Home Page Forums Other Emulator Message Boards Modeler and M1 Trying to replace a sound sample in Golden Axe

If one of the unencrypted bootlegs was used, it should be possible though?

Possible, but still complicated.

I have already made many changes (to the main set), I had no encryption problems. Previously I attempted to translate Space Harrier and it's impossible to change the text without breaking the game.

Here are some screenshots, by the way; the third is the sound submenu in the service menu.










Except from the sound, I only have to center a certain text (see the last image), and find the new checksum for the checksum check in the service menu (where it checks the memory chips really).

Edit: I have edited the font, the text, background/foreground graphics, a sprite (the "GO!" sign), some palettes, and graphics tilemaps, of course. I also added some new assembly code in the translation (it has to do with some strings in the service menu). After seeing that problem with Space Harrier, which is an intentional type of protection by Sega, I first checked Golden Axe thoroughly, before starting the translation. I can't be 100% sure that all other System 16 games can be translated/hacked easily.

Some very nice work there Good job!

Just some more details about the rom format while I am looking:

At certain points in the rom, the 0x93 byte is used to tell the chip to play the next X number of bytes, and the byte following that tells the chip how many nibbles to play. At rom location 0xEE7 byte 0x93 is followed by 0x81 (129 in decimal) and +1 is added to this value to equal 130. This tells the chip to play the next 130 nibbles (65 bytes). The next time 0x93 is used again is 65 bytes later, so this means that this might be correct.

There is also another command used to play X number of nibbles but repeat them Y times. This is a 3 byte long command. I haven't checked if it's used in the rom yet.

In the game, the Z80 memory location 0xE800 is the sound latch byte (I think). 0x9C is the coin-up sound, 0x90 and 0x93 are used for the axe swinging sounds, 0x54 is the sound sample for the first enemy when they are killed, 0x53 is the sound sample for the second enemy when they are killed, etc. If these values are converted to decimal they will play the correct sound in M1, for example ./m1 goldnaxe 156 will play the coin-up sound.

On the main CPU, memory location 0x00FFECFC appears to be where the same byte is also written to. In the MAME debugger I did this

wp 00FFECFC,1,w,wpdata,{ printf "Value is %08X\n",wpdata ; g }

and I get the correct values when the sounds are played.

Thank you! :-)

That's so great!
If there's no solution with the NEC ADPCM encoding, I may add the sound as a different ADPCM variation (with noise). At least these bytes will be correct!
Did you see that in the assembly code, or did you see the bytes in the sound file?

Oh yes!!!
At FFECFC, FF00 stops the sound and 00xx starts the sound with id xx (including songs). When you start a sound, FF00 is first written, in case another sound was still playing, and then 00xx is written. When the sound ends, FF00 is written again. As there were 4 sets of similar values near that memory area, I checked the other possible addresses (FFACFC, FF6CFC, FF2CFC) but they are irrelevant (which is logical, but I had to make sure).

FF00 stops the sound and is also at the beginning of the Golden Axe sounds, but not at the other sounds I downloaded. I don't think that's a coincidence :-)
Maybe that specific FF 00 is written at FFECFC. That means that in the sounds, FF 00 is not really indicating the beginning of the file, but the bytes at the beginning of the file are commands (not a header), up to byte 53, that means that the following 128 bytes are data. Similarly, after the last 93 and the following data bytes, the next bytes should also be commands. 00 FF is the end of the sound data, but maybe it continues reading the next bytes, that are commands. Maybe FF doesn't do anything, but then you (usually) have FF 00 5A A5. So you have FF 00 again, which really makes the program stop the sound, and that's the next FF 00 that is written at FFECFC. 5A A5 must also be a command (or two commands). I don't think it's the end of the file as it's not always present.

When I have time, I will try to insert code that plays a sound when the GreekRoms logo shows up whole (it's where the FBI message was). Of course I can't really use it until I can add new sounds.

The 0xFF00 value may be a coincidence, because the main CPU does not talk to the ADPCM chip directly but sends commands to the Z80. Because the Z80 is 8-bit, I think it will only see the lower byte so it might just see 0x00 then 0x9C instead of 0xFF00 then 0x009C. If the sound chips receive a play command when they are already playing, I think they will just restart playback - the Z80 might not need to tell the sound chip to stop playing first. Maybe the 0x00 is needed to tell the Z80 chip to reset a routine, or maybe it is only used by the main CPU and the Z80 doesn't care about it.

As you have said, in the ADPCM sound data the chip knows how many bytes to play, so anything after that is processed as commands. This is how it knows not to stop playing if it sees 0x00 in the middle of the 128 bytes of data, so it doesn't try to process it as a command and stop the playback. For the welcome sample, all of the bytes up to the first 0x53 trigger commands. The first 0xFF is significant, but the other bytes do not appear to do anything even though they trigger a command on the chip. I still have no idea what the 5A A5 sequence does because the ADPCM chip never reads that data (not in M1 anyway) and no other data is read after 0x00.

So, I need to write a Lua script to try and manually trigger a sound to be played. I will also use the MAME debugger to see what data is written to the soundlatch.

Hey Dodg, of course you were right about location FFECFC, thank you for it!
I am now writing a value there, and a sound is heard.

There's a loop that shows or hides the screen, e.g. when the program starts.
I want to play a sound when the GreekRoms logo (the FBI logo in the original) is shown. D6 becomes zero then, but that also happens when the logo is hidden again, or in all other cases the screen does the same effect. The first time the game loads and the logo is fully shown, A6 is zero.
E.g. for the coin-up sound (156 - 9C):

In address 1A5C (which is inside the loop), I replace these three commands D444D0C5361F with 4EF900002E0C (a JMP to 2E0C, but Ι may change this address).
There is plenty of empty space there, so I add these:

D444D0C5361F (the commands I had replaced)
4A86 (check if D6 is 0)
6610 (if not, go to last command)
BC8E (check if A6 equals D6, which is 0)
660C (if not, go to last command)
2C7C00FFECFC (write FFECFC to A6)
1CBC009C (write the sound id, 9C, to A6 address)
4286 (restore A6 to zero)
4EF900001A62 (JMP back to where you were)

This works, but it doesn't do all I want. I didn't check properly, A6 is zero only the first time. I want the sound to be heard whenever the logo is shown by itself (and not when it's shown if you insert a coin).
I will also have to add one more check, because there is an on/off DIP switch setting for demo sounds.

If I put 00 instead of 9C there, no sound is heard and there are no side effects, it works. So, after I complete the code, I will just add it, with 00.
If I find a way to add new sounds, then I'll just update that one value :-)
I might then add two different sounds, one for the very first time, and another one for all the other times ;-)

How are you able to edit the 68000 code? It looks like the two ROMs are interleaved, but I thought that they are encrypted also?

I tried to write a Lua script to POKE a value into the soundlatch but it didn't work. I can read from the memory location, but I can't write to it. I had this problem with a different game but I can't remember how I solved the problem. Also, I tried to set a watchpoint for the soundlatch in the MAME debugger but it is never triggered so I can't see exactly what data is being written there. The watchpoint works fine for the main CPU, but not on the sound CPU.

Maybe it is a coincidence, but I noticed that the "Welcome" sample sounds like a slowed down version of the "Welcome" speech in Gauntlet II. I wonder if SEGA used the same hardware to generate the speech but then saved it as a sample instead.

I have written a tool for that, it's called Tile Mixer and it's here: https://www.romhacking.net/utilities/1707 or here: https://www.greekroms.net/files/programs/Tile%20mixer%20setup.zip.

You select two or more files that are interleaved and you can join them, or separate that file. You can change their order, if you want. You can also make it create a zip file (for MAME) with the new, joined file, or run a cmd command, like "C:\Romhacking\MAME\mame goldnaxe -autoframeskip -video gdi". You can also save all these selections and have it load them automatically. So, you just open that program and you press one button to join the ROMs and one more to run the game in MAME. You can even join two or three buttons together, so you only have to click on one instead of two :-)
Romhacking is too tedious sometimes, I had to make it as easier to use as possible, because during the two or three months that are needed to finish a hack or a translation, you do these tasks thousands of times!
And just for fun, after I wrote Tile Mixer in Greek and English, I translated it into 55 more languages (I used Google Translate, DeepL, and Microsoft Translator) :-o

No, luckily :-)

I wouldn't be surprised at all!
Enjoy: