted: 03 Jan 2015 at 2:16pm
HUGE BUMP!

There's a need to revisit this topic as, over the past few days, there's been a discussion on the UKVAC Facebook page regarding this, so for those who haven't yet sold their souls to FB and can't access it, I thought I'd mirror the info here.

This all came to light when Space Harrier world champion and fine upstanding member of the UKVAC community Jodo mentioned in the discussion that there was a *bug* in Space Harrier when played on Enduro Racer hardware whereby occasionally your lives remaining would NOT decrease when you got hit by an enemy, or in some cases your lives remaining would actually *increase* when you got hit by an enemy.  He posted a video of it in action and I then also confirmed that the issue existed using both patched and unpatched SH roms in MAME.

Well this fascinated me and, as I've become rather adept at fixing Sega code bugs in the past few years, I thought I'd look into it deeper to hopefully resolve it.

As you may be aware it's possible to play Space Harrier on an Enduro Racer board set.  The only difference between an SH board set and an ER board set is the inclusion of an i8751 protection MCU on SH.

It was originally thought that the only purpose of the MCU was to check the main cpu roms at boot time, generate a vblank interrupt for the main cpu and process analog inputs/pass them to the main cpu.

It now turns out that this is not the case and the MCU does further protection on the game code.  This is the *bug* (it isn't actually a bug, it's protection code).

The protection routine starts at address $4aae in the main cpu code.  It works by querying the in-game timer (the timer that starts when you start a new game) and if the timer is a multiple of $200 (512) seconds it adds 1 to the word value @ $400f0 in memory.

This value is then copied, every vblank, to $124306 (in shared ram) by the code @ $4e86.  This is the trigger for bad things to start happening.

The value at $124306 is queried whenever you lose a life by the code @ $75ca and the following happens, based on the value held in that memory location at that time :-

if the value is 0 then nothing further happens (this is what the value should ALWAYS be)

if the value is 1 (i.e. after 512 seconds of gameplay) then the in-game frame counter is ANDed with a value of 1 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that, after 512 seconds of gameplay, you've got a 50/50 chance of NOT losing a life when you get hit by a bad guy.

if the value is 2 (i.e. after 1024 second of gameplay) then the in-game frame counter is ANDed with a value of 3 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that, after 1024 seconds of gameplay, you've got a 25% chance of losing a life, a 25% chance of NOT losing a life, a 25% chance of GAINING a life or a 25% chance of GAINING 2 lives, when hit by a bad guy.

if the value is 3 or higher (i.e. after 1536 seconds of gameplay) then the in-game frame counter is ANDed with a value of 7 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that you're now swimming in extra lives, to the point that the game will eventually crash if you keep getting hit by the bad guys (as you've accumulated so many lives by this point).


Long serving and well respected MAME dev team member Chris Hardy (Junofirstman on here) has confirmed my initial findings.  He believes the MCU writes a value of zero to address $400f0 every vblank, so the absence of this simulated code in SH running on ER hardware or in MAME meant that the above phenomenon was happening after 512 seconds of gameplay.

Chris has updated the MAME driver and submitted it and also suggested a patch to the roms for playing on ER hardware which will eliminate the problem.


So, taking a step back, I think this was a pretty crafty protection scheme by Sega.  Time delayed protections are usually very effective and the most difficult to find as they often don't start kicking in until a long time after the game has booted (as is the case here, ~8.5 minutes of gameplay until the effect is noticed).  This means that the bootleggers (was there ever a bootleg of SH?) may have thought that they'd overcome the MCU protection if they managed to clone the functionality of it sufficiently to get the game to boot.  They may not then have proceeded to test it sufficiently long enough to notice the time delayed protection effects kicking in.

What this would mean though is that, if SH was bootlegged and the bootleggers didn't overcome the time based protection and arcade operators bought a bootleg board instead of a genuine Sega board then the operators would likely have been losing money as the players would have been getting much longer gameplay for their 10/20p due to all the extra lives they'd have been getting.  So Sega's idea was to hit the operators where it hurt, in the pocket.

Thanks go out to Chris Hardy, Jodo, Mark Haysman and Ordyne for all chipping in with info and to Sega for making awesome games with semi-awesome protection. Wink

Really really would like to get a dump of the 8751 code though.  Does anybody know a way to do this (other than Chinese decapping/reversing factories) ?

Back to Top
Jodo View Drop Down
Moderator Group
Moderator Group
Avatar
It's Tachikoma Time!

Joined: 12 Jul 2008
Location: United Kingdom
Status: Offline
Points: 4366

Feedback: 5
Post Options Post Options   Thanks (1) Thanks(1)   Quote Jodo Quote  Post ReplyReply Direct Link To This Post Posted: 03 Jan 2015 at 6:54pm
I'm so glad this has been fixed - what a great community! Thumbs Up

There was a Space Harrier bootleg too! Glstar found it just last year: 


(It even has a bootleg marquee! I love it.)

I'd love to see what the board set looks like Glstar....Wink




Edited by Jodo - 03 Jan 2015 at 7:58pm
Space Harrier Arcade World Record Holder!!
Twin Galaxies Official Score: 42,384,290
Have a question about the forum? Need some help? Why not drop me a PM...
Back to Top
smarty View Drop Down
Senior Members
Senior Members
Avatar

Joined: 14 Oct 2011
Location: Fleet,Hampshire
Status: Online
Points: 14005

Feedback: 5
Post Options Post Options   Thanks (1) Thanks(1)   Quote smarty Quote  Post ReplyReply Direct Link To This Post Posted: 03 Jan 2015 at 7:04pm
Originally posted by cmonkey cmonkey wrote:

HUGE BUMP!

I just read up on the VAC Facebook group, great work all round! Clap

jumpnfire.com

MOST WANTED CABS:
Back to Top
 Post Reply Post Reply Page  12>
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.250 seconds.