Jump to content

MAME Changes that relate to FME


Altharic
 Share

Recommended Posts

3 hours ago, thealteredemu said:

Wow, would love to see Pluto6 just a certain few Astra lo-techs.

Great stuff :)

J

Pluto 6 would be impressive, although I guess the manufacturer specific FPGA chips will be the issue? Definitely good to see development on it. I forgot that my old JPM clubber, an Al Murray clubber based on Casino Crazy but with £400 jackpot and multi stake, used it. I assume other late JPM and Crystal club and pub machines would. Along with the usual Betcoms and similar.

I'm assuming Empire used it too once they were absorbed by Astra, so plenty of other lo-techs.

I can't remember though if the likes of Bullion BARs Streakin' used Pluto 6 or if they ran something else? I feel like they might have had a backplane arrangement like the Firefox machines? They used Firefox cabinets for sure.

Edited by slotsmagic

Happy non-gambler since 1st January 2025!
(if anyone else needs or wants to quit, I recommend Allen Carr's 'Easyway to Stop Gambling'.
Still happy to dump ROMs for people and that sort of stuff :)

Link to comment
Share on other sites

15 hours ago, slotsmagic said:

Pluto 6 would be impressive, although I guess the manufacturer specific FPGA chips will be the issue? Definitely good to see development on it. I forgot that my old JPM clubber, an Al Murray clubber based on Casino Crazy but with £400 jackpot and multi stake, used it. I assume other late JPM and Crystal club and pub machines would. Along with the usual Betcoms and similar.

Betcoms are scorp. I think most (if not all) Betcoms that have a scorp6 version will also have a scorp5 version but we have problems with a couple of those so maybe scorp6 will be a solution.

Your box will be CASHPOT

Link to comment
Share on other sites

3 hours ago, dondplayer said:

Betcoms are scorp. I think most (if not all) Betcoms that have a scorp6 version will also have a scorp5 version but we have problems with a couple of those so maybe scorp6 will be a solution.

Ah, I might have been confusing Betcom with someone else. I have a habit of lumping all the modern crap machines into the same category lol.

There's definitely been plenty of pub AWPs on Pluto 6 the last 10/15 years I'm sure, but many of them may have had Scorp 5 versions or similar?

 

(Edit - see attached for a Betcom Pluto 6 board with Paddy's PD (PayDay?) CF card)

Screenshot_20250124_115653_com_ebay_mobile_ViewItemActivity.jpg

Edited by slotsmagic
  • Like 1

Happy non-gambler since 1st January 2025!
(if anyone else needs or wants to quit, I recommend Allen Carr's 'Easyway to Stop Gambling'.
Still happy to dump ROMs for people and that sort of stuff :)

Link to comment
Share on other sites

I wonder if they may have more security outside of the Pluto 6 'core' emulation; from the Heber website:
 

Sophisticated Security

Safety against game piracy is imperative. Pluto 6 uses two-stage customer-specific security giving superior protection to your gaming application. A security chip and security software ensures that once your application is developed it is well and truly safeguarded.


Hopefully not of course (this may even be a recent development, and not be present on the older fruit machine hardware already deployed), and if the dev has a running game, then they may have already bypassed it... but might be a roadblock depending on how it's implemented etc.

Edited by johnparker007

[ Arcade Simulator ] Pre-alpha installer: https://tinyurl.com/2kcrkprh | Donation info: https://tinyurl.com/yzvgl4xo
[ Community Drive ] The drive: http://tinyurl.com/yckze665
[ Fruit Machine Database ] Initial google sheets (WIP): https://tinyurl.com/2c5znxzz
[ Fruit Machine ROM  Archive ] The archive: https://tinyurl.com/3jhzbueb
[ Fruit Machine Settings/Tests Guide ] https://tinyurl.com/yuebw8b5
[ MAME (fixes/improvements) ] Commits: https://github.com/johnparker007/mame/commits/master/?author=johnparker007

[ MFME Launch ] Source code: https://github.com/johnparker007/MFMELaunch
[ Oasis ] Source code: https://github.com/johnparker007/Oasis
[ Sound ROM Editor ] Source code: https://github.com/johnparker007/SoundRomEditor

Link to comment
Share on other sites

3 hours ago, johnparker007 said:

I wonder if they may have more security outside of the Pluto 6 'core' emulation; from the Heber website:
 

Sophisticated Security

Safety against game piracy is imperative. Pluto 6 uses two-stage customer-specific security giving superior protection to your gaming application. A security chip and security software ensures that once your application is developed it is well and truly safeguarded.


Hopefully not of course (this may even be a recent development, and not be present on the older fruit machine hardware already deployed), and if the dev has a running game, then they may have already bypassed it... but might be a roadblock depending on how it's implemented etc.

It sounds like some manufacturers never utilised it (reflex) so it might be possible to bypass it, well time will tell of course.

J

 

  • Like 1
Link to comment
Share on other sites

A quick read on google, looks like they are able to be dumped.  I imagine the data is scrambled with the receiving end deciphering it?   I don't really know a lot about this kind of stuff.  I'm sure it won't just be as simple as dumping the data as it would seem a bit pointless if it is security.

J

Link to comment
Share on other sites

I am pretty sure these security chips cannot be read by normal means, they will have there security fuses blown, BUT as with all chips they can be done by company's using nitric acid and high powered microscopes! but that of course can cost £1000 for just one chip, and more if its a complex fpga, so if there is more than just one chip used for different machines (like mpu4 charactisers) it really makes it very uneconomical to do

Link to comment
Share on other sites

probably why mfme was never back ported back to mame I remember a convo I had years ago on how they got past these chips and how the debugger was used to bypass the chrs, basically the machine would ask for (example) the number 2 rather than emulate the chip and pass 2 to the machine they would feed it the number 2

Link to comment
Share on other sites

41 minutes ago, Altharic said:

probably why mfme was never back ported back to mame I remember a convo I had years ago on how they got past these chips and how the debugger was used to bypass the chrs, basically the machine would ask for (example) the number 2 rather than emulate the chip and pass 2 to the machine they would feed it the number 2

yes so if you know what the machine is asking for you can program a chip to give those answers to the mpu, its how i did mpu5 security chips in real machines, but took me 6 months and more to do it

Edited by andrew96
Link to comment
Share on other sites

and sadly why Pluto might be stumbled they like straight emulation and no workarounds unless its something they like and are interested in saw a full PR get binned the other day no help just criticism so the guy just went fuck this and walked understandable IMO

 

https://github.com/mamedev/mame/pull/13264

Edited by Altharic
Link to comment
Share on other sites

20 hours ago, Altharic said:

and sadly why Pluto might be stumbled they like straight emulation and no workarounds unless its something they like and are interested in saw a full PR get binned the other day no help just criticism so the guy just went fuck this and walked understandable IMO

 

https://github.com/mamedev/mame/pull/13264

Wow, a lot of work there for it just to get cancelled :(

Sadly there are quite a few folk who won't even consider contributing to MAME because of the difficulty of getting stuff approved.

 

Link to comment
Share on other sites

Not strictly fme but could be now gas a recompiler that means a big speed increase for demanding systems I can see them adding more if this lot works

1.21 Updated to MAME 0.274 which adds a 64-bit ARMv8 recompiler (DRC). This means a huge performance boost on very demanding systems like K.Instinct or CPS-3. Support 16 KB page sizes so that new Android devices will work.

  • Like 2
Link to comment
Share on other sites

  • 1 month later...
On 25/01/2025 at 19:02, Altharic said:

and sadly why Pluto might be stumbled they like straight emulation and no workarounds unless its something they like and are interested in saw a full PR get binned the other day no help just criticism so the guy just went fuck this and walked understandable IMO

 

https://github.com/mamedev/mame/pull/13264

So for Heber's Pluto 5 board you can absolutely brute-force the security on it. There was a handful of bytes which changed depending on the customer; so were someone to try and reverse engineer one of my games (which I'd happily supply the security byte data for) you can prove the ROMs boot up. Then for other games it'd just be a case of amending those bytes and trying again, and repeat until the thing boots....

Pluto 6 was a bit more involved but still should be fairly straightforward to crack.

  • Like 4
Link to comment
Share on other sites

1 hour ago, edwardb said:

So for Heber's Pluto 5 board you can absolutely brute-force the security on it. There was a handful of bytes which changed depending on the customer; so were someone to try and reverse engineer one of my games (which I'd happily supply the security byte data for) you can prove the ROMs boot up. Then for other games it'd just be a case of amending those bytes and trying again, and repeat until the thing boots....

Pluto 6 was a bit more involved but still should be fairly straightforward to crack.

If there is a magic string of bytes per game, that could included in the MAME driver per game definition, that would be acceptable to the core MAME devs.  We already do it with the characteriser lamp column values for MPU4 (to 'unscramble' the lamps).

[ Arcade Simulator ] Pre-alpha installer: https://tinyurl.com/2kcrkprh | Donation info: https://tinyurl.com/yzvgl4xo
[ Community Drive ] The drive: http://tinyurl.com/yckze665
[ Fruit Machine Database ] Initial google sheets (WIP): https://tinyurl.com/2c5znxzz
[ Fruit Machine ROM  Archive ] The archive: https://tinyurl.com/3jhzbueb
[ Fruit Machine Settings/Tests Guide ] https://tinyurl.com/yuebw8b5
[ MAME (fixes/improvements) ] Commits: https://github.com/johnparker007/mame/commits/master/?author=johnparker007

[ MFME Launch ] Source code: https://github.com/johnparker007/MFMELaunch
[ Oasis ] Source code: https://github.com/johnparker007/Oasis
[ Sound ROM Editor ] Source code: https://github.com/johnparker007/SoundRomEditor

Link to comment
Share on other sites

2 hours ago, johnparker007 said:

If there is a magic string of bytes per game, that could included in the MAME driver per game definition, that would be acceptable to the core MAME devs.  We already do it with the characteriser lamp column values for MPU4 (to 'unscramble' the lamps).

OK. On Pluto 5 there were 3x 4-byte values which would be set in the ROM before compilation. There was some IO mapping stuff going on in the FPGA. I could probably get this stuff compiling again, change the FPGA code over then look at the ROMs and work out what goes where....

 

/*
APOLLO GAMING LTD - SOFTWARE R&D					COPYRIGHT 2008 (c) APOLLO GAMING LIMITED
Filename:	FPGA.h
Author:		EB
Revision History:
	- 19/05/2008	Created			v1.0			
----------------------------------------------------------------------------------------------
Contains data for specific FPGA versions
1. Development
2. Apollo SECURE FPGA 1
3. That Dutch Company Who Was A Pain In The Arse
*/		 
#ifndef __FPGA_H
#define __FPGA_H

/**************************** BEGIN DEV FPGA VERSION HERE ***************************/
#if (DEV_FPGA_VERSION==1)

#define FPGA_SIG		0x01						/* value of ident byte */
													/* read @FPGA_ID */
#define FPGA_REG_BASE	(FPGA_BASE+0x00)			/* FPGA registers base */
#define FPGA_IO_BASE    (FPGA_BASE+0x20)			/* FPGA I/O base */

//	Offsets from FPGA_REG_BASE
#define FPGA_ID		(BYTE*)(FPGA_REG_BASE + 0x01)	/* read FPGA ID byte */
#define XCRA		(BYTE*)(FPGA_REG_BASE + 0x00)	/* FPGA Control Reg A */
#define XMPX		(BYTE*)(FPGA_REG_BASE + 0x01)	/* Multiplex Control Reg */
#define XDRA		(BYTE*)(FPGA_REG_BASE + 0x02)	/* data, pins FPGA0-6 */
#define XDRB		(BYTE*)(FPGA_REG_BASE + 0x03)	/* data, pins FPGA0-6 */
#define XDDRA		(BYTE*)(FPGA_REG_BASE + 0x04)	/* data dir, FPGA0-6 */
#define XDDRB		(BYTE*)(FPGA_REG_BASE + 0x05)	/* data dir, FPGA8-14*/
#define SFXR1		(BYTE*)(FPGA_REG_BASE + 0x06)	/* SFX Ch 1 byte */
#define SFXR2		(BYTE*)(FPGA_REG_BASE + 0x07)	/* SFX Ch 2 byte */

#define XSEC		(BYTE*)(FPGA_REG_BASE + 0x07)	/* Security Byte */

//	Offsets from FPGA_IO_BASE
#define AUX_BASE	(FPGA_IO_BASE+0x10)   			/* Base Of Aux Outputs */
#define AUX0		(BYTE*)(AUX_BASE+0x00)			/* AUX0 Output */
#define AUX1		(BYTE*)(AUX_BASE+0x01)			/* AUX1 Output */
#define AUX2		(BYTE*)(AUX_BASE+0x02)			/* AUX2 Output */
#define AUX3		(BYTE*)(AUX_BASE+0x03)			/* AUX3 Output */
#define AUX4		(BYTE*)(AUX_BASE+0x04)			/* AUX4 Output */
#define AUX5		(BYTE*)(AUX_BASE+0x05)			/* AUX5 Output */
#define AUX6		(BYTE*)(AUX_BASE+0x06)			/* AUX6/EXT SCL Output */
#define AUX7		(BYTE*)(AUX_BASE+0x07)			/* AUX7/EXT SDA Output */

#define OUTPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of outputs */

#define INPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of inputs */

#define INPUTS2		(*(volatile char*)FPGA_IO_BASE)			/* base of inputs */

#define	CSAM0 	0x00FFFFF5
#define	CSBAR0	0x00000009

#define	CSAM1	0x00FFFFF5
#define	CSBAR1	0x01000001

#define	CSAM2	0x00FFFFFF
#define	CSBAR2	0x02000003

#define	CSAM3	0x00FFFFFF
#define	CSBAR3	0x03000001

#endif

/**************************** BEGIN APOLLO_FPGA_VERSION ***************************/
#if (APOLLO_FPGA_VERSION==1)

#define FPGA_SIG		0xca				/* value of ident byte */
													/* read @FPGA_ID */
#define FPGA_REG_BASE	(FPGA_BASE+0x50)			/* FPGA registers base */
#define FPGA_IO_BASE    (FPGA_BASE+0x00)			/* FPGA I/O base */

//	Offsets from FPGA_REG_BASE
#define FPGA_ID		(BYTE*)(FPGA_REG_BASE + 0x01)	/* read FPGA ID byte */
#define XCRA		(BYTE*)(FPGA_REG_BASE + 0x00)	/* FPGA Control Reg A */
#define XMPX		(BYTE*)(FPGA_REG_BASE + 0x01)	/* Multiplex Control Reg */
#define XDRA		(BYTE*)(FPGA_REG_BASE + 0x02)	/* data, pins FPGA0-6 */
#define XDRB		(BYTE*)(FPGA_REG_BASE + 0x03)	/* data, pins FPGA0-6 */
#define XDDRA		(BYTE*)(FPGA_REG_BASE + 0x04)	/* data dir, FPGA0-6 */
#define XDDRB		(BYTE*)(FPGA_REG_BASE + 0x05)	/* data dir, FPGA8-14*/
#define SFXR1		(BYTE*)(FPGA_REG_BASE + 0x06)	/* SFX Ch 1 byte */
#define SFXR2		(BYTE*)(FPGA_REG_BASE + 0x07)	/* SFX Ch 2 byte */

#define XSEC		(BYTE*)(FPGA_REG_BASE + 0x07)	/* Security Byte */

//	Offsets from FPGA_IO_BASE
#define AUX_BASE	(FPGA_REG_BASE+0x08)   			/* Base Of Aux Outputs */
#define AUX0		(BYTE*)(AUX_BASE+0x00)			/* AUX0 Output */
#define AUX1		(BYTE*)(AUX_BASE+0x01)			/* AUX1 Output */
#define AUX2		(BYTE*)(AUX_BASE+0x02)			/* AUX2 Output */
#define AUX3		(BYTE*)(AUX_BASE+0x03)			/* AUX3 Output */
#define AUX4		(BYTE*)(AUX_BASE+0x04)			/* AUX4 Output */
#define AUX5		(BYTE*)(AUX_BASE+0x05)			/* AUX5 Output */
#define AUX6		(BYTE*)(AUX_BASE+0x06)			/* AUX6/EXT SCL Output */
#define AUX7		(BYTE*)(AUX_BASE+0x07)			/* AUX7/EXT SDA Output */

#define OUTPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of outputs */
#define INPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of inputs */

// Chip select registers
#define	CSAM0 	0x00FFFFF5
#define	CSBAR0	0x00000009
#define	CSAM1	0x00FFFFF5
#define	CSBAR1	0x01000001
#define	CSAM2	0x000000FD
#define	CSBAR2	0x02000001
#define	CSAM3	0x00FFFFFF
#define	CSBAR3	0x03000001

#endif

/**************************** BEGIN DUTCH_FPGA_VERSION ***************************/
#if (DUTCH_FPGA_VERSION==1)

//#define FPGA_SIG		0xA2				/* value of ident byte for Peter's Test FPGA */
//#define FPGA_SIG		0x4a				/* value of ident byte for Dutch production FPGA */
#define FPGA_SIG		0x7f				/* value of ident byte for Peter's dev FPGA */

													/* read @FPGA_ID */
#define FPGA_REG_BASE	(FPGA_BASE+0x20)			/* FPGA registers base */
#define FPGA_IO_BASE    (FPGA_BASE+0x40)			/* FPGA I/O base */

//	Offsets from FPGA_REG_BASE
#define FPGA_ID		(BYTE*)(FPGA_REG_BASE + 0x01)	/* read FPGA ID byte */
#define XCRA		(BYTE*)(FPGA_REG_BASE + 0x00)	/* FPGA Control Reg A */
#define XMPX		(BYTE*)(FPGA_REG_BASE + 0x01)	/* Multiplex Control Reg */
#define XDRA		(BYTE*)(FPGA_REG_BASE + 0x02)	/* data, pins FPGA0-6 */
#define XDRB		(BYTE*)(FPGA_REG_BASE + 0x03)	/* data, pins FPGA0-6 */
#define XDDRA		(BYTE*)(FPGA_REG_BASE + 0x04)	/* data dir, FPGA0-6 */
#define XDDRB		(BYTE*)(FPGA_REG_BASE + 0x05)	/* data dir, FPGA8-14*/
#define SFXR1		(BYTE*)(FPGA_REG_BASE + 0x06)	/* SFX Ch 1 byte */
#define SFXR2		(BYTE*)(FPGA_REG_BASE + 0x07)	/* SFX Ch 2 byte */

#define XSEC		(BYTE*)(FPGA_REG_BASE + 0x07)	/* Security Byte */


//	Offsets from FPGA_IO_BASE
#define AUX_BASE	(FPGA_REG_BASE+0x08)   			/* Base Of Aux Outputs */
#define AUX0		(BYTE*)(AUX_BASE+0x00)			/* AUX0 Output */
#define AUX1		(BYTE*)(AUX_BASE+0x01)			/* AUX1 Output */
#define AUX2		(BYTE*)(AUX_BASE+0x02)			/* AUX2 Output */
#define AUX3		(BYTE*)(AUX_BASE+0x03)			/* AUX3 Output */
#define AUX4		(BYTE*)(AUX_BASE+0x04)			/* AUX4 Output */
#define AUX5		(BYTE*)(AUX_BASE+0x05)			/* AUX5 Output */
#define AUX6		(BYTE*)(AUX_BASE+0x06)			/* AUX6/EXT SCL Output */
#define AUX7		(BYTE*)(AUX_BASE+0x07)			/* AUX7/EXT SDA Output */

#define OUTPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of outputs */
#define INPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of inputs */

// Chip select registers
#define	CSAM0 	0x00FFFFF5
#define	CSBAR0	0x00000009
#define	CSAM1	0x00FFFFF5
#define	CSBAR1	0x01000001
#define	CSAM2	0x000000FD
#define	CSBAR2	0x02000001
#define	CSAM3	0x00FFFFFF
#define	CSBAR3	0x03000001

#endif
extern BYTE *const FpgaId;
extern BYTE *const Xcra;
extern BYTE *const Xmpx;
extern BYTE *const Xdra;
extern BYTE *const Xdrb;
extern BYTE *const Xddra;
extern BYTE *const Xddrb;
extern BYTE *const Sfxr1;
extern BYTE *const Sfxr2;
extern BYTE *const Xsec;
extern BYTE *const Aux0;
extern BYTE *const Aux1;
extern BYTE *const Aux2;
extern BYTE *const Aux3;
extern BYTE *const Aux4;
extern BYTE *const Aux5;
extern BYTE *const Aux6;
extern BYTE *const Aux7;
extern void *const Outputs;
extern void *const Inputs;
extern const SIM40CFG sim40_cfg;
extern const TIMERCFG Timer1Cfg;
extern const TIMERCFG Timer2Cfg;
extern const DMACFG DMA1Cfg;
extern const DMACFG DMA2Cfg;

#endif
/*
End-----------------------------------------------------------------------------------------------
*/

 

  • Like 2
Link to comment
Share on other sites

On 23/01/2025 at 17:11, slotsmagic said:

Pluto 6 would be impressive, although I guess the manufacturer specific FPGA chips will be the issue? Definitely good to see development on it. I forgot that my old JPM clubber, an Al Murray clubber based on Casino Crazy but with £400 jackpot and multi stake, used it. I assume other late JPM and Crystal club and pub machines would. Along with the usual Betcoms and similar.

I'm assuming Empire used it too once they were absorbed by Astra, so plenty of other lo-techs.

I can't remember though if the likes of Bullion BARs Streakin' used Pluto 6 or if they ran something else? I feel like they might have had a backplane arrangement like the Firefox machines? They used Firefox cabinets for sure.

There were effectively 2 chips on Pluto 6. Pluto 5 was cracked a long time ago so they fixed it :)

  • Like 1
Link to comment
Share on other sites

  • 2 weeks later...
 Share

×
×
  • Create New...