Sunday 23 November 2014

Capcom Kabuki CPU - Intro

What do games such as Pang, Cadillacs and Dinosaurs or Block Block have in common?



Yes, they are all Capcom titles, but what i'm referring to is this thing:

The Capcom Kabuki Z80 CPU

Manufactured by VSLI Technology Inc, the Kabuki is a security enabled Z80 cpu used extensively by Capcom during the late 80s and early 90s.

Kabuki uses a custom crypto implementation involving an internal memory with a set of decryption keys in combination with external encrypted roms. A 3.6v external battery keeps those keys from being lost when the game isn't being powered

The obvious issue here: lose the power source and you will lose your game. 

Why did Capcom produce and use Kabuki? The one and only reason was to combat bootleggers, a widespread business practice back then that saw countless game titles being copied and produced by alternative companies without any rights or payments going back to the original manufacturers.

The security feature in Kabuki presumably tried to make things difficult for bootleggers in order to avoid open and simple copies of games from being produced.  

But did Kabuki accomplish its mission? 

This is a question that's hard to answer since there's known copies of most if not all Kabuki powered titles, therefore one could say in full confidence that Kabuki did not fully prevent game copies from happening, but probably helped reduce the amount of companies and/or individuals able to produce them.

The effectiveness of Kabuki as a business investment is probably a retrospective financial question that needs to be made to Capcom itself.  For us, the collectors and researchers in the post arcade business era, Kabuki represents the two sides of a coin, a very important piece in the arcade history that we need to preserve, but also a limitation to overcome in order to preserve fully working game titles today.

According to the Mame team this is the list of Capcom games known to use Kabuki:

Adventure Quiz 2 Hatena ? no Dai-Bouken  
Ashita Tenki ni Naare    
Block Block                            
Buster Bros
Cadillacs and Dinosaurs           
Capcom Baseball   
Capcom World              
Dokaben   
Dokaben 2
Mahjong Gakuen 2 Gakuen-chou no Fukushuu 
Pang 
Poker Ladies  
Pomping World 
Punisher                           
Quiz Sangokushi             
Quiz Tonosama no Yabou   
Slam Masters     
Super Buster Bros 
Super Marukin-Ban   
Super Pang (Japan) 
Super Pang (World)
Warriors of Fate                   
           
All these games use Kabuki as the main game cpu except for Cadillacs and Dinosaurs, Punisher, Slam Masters, and Warriors of Fate. These four titles use Kabuki only as the sound cpu in Capcom's patented Q-Sound technology. 

This blog post is the first one in a series of Kabuki articles that will analyze this security cpu in full detail, and share my research work and findings that successfully allowed me to reverse engineer this cpu and bring any dead Kabuki games back to life unmodified. 

What this means to you and the rest of the arcade community is full preservation of all Kabuki powered games as fully working factory originals.

You can read the next articles in the series here:




  • Part 1
  • Part 2
  • Part 3
  • Part 4
  • Part 5

  • 14 comments:

    1. Interesting! What will be your attempt in rebuilding Kabuki? FPGA?
      I assume it to be game specific, since different games have different encryption keys in the kabuki. The functionality is well documented in the MAME source code.
      Best Regards,
      Mike McBike

      ReplyDelete
      Replies
      1. Hi Mike, thanks for your comment. As the article says, my project brings dead Kabukis back to life unmodified. Regards.

        Delete
      2. I will definitely stay tuned... ;-) Go, go, go!

        Delete
    2. By the way, if you are in need of a tester, you may contact me anytime...

      http://www.wolfgangrobel.de/arcadereps/pang.htm

      Regards,
      Wolfgang (Mike McBike)

      ReplyDelete
    3. This is extremely awesome. Would decapping a chip be of any help in seeing now the encryption "system" interacts with the Z80 part of the chip?

      ReplyDelete
      Replies
      1. Indeed, watch the next few articles for a decapping journey.

        Delete
    4. I'd be highly interested in how the manufacturers did program the decryption keys into the SRAM at the production line, because there are no programming sockets on the pcbs. But around the Kabuki there are a lot of solder filled contacts, they might have used them for programming...

      ReplyDelete
      Replies
      1. Hi Wolfgang, good point, those contacts also caught my attention but they only seem to exist in Pang / Super Pang motherboards, haven't seen them anywhere else.

        Delete
    5. There seems to be no answer at the moment to an interesting question... ;-)

      ReplyDelete
    6. Hi Eduardo!!! I'm starting with the learning about repair of arcade boards, and I have a couple of Cadillacs and Dinosaurs suicide boards, and one with the qsound board with troubles. I need some help...do you speak spanish? if you can help me please let me know. Thank you very much.

      Eduardo Morales

      ReplyDelete
      Replies
      1. Hi Eduardo, i do speak spanish. Go on with any questions you have. Regards.

        Delete
    7. increible tu trabajo, pero siendo tan laborioso el proceso,como consiguieron hacer copias(bootleg) en los 80?
      ,gracias

      ReplyDelete