Saturday, 19 September 2015

CPS1 Project Update

Programmer code
The code needed by the programmer has been made available on the following github account: https://github.com/ArcadeHacker

Each folder contains the base code for the systems supported by the programmer. Before using your programmer make sure you run the right code for the target system to desuicide. 


Supported systems*
Pre-CPS Kabuki Z80 CPU based boards (Capcom and Mitchell)

CPS1 & 1.5 QSound titles 

*Important: make sure you read the known issues block further below.


Building your own programmer
The base of the programmer consists of two Arduino pieces:


I/O with the target arcade pcb happens via the 7 pins found just above of the lcd shield right side, look at the Kabuki pdf instructions for further visual reference, tap ground feed from the ICSP connectorhttps://github.com/ArcadeHacker/ArcadeHacker_Kabuki/blob/master/kabuki-instructions.pdf


Updating your programmer
In order to update your programmer or switch target systems you need to download the code using the Github mentioned above, look for the .ino files. Once you have downloaded the code just plug your programmer via USB to your computer and upload the right .ino code file using the Arduino IDE. If you don't have the Arduino IDE please download it from the following link:https://www.arduino.cc/en/Main/Software

Once updated just follow the programmer on-screen instructions.


Programming instructions

CPS1 & CPS1.5:
There's no documented guide yet (pending task), please follow these steps:

CPS 1 C board pinout as follows:
Connect programmer pin 3 to CNB pin 61
Connect programmer pin 4 to CNB pin 62
Connect programmer pin 5 to CNA pin 19
Connect programmer pin 6 to CNA pin 20

Please watch this video to see the whole process in action:

IMPORTANT: The programmer does not have enough power to drive the C
board. Watch the video to learn how to piggyback power from the game
motherboard.


Known issues [March 7th 2016 all issues fixed]
The following Pre-CPS titles have been reported not to work or have issues with the desuicider: Super Pang, Poker Ladies
Current behavior: Games start but freeze.

The following CPS1/1.5 titles have been reported not to work or have issues with the desuicider:  Cadillacs & Dinosaurs, Captain Commando, King of Dragons, Quiz & Dragons
Current behavior: Some graphic layers are missing.

Note: Thanks to Corrado, Tormod, Sylvain, and Bill D. for their patience and assistance.


Next steps
I'm currently converting one of my CPS1.5 titles into Cadillacs & Dinosaurs to be able to research the issue common to all four CPS1/1.5 games listed above. ETA before I start the research is 2 weeks from now.


Project pending tasks
Research and fix all known issues
Create a project wiki
Properly document CPS1/1.5 desuicide process

Tuesday, 16 June 2015

Capcom CPS1 - Part 3

Welcome to the third and last post in the Capcom CPS-1 reverse engineering series, if you missed any of the previous readings you can find them here:


Security inside

As explored during the previous two articles, with the introduction of CPS-1 Capcom developed a couple of graphic custom chips known as CPS-A and CPS-B. These chips unified many graphic functions and allowed Capcom to push its game capabilities further while reducing system design complexity.

One specific mission of custom CPS-B was security, a characteristic that prevented operators from reusing CPS-1 hardware by simply burning new roms, this was accomplished by featuring a unique internal chip configuration in almost every new game title.

While early CPS-B chips are truly unique items, with their internal configuration set at the silicon level, the final CPS-B revision known as B-21 was capable of holding any factory configuration by using internal memory backed by an external battery. This helped Capcom simplify its operation by not having to manufacture new CPS-B chips with every new release.

At production one specific configuration was defined by Capcom for the accompanying game title, and losing power supplied by the external battery means you lose your game, a typical problem faced by today's game collector in preserving working original games.





Sunday, 10 May 2015

Capcpom CPS1 - Part 2

Welcome to the second post in the Capcom CPS1 reverse engineering series, you can find Part 1 right here.

The roots of CPS1

Everything we know has an origin and predecessors, Capcom's arcade platform CP System 1 is no exception to the rule.

For many years arcade manufacturers battled for market share in release cycles that saw games burning out of distribution in just a few months. This intense competition demanded manufacturers faster releases and better games in a never ending market race.

According to an interview by LCSM to Kouichi "Isuke" Yotsui, father of Capcom's hit title "Strider", the Capcom Play System (CPS1) was originally developed with the need to bring better and bigger graphics into new games.

Isuke: "PCBs back then did not hold an abundant amount of data for graphics. The CPS was developed to free ourselves from that."
Isuke circa 2011. Source: Striderpedia

With full 16 bits capabilities, plenty of hardware sprites, tiles and graphic layers, CPS1 extended game asset and code storage capacity beyond its lifetime needs. The largest CPS1 B board known allowed for 8.39 megabytes of graphics, 3.15 megabytes of cpu code, and 0.39 megabytes of audio code and samples. No game ever released on CPS1 used the full rom capacity found in the system, although CPS 1.5 systems expanded the audio storage capabilities via a new dedicated q sound board.

CPS1 B Board rom sections
CPS1 B Board rom sections

The availability of the new system sparked the production at Capcom of a new generation of games developed almost in parallel. The three initial titles under development consisted in Daimakaimura (Ghouls'n Ghosts), Forgotten Worlds, and Strider, in that order respectively. In the end Forgotten Worlds made it first to market and got to be the first official CPS1 release title.

The Chocolate Factory. Capcom's production line, circa 1992. credit: Super Power magazine


But how did CPS1 and its specs came to be? An early 1990s interview extract from the french magazine "Super Power" seems to confirm the prevalent expert arcade community opinion: CPS1 base specs came straight from a computer commercially unknown to the western world: Sharp's X68000 a.k.a. the god computer.

Isuke: “I have participated to the development of the CP system and yes absolutely, the X68000 is the base of the CP system." (Thanks to Denis Lechevalier for the interview extract and photos)
Capcom offices. Circa 1992. credit: Super Power magazine


X68000: The God Computer

In March of 1987 Sharp released the X68000 home computer to the Japanese market, a multimedia computer so strong and powerful it had no immediate rivals. The new system wasn't even matched by the highly awarded Commodore Amiga 500 released six months later.

Sharp X68000

The X68000 featured full 16 bits capabilities thanks to its Motorola 68k cpu running at 10Mhz, came with 1 megabyte of memory upgradable to 12 megabytes, advanced sound and high resolution hardware graphics with a 65k color palette, a device better than any arcade game platform at the time. Full specs.

Personally whenever I try compare the X68000 with the humble specs of my first computer back then, the Amstrad CPC 6128, I really feel the X68000 earned its "god computer" nickname well. Indeed a device sent from the future.

With the introduction of the X68000 Sharp leapfrogged the market in such a way it remained the most capable gaming platform until the early 1990s. Even today the X68000 with its distinct double tower design is still undeniably appealing in terms of aesthetics. PS4 anyone?

With a whopping price tag of 369,000 Japanese Yens, $2,434 USD in 1987 money or more than $5000 USD in today's money, Sharp sold millions of units in the Japanese market until its final update in 1993. The reasons as to why Sharp didn't release this system outside of Japan are unknown to me, please contribute any information by commenting below.




According to what is known, Capcom used the X68000 as a benchmark for its CPS1 hardware design and also as game development workstation. Capcom wasn't the only arcade game design company known to have used the X68000 for the production of videogames, for example Toaplan used it to develop games like Outzone, Truxton, and all of their 68000 based releases.

Capcom's sound and music design team at work. X68000 compact workstation. Super Power magazine.

Thanks to its involvement in content and game creation and its strong market share, the X68000 enjoyed plenty of pixel perfect arcade ports. Titles such as Final Fight or Daimakaimura (Ghouls'n Ghosts) were released on the X68000 and are still in high demand by todays collectors. Ironically, putting your hands today on a copy of Final Fight for the X68000 will cost you twice as much as the original arcade game board.

Although commonly referred as a pixel perfect port, ports like Final Fight aren't exactly perfect. For example Final Fight for the X68000 will only display a maximum of four concurrent enemies on screen where as the arcade version will do as many as nine. This is due to CPS1 being more capable in terms of hardware sprites: 256 vs 128.




The Chocolate Factory Suppliers

Now we know how Capcom got its base specs for the development of CPS1. How about hardware suppliers?

Many companies contributed to the making and supply of CPS1 parts, although one particular company contributed the most significant number of them. Hitachi, the Japanese multinational, was the most notable supplier with multiple parts including TTL chips, memories, and the main system CPU.

Capcom's CPS1 featured the CMOS version of the Motorola 68000 CPU running at 10Mhz (later upgraded to 12Mhz). The CPU introduced in 1985 was a joint development of Motorola and Hitachi after a long term relationship between the companies.

This special relationship was recently discussed in an interview with Bill Walker, a now retired SVP at Motorola:
"Our manufacturing practices were pretty bad back then, low yields, long cycle times and poor productivity. In 1978, Motorola and Hitachi entered into a technology exchange venture. We brought a lot back and injected it into our manufacturing and it helped greatly, especially when we built our newest factory in the early eighties. That became the factory that built most of the 68K products – a new 5 inch factory, MOS-8."
The original CPS1 main cpu: Hitachi Motorola 68000 2-micron CMOS process

Other significant parts found inside CPS1 boards are the secondary cpu dedicated to running the sound program, a standard Z80 type cpu by Zilog running at a speed of 3.5Mhz, or multiple rom chips sourced from a variety of vendors such as Intel, AMD, Hitachi or Sharp.


The Graphic Customs

One of the most intriguing questions we had at the time of starting the reverse engineering effort on CPS1 was identifying who developed the two mysterious customs found on the A and C boards. None of them showed any identifiable manufacturer marks or logos besides the CAPCOM mark and production id numbers.

CPS1 custom chips, B custom on the left, A on the right.

In our mind the most probable vendor responsible for these customs could had been Hitachi, not only we knew it to be a high contributor to CPS1 parts, but also at the time of the making of CPS1 Hitachi had a good number of popular custom ASIC products in the market.

Uncovering the custom secrets and helping the arcade community overcome the popular CPS1 security issues led us to begin the reverse engineering efforts on these customs. Once digshadow got his hands on the CPS1 parts I sent him the wait to understand who was behind the customs came to an end. At his lab and with the aid of a powerful metallurgical microscope the truth got revealed: the vendor of choosing for the CPS1 custom parts was Ricoh.

Partial photo of CPS-1 custom B-21 under the microscope, credit: digshadow

This finding went against all our bets, but research revealed Ricoh was in the business of producing a range of CMOS based products including memory products and gate array or standard cell based custom chips. According to specifications found in Ricoh's 1988 product databook, both custom chips found in CPS1 belong to the RSC-15 CMOS standard cell series made with a 1.5 micron process.

[Update May/13th 2015] Thanks to everyone who pointed out Ricoh is the company behind the original Nintendo NES cpu, a variant of the popular 6502 cpu. More on this here.

Thanks to this integration effort Capcom introduced plenty of new graphic hardware functions packaged inside these customs, and managed to substantially reduce overall pcb complexity by eliminating legacy parts used in previous designs.

With them also came a number of security measures that have been a nightmare to today's arcade collectors and a barrier to fully preserve a good number of arcade titles in the CPS1 series.

This is all for now, I hope you have enjoyed Part 2 of the CPS1 reverse engineering series. On the next post we will explore custom B-21 in detail and discuss how the custom chip got dissected and analyzed. Stay tuned.

Update: Part 3 now available


Thursday, 16 April 2015

Capcom CPS1 - Part 1

For most of the 80's, arcade titles were the product of intense hardware and software custom design work. With every new game title came a new board design and the full dedication of multiple specialized teams including experts in hardware, electronics, software, game design, graphics, sound... the list goes on and on.

Competition, faster release cycles, and the need for continued improved financial results, drove arcade manufacturers into operational optimization and standardization efforts with the ultimate goal of focusing into their true core business: producing successful video games, not hardware.

With the introduction in 1988 of the Capcom Play System 1 (CPS-1) by Capcom, the company signaled a new era in game design quality and hardware platform maturity.

An original CPS-1 Street Fighter II CE kit from my personal collection

The CPS-1 system was Capcom's bet in standardizing its own game release cycle, and the new system gave birth to 32 new game titles, about 137 if we count in game revisions and market specific localized versions. Its 16 bits and extended capabilities served as publishing vehicle for successful franchises such as Capcom's worldwide hit: Street Fighter II.

According to one release flyer from the UK distributor Electrocoin, the new system took 2 years to develop and a total investment of $5,000,000 USD ($10 million in 2015 money). But take this information just as a reference, the flyer happens to be full of marketing driven inaccuracies such as the claim about the system containing three 68000 cpu cores... (Thanks Haze for the finding).

Electrocoin UK CPS-1 advertisement. Source: arcade-museum.com

In production for a total of 12 years (1988-2000) and 6 known revisions, CPS-1 is probably one of the most successful hardware platforms in the history of the arcade industry and Capcom's first truly modular/reusable system. The reach of CPS-1 even includes a failed attempt to penetrate the home video game market.

CPS-1 the detail

The design consist of a number of interconnected pcbs known as A, B and the later added C board and Q-sound board. Here's a description of each layer:

  • A: the base board containing most of the system hardware. eg: cpu, memory, sound, etc...
  • B: the game rom board containing a combined number of mask roms and/or eproms.
  • C (later added): an small satellite board containing a video logic custom chip, and sometimes additional IO.
  • QSound (later added): a full size intermediate board providing new sound capabilities, the board is sandwiched in between A and B.

Note: C board was introduced right after the two initial game releases: Forgotten Worlds & Ghosts and Ghouls, and wasn't part of the original CPS-1 design. Instead, its contents were an integral part of the B board.

CPS-1 Technical specs: (source: Wikipedia)

  • CPU
    • Primary: Motorola 68000 @ 10 MHz (some later boards 12 MHz)
    • Secondary: Zilog Z-80 @ 3.579 MHz
  • Sound Chips:
    • Yamaha YM2151 @ 3.579 MHz
    • Oki OKI6295 @ 7.576 MHz, Stereo
  • Display
    • Resolution: Raster, 384x224 @ 59.6294 Hz
    • Color Depth: 12 bit RGB with a 4 bit brightness value
    • Colors available: 4096
    • Onscreen colors: 3072 (192 global palettes with 16 colors each)
  • Sprites:
    • Simultaneously displayable: 256 (per scanlines)
    • Sizes: 16x16, max. 16 colors (15 unique + 1 transparent)
    • Vertical and Horizontal Flipping capability
  • Tiles: Sizes 8x8, 16x16, 32x32 with 16 colors (15 unique + 1 transparent)
  • Tile Maps: 3 Maps, 512x512, 1024x1024, 2048x2048 pixel
  • 68K RAM: 64 KB WORK RAM + 192 KB VRAM (Shadow)
  • PPU: 192 KB VRAM + 16 KB CACHE RAM
  • Z80 RAM: 2 KB WORK RAM

CPS-1 evolution

The CPS-1 platform went through five clear differentiated evolutionary phases. The first release of the platform consisted only of a two layer design which missed what we know today as the C board.

1988 Forgotten Worlds 
A two layer design with QFP soldered mask roms.

CPS-1 launch title Forgotten Worlds. Photo by James Greenhalgh.

1989 Strider 
A three layer design introducing the top C satellite board. QFP mask roms are gone, uses standard DIP roms instead. This modern layout stays for most of the CPS-1 lifetime.

CPS-1 Strider. Photo taken from arcade-system.com

1991/92 Street Fighter II Champion Edition 
The system gains a 20% speed bump by increasing the system frequency from 10Mhz to 12Mhz. With SF II the C board features additional IO for the extended game controls (6 buttons per player).

Street Fighter II Champion Edition board



1992 Capcom World 2
Some CPS-1 releases are enclosed inside a partial soft case including a title marketing sticker. The system features the same three layer design.

Capcom World 2 enclosed in a soft case

1993 Warriors of Fate
Updated CPS-1 design known as CPS Dash (or CPS 1.5). Four layer design featuring a new intermediate QSound board. All enclosed inside a hard case that includes an internal fan. This is the final update to the CPS-1 platform.

CPS (1.5) Dash hard case with QSound for the game Warriors of Fate.

This last update also saw a failed attempt of marketing CPS Dash as a home videogame system. The system was known as Capcom Power System Changer. Below is an original mailer about the system and its accessories:

Capcom Power System Changer. Photo taken from therealundamned.blogspot.com

CPS-1 the customs

One of the many milestones of CPS-1 is probably the reduction in the dependency of TTL chips, a family of logic chips widely used in the arcade video game industry since its very beginnings. With the introduction of CPS-1, Capcom also introduced a number of custom ASIC chips bringing new system capabilities, as well as a significant reduction in board density and complexity.

An ASIC is basically a custom chip built on request to meet a certain specification. In basic terms think of it as a relative easy way (if you have the required upfront investment capital) of integrating many off the shelf logic parts into just one.

A couple of these custom chips found in CPS-1 are the video logic ASICs known as A-XX and B-XX.

Left: CPS custom B. Right: CPS custom A


Rather than being mission specific, these chips do combine several video functions (scrolling, layer controls, palettes, memory transfers, etc... ) and as you can see in the photos above both came in high IO density QFP chip packages.


The strange case of COMCO

One good story about these customs is the apparent existence of a full A-01 custom clone under the comical brand "COMCO". Did anyone back then leak, sold, or steal the designs of this chip from Capcom? Or perhaps someone in the 90s embarked into fully reversing it? Whichever the case, who did it was resourceful enough and had the investment capacity to successfully reproduce and manufacture working clone parts.

Left: COMCO A-01 clone. Right: CAPCOM A-01 original part. 

I find this particular story amusing and believe it deserves a future investigation. Thanks to Fabrizio (Caius) for exposing the existence of the clone.

CPS-1 security

The overall reason for the existence of the C board is copy protection. The B-XX custom was manufactured with a different unique internal configuration in almost every new game, preventing operators from simply changing roms from title to title. Eg: converting old dated games into new releases without the right.

With the release of the game "Three Wonders", custom B-XX underwent its last known revision (B-21) which saw the introduction of an on-chip internal memory backed by an external battery.

CPS-1 C board with custom revision B-21. Battery shown on the left.

This custom component gave Capcom the ability of having a dynamic internal configuration without the need to update and build new B-XX custom chips with every release, an operational optimization that most probably simplified Capcom's life and introduced long term savings on production cost.

The long term consequences of this practice? Lose the battery, lose the game. As discussed earlier this practice probably helped Capcom with stopping plain and simple piracy attempts. But did this stop professional bootleggers? Clearly not as we know today CPS-1 and its army of hit games have been cloned to infinity.

On the positive side the perceived survivability of the B-21 battery is strong. The custom is known to hold for an impressive number of years on its original battery, most have survived 20+ years and many even still go on today. In any case, for us collectors in the post arcade industry era, this battery backed chip represents a problem to overcome in order to keep working unmodified originals of our CPS-1 titles.


CPS-1 the challenge

With the idea of uncovering the CPS-1 B-XX custom secrets and providing the arcade community with complete control over their hardware, I teamed with the almighty Digshadow and went ahead on a quest to reverse engineer this mysterious chip.

What's inside CPS-1 B-21? Who manufactured it? Can it be desuicided and reprogramed? To our satisfaction all of these questions (and more) already have an answer. During the next coming days a series of articles will provide you the insights and full disclosure on all of the B-21 custom secrets. Ready to discover what Capcom didn't want you know?

Stay tuned.

Update: Part 2 now available

Monday, 13 April 2015

Capcom CPS1 Announcement

Dear all, i'm very happy to announce the successful reverse engineering of the CPS1 security enabled custom PPU, also known as CPS B-21.

CPS1-C board with battery backed B-21 custom IC

What this announcement means for the arcade community is full preservation of CPS1 systems enabled with security, without the need to modify hardware or rom code.

Details about the reverse engineering process, milestones, and full disclosure of the custom IC programing method to follow during the coming days.

Thanks all for reading and supporting this project.

Sunday, 18 January 2015

Kabuki Presentation PDF

Some of you have requested a copy of the pdf presentation I used during the final Kabuki video, here it is: kabuki-reprograming.pdf

Saturday, 17 January 2015

Announcing Sega's FD1094 Reverse Engineering


Dear all, it is my pleasure to announce the beginning of Sega's FD1094 reverse engineering effort. As it was with Kabuki, the main goal is to understand the programing secrets of this security processor featured in plenty of arcade games developed by Sega.

After having spent some time studying it, I firmly believe Sega's FD is probably one of the more complex and beautiful chips ever designed.

Stay tuned.

ps: If you hold a stash of FD1904 & FD1089 cpu's please consider donating any spare units to the cause, contributions welcome.

Thursday, 8 January 2015

I LOVE this community

Just wow guys, the reaction to the Kabuki Reverse Engineering series has been extraordinary, and I want to thank you all for being such a great and devoted community. The arcade family is one of a kind.

During the last weeks I got contacted by great individuals that not only praised and recognized the work on Kabuki but also offered help as well as valuable information on new intriguing challenges. All of this activity has lead to countless discussions on undefeated security systems, such as the Sega FD, Capcom's CPS1, CPS2, and the CPS3.

I'm sure this great momentum will not be wasted so expect further news from my end soon.

Great stories ahead.

Sunday, 4 January 2015

Capcom Block Block desuicide - Kabuki Programmer

Video demonstrating the reprograming of a suicided Capcom Block Block arcade game motherboard.