Home Page Forums MAME MAME SNES: ST-0018 emulation research

It appears I was able to dump the ST-0018 program ROM:



... amusingly, through the controller port.

http://byuu.org/temp/st0018-20120225.tar.bz2

The ST-0018 is used by Hayazashi Nidan Morita Shougi 2.
It holds the distinction as the only coprocessor not yet emulated, and the only game not yet playable.
Completing this would give us 100% total compatibility.
And from there, all that is left are strange peripherals like keyboard controllers and horse-race-betting dial-up modems.

Cydrak looked at the file, and found ARM 32-bit instructions. The chip dates to 1994, so this would be pre-THUMB. Possibly ARMv6 or older.

Discussion thread is here:
http://board.byuu.org/viewtopic.php?p=56471#p56471

I'd humbly like to ask for anyone's assistance who is familiar with ARM and would like to help us get this emulated.

Finishing this one last chip will fulfill a 7.5+-year dream of mine; and I'll be eternally grateful to anyone who can assist.

What have you tried? I imagine the MAME core would handle it. I'm assuming you already know how it communicates with the main system in order to have dumped it using this method? It sounds like it would just be a case of hooking up the CPU then connecting the various latches needed (although being a custom chip you can't discount additional timers / custom co-processor and the like)

Get us the ROM, sounds trivial to hook up since MAME speaks ARM up through ARM9

I think the original post contains the link you need...

anyway, byuu, congrats!

Yes, the ROM is here:
http://byuu.org/temp/st0018-20120225.tar.bz2

It is 0xf3.bin.

From the SNES side, the register ports are:
$3800r data port from ST018 to SNES
$3802r data port from SNES to ST018
$3804w command register (results in $3800)
01 = unknown
aa = board upload
b2 = unknown
b3 = player lost test
b4 = player won test
b5 = check test
f1/f2 = test registers (returning $00 seems enough)
f3 = dump ROM
f4 = dump RAM(?)
$3804r status register
d7 = chip ready
d4 = write ready
d0 = read ready
... and that's it. Very small interface.

So for instance, you want to know if player 1 was checked.
You write $aa to $3804. Then you write the board into $3802 (9x9 grid + 16 bytes for promotion information.) Now write $b5 to $3804, wait a bit, read $3800. It will be 1 if checked, 0 if not checked.

I can jump on IRC/AIM if someone wants to try hooking it up to an ARM core in MESS. Right now, I'm not even sure where to begin execution when the chip powers on.

0

:-)

The MAME ARM core works pretty well, from a CPU side the main pitfall is if it has a custom co-processor (like the data east stuff does, IIRC our emulation is still hardcoded to that co-processor)

Congratulation, byuu.

Ok, that's a pretty funny looking dumping rig Nice work as always, though, byuu!

Related trivia: NCL (Nintendo Co Ltd, the Japanese guys) would use an oscilloscope on the controller ports to verify correct timing for games using non-standard controllers (e.g. the multi-tap or gun or mouse).

ETA: pulled it up in IDA Pro, it's definitely valid little-endian ARM, of a fairly old architecture vintage (I'd guess v3 or v4).

This is going to take me a lot longer, since I have to write my first ARM core. Happy that it's pre-THUMB, at least.

So far ...

Really hoping it doesn't have any custom vendor extension opcodes, or extra ROMs in there somewhere, or anything terrifying like that. Guess we'll find out soon enough.

WOW! Congratulations!

LN