MAME Changes that relate to FME

slotsmagic · January 23

3 hours ago, thealteredemu said:

Wow, would love to see Pluto6 just a certain few Astra lo-techs.

Great stuff

J

Pluto 6 would be impressive, although I guess the manufacturer specific FPGA chips will be the issue? Definitely good to see development on it. I forgot that my old JPM clubber, an Al Murray clubber based on Casino Crazy but with £400 jackpot and multi stake, used it. I assume other late JPM and Crystal club and pub machines would. Along with the usual Betcoms and similar.

I'm assuming Empire used it too once they were absorbed by Astra, so plenty of other lo-techs.

I can't remember though if the likes of Bullion BARs Streakin' used Pluto 6 or if they ran something else? I feel like they might have had a backplane arrangement like the Firefox machines? They used Firefox cabinets for sure.

Edited January 23 by slotsmagic

dondplayer · January 24

15 hours ago, slotsmagic said:

Pluto 6 would be impressive, although I guess the manufacturer specific FPGA chips will be the issue? Definitely good to see development on it. I forgot that my old JPM clubber, an Al Murray clubber based on Casino Crazy but with £400 jackpot and multi stake, used it. I assume other late JPM and Crystal club and pub machines would. Along with the usual Betcoms and similar.

Betcoms are scorp. I think most (if not all) Betcoms that have a scorp6 version will also have a scorp5 version but we have problems with a couple of those so maybe scorp6 will be a solution.

slotsmagic · January 24

3 hours ago, dondplayer said:

Betcoms are scorp. I think most (if not all) Betcoms that have a scorp6 version will also have a scorp5 version but we have problems with a couple of those so maybe scorp6 will be a solution.

Ah, I might have been confusing Betcom with someone else. I have a habit of lumping all the modern crap machines into the same category lol.

There's definitely been plenty of pub AWPs on Pluto 6 the last 10/15 years I'm sure, but many of them may have had Scorp 5 versions or similar?

(Edit - see attached for a Betcom Pluto 6 board with Paddy's PD (PayDay?) CF card)

Edited January 24 by slotsmagic

dondplayer · January 24

Ah right I knew they had covered many bases by utilising Scorp5 and Scorp6 but not Pluto. I wonder if every game had multiple versions.

fruitsnappa · January 24

General rule of thumb would be a Betcom cabinet with the larger plastic nose pod and top would be Pluto, and narrower would be Scorpion 5/6.

1867901082_Screenshot2025-01-24153548.png.2f9de8a94788240253d088ca1e7e46b7.png 1509706069_Screenshot2025-01-24153527.png.405fda4b0065205a174e37aaae2d37e4.png

Altharic · January 24

Be interesting to see how well it runs if they do get it running would expect it would need a beefy PC to run it all.

johnparker007 · January 24

I wonder if they may have more security outside of the Pluto 6 'core' emulation; from the Heber website:

Sophisticated Security

Safety against game piracy is imperative. Pluto 6 uses two-stage customer-specific security giving superior protection to your gaming application. A security chip and security software ensures that once your application is developed it is well and truly safeguarded.

Hopefully not of course (this may even be a recent development, and not be present on the older fruit machine hardware already deployed), and if the dev has a running game, then they may have already bypassed it... but might be a roadblock depending on how it's implemented etc.

Edited January 24 by johnparker007

Altharic · January 24

Wonder if that chip next to the CF card is it ?

thealteredemu · January 25

That is the security chip next to the CF card. I had a Pluto6 machine for a while that’s definitely it bud.

J

thealteredemu · January 25

3 hours ago, johnparker007 said:

I wonder if they may have more security outside of the Pluto 6 'core' emulation; from the Heber website:

Sophisticated Security

Safety against game piracy is imperative. Pluto 6 uses two-stage customer-specific security giving superior protection to your gaming application. A security chip and security software ensures that once your application is developed it is well and truly safeguarded.

Hopefully not of course (this may even be a recent development, and not be present on the older fruit machine hardware already deployed), and if the dev has a running game, then they may have already bypassed it... but might be a roadblock depending on how it's implemented etc.

It sounds like some manufacturers never utilised it (reflex) so it might be possible to bypass it, well time will tell of course.

J

Altharic · January 25

Wonder if that chip is dump able?

thealteredemu · January 25

A quick read on google, looks like they are able to be dumped. I imagine the data is scrambled with the receiving end deciphering it? I don't really know a lot about this kind of stuff. I'm sure it won't just be as simple as dumping the data as it would seem a bit pointless if it is security.

J

andrew96 · January 25

I am pretty sure these security chips cannot be read by normal means, they will have there security fuses blown, BUT as with all chips they can be done by company's using nitric acid and high powered microscopes! but that of course can cost £1000 for just one chip, and more if its a complex fpga, so if there is more than just one chip used for different machines (like mpu4 charactisers) it really makes it very uneconomical to do

Altharic · January 25

probably why mfme was never back ported back to mame I remember a convo I had years ago on how they got past these chips and how the debugger was used to bypass the chrs, basically the machine would ask for (example) the number 2 rather than emulate the chip and pass 2 to the machine they would feed it the number 2

andrew96 · January 25

41 minutes ago, Altharic said:

probably why mfme was never back ported back to mame I remember a convo I had years ago on how they got past these chips and how the debugger was used to bypass the chrs, basically the machine would ask for (example) the number 2 rather than emulate the chip and pass 2 to the machine they would feed it the number 2

yes so if you know what the machine is asking for you can program a chip to give those answers to the mpu, its how i did mpu5 security chips in real machines, but took me 6 months and more to do it

Edited January 25 by andrew96

Altharic · January 25

and sadly why Pluto might be stumbled they like straight emulation and no workarounds unless its something they like and are interested in saw a full PR get binned the other day no help just criticism so the guy just went fuck this and walked understandable IMO

https://github.com/mamedev/mame/pull/13264

Edited January 25 by Altharic

dec1962 · January 26

20 hours ago, Altharic said:

and sadly why Pluto might be stumbled they like straight emulation and no workarounds unless its something they like and are interested in saw a full PR get binned the other day no help just criticism so the guy just went fuck this and walked understandable IMO

https://github.com/mamedev/mame/pull/13264

Wow, a lot of work there for it just to get cancelled

Sadly there are quite a few folk who won't even consider contributing to MAME because of the difficulty of getting stuff approved.

Altharic · February 2

Not strictly fme but could be now gas a recompiler that means a big speed increase for demanding systems I can see them adding more if this lot works

1.21 Updated to MAME 0.274 which adds a 64-bit ARMv8 recompiler (DRC). This means a huge performance boost on very demanding systems like K.Instinct or CPS-3. Support 16 KB page sizes so that new Android devices will work.

edwardb · March 10

On 25/01/2025 at 19:02, Altharic said:

and sadly why Pluto might be stumbled they like straight emulation and no workarounds unless its something they like and are interested in saw a full PR get binned the other day no help just criticism so the guy just went fuck this and walked understandable IMO

https://github.com/mamedev/mame/pull/13264

So for Heber's Pluto 5 board you can absolutely brute-force the security on it. There was a handful of bytes which changed depending on the customer; so were someone to try and reverse engineer one of my games (which I'd happily supply the security byte data for) you can prove the ROMs boot up. Then for other games it'd just be a case of amending those bytes and trying again, and repeat until the thing boots....

Pluto 6 was a bit more involved but still should be fairly straightforward to crack.

johnparker007 · March 10

1 hour ago, edwardb said:

So for Heber's Pluto 5 board you can absolutely brute-force the security on it. There was a handful of bytes which changed depending on the customer; so were someone to try and reverse engineer one of my games (which I'd happily supply the security byte data for) you can prove the ROMs boot up. Then for other games it'd just be a case of amending those bytes and trying again, and repeat until the thing boots....

Pluto 6 was a bit more involved but still should be fairly straightforward to crack.

If there is a magic string of bytes per game, that could included in the MAME driver per game definition, that would be acceptable to the core MAME devs. We already do it with the characteriser lamp column values for MPU4 (to 'unscramble' the lamps).

edwardb · March 10

2 hours ago, johnparker007 said:

If there is a magic string of bytes per game, that could included in the MAME driver per game definition, that would be acceptable to the core MAME devs. We already do it with the characteriser lamp column values for MPU4 (to 'unscramble' the lamps).

OK. On Pluto 5 there were 3x 4-byte values which would be set in the ROM before compilation. There was some IO mapping stuff going on in the FPGA. I could probably get this stuff compiling again, change the FPGA code over then look at the ROMs and work out what goes where....

/*
APOLLO GAMING LTD - SOFTWARE R&D					COPYRIGHT 2008 (c) APOLLO GAMING LIMITED
Filename:	FPGA.h
Author:		EB
Revision History:
	- 19/05/2008	Created			v1.0			
----------------------------------------------------------------------------------------------
Contains data for specific FPGA versions
1. Development
2. Apollo SECURE FPGA 1
3. That Dutch Company Who Was A Pain In The Arse
*/		 
#ifndef __FPGA_H
#define __FPGA_H

/**************************** BEGIN DEV FPGA VERSION HERE ***************************/
#if (DEV_FPGA_VERSION==1)

#define FPGA_SIG		0x01						/* value of ident byte */
													/* read @FPGA_ID */
#define FPGA_REG_BASE	(FPGA_BASE+0x00)			/* FPGA registers base */
#define FPGA_IO_BASE    (FPGA_BASE+0x20)			/* FPGA I/O base */

//	Offsets from FPGA_REG_BASE
#define FPGA_ID		(BYTE*)(FPGA_REG_BASE + 0x01)	/* read FPGA ID byte */
#define XCRA		(BYTE*)(FPGA_REG_BASE + 0x00)	/* FPGA Control Reg A */
#define XMPX		(BYTE*)(FPGA_REG_BASE + 0x01)	/* Multiplex Control Reg */
#define XDRA		(BYTE*)(FPGA_REG_BASE + 0x02)	/* data, pins FPGA0-6 */
#define XDRB		(BYTE*)(FPGA_REG_BASE + 0x03)	/* data, pins FPGA0-6 */
#define XDDRA		(BYTE*)(FPGA_REG_BASE + 0x04)	/* data dir, FPGA0-6 */
#define XDDRB		(BYTE*)(FPGA_REG_BASE + 0x05)	/* data dir, FPGA8-14*/
#define SFXR1		(BYTE*)(FPGA_REG_BASE + 0x06)	/* SFX Ch 1 byte */
#define SFXR2		(BYTE*)(FPGA_REG_BASE + 0x07)	/* SFX Ch 2 byte */

#define XSEC		(BYTE*)(FPGA_REG_BASE + 0x07)	/* Security Byte */

//	Offsets from FPGA_IO_BASE
#define AUX_BASE	(FPGA_IO_BASE+0x10)   			/* Base Of Aux Outputs */
#define AUX0		(BYTE*)(AUX_BASE+0x00)			/* AUX0 Output */
#define AUX1		(BYTE*)(AUX_BASE+0x01)			/* AUX1 Output */
#define AUX2		(BYTE*)(AUX_BASE+0x02)			/* AUX2 Output */
#define AUX3		(BYTE*)(AUX_BASE+0x03)			/* AUX3 Output */
#define AUX4		(BYTE*)(AUX_BASE+0x04)			/* AUX4 Output */
#define AUX5		(BYTE*)(AUX_BASE+0x05)			/* AUX5 Output */
#define AUX6		(BYTE*)(AUX_BASE+0x06)			/* AUX6/EXT SCL Output */
#define AUX7		(BYTE*)(AUX_BASE+0x07)			/* AUX7/EXT SDA Output */

#define OUTPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of outputs */

#define INPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of inputs */

#define INPUTS2		(*(volatile char*)FPGA_IO_BASE)			/* base of inputs */

#define	CSAM0 	0x00FFFFF5
#define	CSBAR0	0x00000009

#define	CSAM1	0x00FFFFF5
#define	CSBAR1	0x01000001

#define	CSAM2	0x00FFFFFF
#define	CSBAR2	0x02000003

#define	CSAM3	0x00FFFFFF
#define	CSBAR3	0x03000001

#endif

/**************************** BEGIN APOLLO_FPGA_VERSION ***************************/
#if (APOLLO_FPGA_VERSION==1)

#define FPGA_SIG		0xca				/* value of ident byte */
													/* read @FPGA_ID */
#define FPGA_REG_BASE	(FPGA_BASE+0x50)			/* FPGA registers base */
#define FPGA_IO_BASE    (FPGA_BASE+0x00)			/* FPGA I/O base */

//	Offsets from FPGA_REG_BASE
#define FPGA_ID		(BYTE*)(FPGA_REG_BASE + 0x01)	/* read FPGA ID byte */
#define XCRA		(BYTE*)(FPGA_REG_BASE + 0x00)	/* FPGA Control Reg A */
#define XMPX		(BYTE*)(FPGA_REG_BASE + 0x01)	/* Multiplex Control Reg */
#define XDRA		(BYTE*)(FPGA_REG_BASE + 0x02)	/* data, pins FPGA0-6 */
#define XDRB		(BYTE*)(FPGA_REG_BASE + 0x03)	/* data, pins FPGA0-6 */
#define XDDRA		(BYTE*)(FPGA_REG_BASE + 0x04)	/* data dir, FPGA0-6 */
#define XDDRB		(BYTE*)(FPGA_REG_BASE + 0x05)	/* data dir, FPGA8-14*/
#define SFXR1		(BYTE*)(FPGA_REG_BASE + 0x06)	/* SFX Ch 1 byte */
#define SFXR2		(BYTE*)(FPGA_REG_BASE + 0x07)	/* SFX Ch 2 byte */

#define XSEC		(BYTE*)(FPGA_REG_BASE + 0x07)	/* Security Byte */

//	Offsets from FPGA_IO_BASE
#define AUX_BASE	(FPGA_REG_BASE+0x08)   			/* Base Of Aux Outputs */
#define AUX0		(BYTE*)(AUX_BASE+0x00)			/* AUX0 Output */
#define AUX1		(BYTE*)(AUX_BASE+0x01)			/* AUX1 Output */
#define AUX2		(BYTE*)(AUX_BASE+0x02)			/* AUX2 Output */
#define AUX3		(BYTE*)(AUX_BASE+0x03)			/* AUX3 Output */
#define AUX4		(BYTE*)(AUX_BASE+0x04)			/* AUX4 Output */
#define AUX5		(BYTE*)(AUX_BASE+0x05)			/* AUX5 Output */
#define AUX6		(BYTE*)(AUX_BASE+0x06)			/* AUX6/EXT SCL Output */
#define AUX7		(BYTE*)(AUX_BASE+0x07)			/* AUX7/EXT SDA Output */

#define OUTPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of outputs */
#define INPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of inputs */

// Chip select registers
#define	CSAM0 	0x00FFFFF5
#define	CSBAR0	0x00000009
#define	CSAM1	0x00FFFFF5
#define	CSBAR1	0x01000001
#define	CSAM2	0x000000FD
#define	CSBAR2	0x02000001
#define	CSAM3	0x00FFFFFF
#define	CSBAR3	0x03000001

#endif

/**************************** BEGIN DUTCH_FPGA_VERSION ***************************/
#if (DUTCH_FPGA_VERSION==1)

//#define FPGA_SIG		0xA2				/* value of ident byte for Peter's Test FPGA */
//#define FPGA_SIG		0x4a				/* value of ident byte for Dutch production FPGA */
#define FPGA_SIG		0x7f				/* value of ident byte for Peter's dev FPGA */

													/* read @FPGA_ID */
#define FPGA_REG_BASE	(FPGA_BASE+0x20)			/* FPGA registers base */
#define FPGA_IO_BASE    (FPGA_BASE+0x40)			/* FPGA I/O base */

//	Offsets from FPGA_REG_BASE
#define FPGA_ID		(BYTE*)(FPGA_REG_BASE + 0x01)	/* read FPGA ID byte */
#define XCRA		(BYTE*)(FPGA_REG_BASE + 0x00)	/* FPGA Control Reg A */
#define XMPX		(BYTE*)(FPGA_REG_BASE + 0x01)	/* Multiplex Control Reg */
#define XDRA		(BYTE*)(FPGA_REG_BASE + 0x02)	/* data, pins FPGA0-6 */
#define XDRB		(BYTE*)(FPGA_REG_BASE + 0x03)	/* data, pins FPGA0-6 */
#define XDDRA		(BYTE*)(FPGA_REG_BASE + 0x04)	/* data dir, FPGA0-6 */
#define XDDRB		(BYTE*)(FPGA_REG_BASE + 0x05)	/* data dir, FPGA8-14*/
#define SFXR1		(BYTE*)(FPGA_REG_BASE + 0x06)	/* SFX Ch 1 byte */
#define SFXR2		(BYTE*)(FPGA_REG_BASE + 0x07)	/* SFX Ch 2 byte */

#define XSEC		(BYTE*)(FPGA_REG_BASE + 0x07)	/* Security Byte */


//	Offsets from FPGA_IO_BASE
#define AUX_BASE	(FPGA_REG_BASE+0x08)   			/* Base Of Aux Outputs */
#define AUX0		(BYTE*)(AUX_BASE+0x00)			/* AUX0 Output */
#define AUX1		(BYTE*)(AUX_BASE+0x01)			/* AUX1 Output */
#define AUX2		(BYTE*)(AUX_BASE+0x02)			/* AUX2 Output */
#define AUX3		(BYTE*)(AUX_BASE+0x03)			/* AUX3 Output */
#define AUX4		(BYTE*)(AUX_BASE+0x04)			/* AUX4 Output */
#define AUX5		(BYTE*)(AUX_BASE+0x05)			/* AUX5 Output */
#define AUX6		(BYTE*)(AUX_BASE+0x06)			/* AUX6/EXT SCL Output */
#define AUX7		(BYTE*)(AUX_BASE+0x07)			/* AUX7/EXT SDA Output */

#define OUTPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of outputs */
#define INPUTS		(BYTE*)(FPGA_IO_BASE)			/* base of inputs */

// Chip select registers
#define	CSAM0 	0x00FFFFF5
#define	CSBAR0	0x00000009
#define	CSAM1	0x00FFFFF5
#define	CSBAR1	0x01000001
#define	CSAM2	0x000000FD
#define	CSBAR2	0x02000001
#define	CSAM3	0x00FFFFFF
#define	CSBAR3	0x03000001

#endif
extern BYTE *const FpgaId;
extern BYTE *const Xcra;
extern BYTE *const Xmpx;
extern BYTE *const Xdra;
extern BYTE *const Xdrb;
extern BYTE *const Xddra;
extern BYTE *const Xddrb;
extern BYTE *const Sfxr1;
extern BYTE *const Sfxr2;
extern BYTE *const Xsec;
extern BYTE *const Aux0;
extern BYTE *const Aux1;
extern BYTE *const Aux2;
extern BYTE *const Aux3;
extern BYTE *const Aux4;
extern BYTE *const Aux5;
extern BYTE *const Aux6;
extern BYTE *const Aux7;
extern void *const Outputs;
extern void *const Inputs;
extern const SIM40CFG sim40_cfg;
extern const TIMERCFG Timer1Cfg;
extern const TIMERCFG Timer2Cfg;
extern const DMACFG DMA1Cfg;
extern const DMACFG DMA2Cfg;

#endif
/*
End-----------------------------------------------------------------------------------------------
*/

edwardb · March 10

On 23/01/2025 at 17:11, slotsmagic said:

Pluto 6 would be impressive, although I guess the manufacturer specific FPGA chips will be the issue? Definitely good to see development on it. I forgot that my old JPM clubber, an Al Murray clubber based on Casino Crazy but with £400 jackpot and multi stake, used it. I assume other late JPM and Crystal club and pub machines would. Along with the usual Betcoms and similar.

I'm assuming Empire used it too once they were absorbed by Astra, so plenty of other lo-techs.

I can't remember though if the likes of Bullion BARs Streakin' used Pluto 6 or if they ran something else? I feel like they might have had a backplane arrangement like the Firefox machines? They used Firefox cabinets for sure.

There were effectively 2 chips on Pluto 6. Pluto 5 was cracked a long time ago so they fixed it

pbb · March 10

"That Dutch company that was a pain in the arse"

Altharic · March 11

And the sad thing is the PR has sat there and no one has looked at it

dec1962 · March 19

Brain Box 2 (BFM Cobra1) added

https://github.com/mamedev/mame/pull/13498

MAME Changes that relate to FME

Recommended Posts

Link to comment

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Popular Posts

johnparker007

johnparker007

SomeRandomGuy

Posted Images

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites