Bootleg Blues

[Huge]

As in: how to get these bootleg carts to work in emulators as they do in the hardware?

I've had a few bootleg carts over the years with a few minimal differences compared to the original titles. I'd like to repro these in emulators. However this does not seem to be too easy.

Case #1: Streets of Rage 2 bootleg.
This seems to be identical to the US ROM (no Blaze pantyshot), but with all regions enabled. As this cart is an epoxy blob, I can't dump it at the moment. It's not too interesting either, aside from using cart artwork from the Asia release (says both Bare Knuckle II and Streets of Rage 2 on the cart).



Case #2: T2 Arcade + Bare Knuckle III multicart.

Cart art
Cart PCB front
Cart PCB back
Cart PCB front, after desoldering

Sadly the awful PCB did not survive desoldering. I've seen these twice up for auction now, so I may be able to get a replacement one day.
The PCB has space for two standard 16mbit roms, which are included as epoxy blobs on separate PCBs, mounted with pin risers. Also a couple of TTL logic there (7474, 7400, 7432, 7400), which most likely handle the game change.

ROM1 contains the first 2 megs of a standard Bare Knuckle 3 rom. ROM2 contains the remaining 1 meg of BK3, followed by T2 The Arcade Game.
BK3 matches the Japanese rom perfectly. T2 matches the UE version with the exception of one byte around the string table.

Operation in the console is as follows: When first powered on, T2 is loaded. When doing a soft reset, the game switches to BK3. On the first soft reset, the cart actually hangs up for a few seconds until it switches, subsequent soft resets are instantaneous.

There is one peculiar thing that interests me however. When loading BK3 the first time, a certain extra "hidden" option is available in the, uh, Option menu. Namely, you can cycle the difficulty back more by pressing left.
You can select Very Easy: normally the easiest selectable mode is "Easy". Very Easy is there and it is a legit difficulty, if pathetically simple. You can, however, cycle the difficulty backwards even more, and the game will display random garbage instead of text. When launching the game with any of these garbage difficulties, the game will not spawn any enemies at all! This actually makes the game stuck at many parts too.

I believe you can also cycle back your lives and end up with either 0 or infinite ones. However I don't remember this part clearly, and I can't boot the game anymore as dumping it ended up destroying the pcb.

Given that the extra option in BK3 is only enabled on the first switch (once you cycle to the right once, the options return to what they normally are and cannot be set to the glitched values anymore), and that the ROMs are identical to the retail ones, I think this option is caused by certain RAM values set up by T2 Arcade, which are expected to be cleared when BK3 boots up. This, perhaps, merits some research.



Case #3: Ex-Ranza bootleg.

Cart art, front
Cart art, top
Cart PCB, front
Cart PCB, back
Cart PCB, front, top
Cart PCB, front, after desoldering

This one seems to be the normal Japanese game (it was called Ranger X outside Japan). There is, however, one key difference, however minor. The music for Stage 3 has a glitch which slows down the tempo of the song. In fact the entire sound driver slows down, as certain sound effects are played in slow motion as well. Plus, some extra "drums" start playing after a while.

Here's an MP3 recording of this

As there is no extra logic on the cart, just one mask rom, it is possible that this cart actually has different data. This is not entirely the case however.

Here's the ROM dump of the chip

The dump appears to be garbage, but I dumped it multiple times to get the same data; the rom read could be verified, and overdumping just repeated the first 1mb of data. So the dump should be good. And yet, it is entirely garbage.

The only thing I can think of is that the ROM address pins are wired in a different order than how a standard mask rom is, since there seems to be similar data patterns when compared to the retail rom. I plan on inspecting the pinout next.

So, the questions are:
1. how to get the hidden options in BK3?
2. what is wrong with the Ex Ranza dump?

And also; how to get the BK3/T2 multicart to behave as on the console. This is probably not possible, unless with custom loaders, such as the other bootlegs in HazeMD. Nevertheless, as those roms are identical to the retail carts, this is not even important.

edit: whoops, fixed the links.

[Huge]

Embarrassingly enough, just gathering my thoughts properly for a forum post is enough to figure out a problem sometimes. Load up a T2 Arcade savestate while running BK3, then soft reset. The "hidden" options are there. It also changes the controls (you can remap it back in the options), which it didn't do it in the bootleg cart, but oh well.

[r57shell]

It took for me few hours, to get pinouts configuration without looking PCB (because I don't know pinouts of 1608 chip)
http://rghost.ru/50519976
here it is, your dump.

bitswaping:
data byte: abcdefgh -> hdebcgfa
address: akcdspgoilbjmnhfqret -> abcdefghijklmnopqrst

And here is src: http://pastebin.com/wVtG23yD

it was fun.

[Huge]

Ah, and I was halfway mapping the pinout down. But this is better. Thanks a lot!

It is worth noting that the buggy slowdown music isn't perfectly emulated on any emulator, including Exodus. Exodus comes the closest though, but a part at the beginning plays faster. Kega has it pretty wrong until the "extra" drums start playing.

Also, the MP3 I recorded was from a PAL VA6 machine.