mikejmoffitt
Mickey's Coach
- Joined
- Feb 6, 2014
- Posts
- 578
I got a Puyo Puyo Sega C2 board missing a few chips, and found parts from another C2 board (also a Puyo Puyo board) to get it working. I wanted to convert it to Puyo Puyo 2, but I did not have the correct protection chip for it.
Somebody who will remain unnamed claimed to have already cracked the game. I inquired hoping for someone friendly with similar interests but he wanted a bogus 60 Euro (~70 USD) bounty for the patch! Furthermore, the only proof he has is a blurry YouTube video, and as I dug deeper I realized the video is more suspect than I thought.
So, I set about patching the game myself. I merged the two ROMs (IC31 and IC32, odd and even respectively) into a 16-bit image so I may disassemble it, and fired up the game with MAME's debugger.
Here is the routine, partially disassembled to the extent that I was able to work with it:
If you just install the Puyo Puyo 2 ROMs (and set the jumpers) the game will run and seem to be doing very well. However, the Sousai (garbage) system is completely turned off!! This makes the game more or less unplayable. You can technically beat the first level, but only by a fluke. It's pointless.
So, first I thought I'd patch the protection routine to always report that protection passed. With some sleuthing I found memory location $FFA026 is a variable that deactivates the Sousai system. It gets set when protection fails; there are two nearly identical protection check routines (the second one is run right before a game begins, and is at $1881A. I modified move.b #1,$5810(a4) to move.b #0,$5810(a4).
That first idea worked, and garbage was back to working. However, it introduced a new problem: after winning a match (or anyone winning/losing in 2P mode) the game would just sit there. It wasn't frozen, as things animated and bounced, but the game never showed the character portrait, played the sample, or showed the small character sprites before fading out. It seems I'd triggered some anti-tampering measure; I hardly changed anything and doubt the code was broken as a result.
So, back to the drawing board. I tried a number of things, but what I settled for is actually quite simple. I simply nop'd out the routine that disables the garbage as a result of checking $FFA026, which is run every time a Puyo chain is popped. This did not trigger the anti-tampering (or whatever else was wrong) and the game now works.
Now, the original person's YouTube video seems more suspicious now. In his video, he just starts a game and doesn't press any buttons, letting the player get a game over. We never got to see either player complete a chain, so I have no proof that he even fixed the protection-related behavior in the first place! 60 Euro is a real rip anyhow, so I'm happy to present the patched set here, for free as it should be:
http://mikejmoffitt.com/bin/PuyoPuyo2-NoProtection.zip
I just played through the whole game a few times from start to finish, and all looks and sounds great. I'm glad to be able to play the arcade version of the game on my C2 Jamma board now!
Somebody who will remain unnamed claimed to have already cracked the game. I inquired hoping for someone friendly with similar interests but he wanted a bogus 60 Euro (~70 USD) bounty for the patch! Furthermore, the only proof he has is a blurry YouTube video, and as I dug deeper I realized the video is more suspect than I thought.
So, I set about patching the game myself. I merged the two ROMs (IC31 and IC32, odd and even respectively) into a 16-bit image so I may disassemble it, and fired up the game with MAME's debugger.
Here is the routine, partially disassembled to the extent that I was able to work with it:
If you just install the Puyo Puyo 2 ROMs (and set the jumpers) the game will run and seem to be doing very well. However, the Sousai (garbage) system is completely turned off!! This makes the game more or less unplayable. You can technically beat the first level, but only by a fluke. It's pointless.
So, first I thought I'd patch the protection routine to always report that protection passed. With some sleuthing I found memory location $FFA026 is a variable that deactivates the Sousai system. It gets set when protection fails; there are two nearly identical protection check routines (the second one is run right before a game begins, and is at $1881A. I modified move.b #1,$5810(a4) to move.b #0,$5810(a4).
That first idea worked, and garbage was back to working. However, it introduced a new problem: after winning a match (or anyone winning/losing in 2P mode) the game would just sit there. It wasn't frozen, as things animated and bounced, but the game never showed the character portrait, played the sample, or showed the small character sprites before fading out. It seems I'd triggered some anti-tampering measure; I hardly changed anything and doubt the code was broken as a result.
So, back to the drawing board. I tried a number of things, but what I settled for is actually quite simple. I simply nop'd out the routine that disables the garbage as a result of checking $FFA026, which is run every time a Puyo chain is popped. This did not trigger the anti-tampering (or whatever else was wrong) and the game now works.
Now, the original person's YouTube video seems more suspicious now. In his video, he just starts a game and doesn't press any buttons, letting the player get a game over. We never got to see either player complete a chain, so I have no proof that he even fixed the protection-related behavior in the first place! 60 Euro is a real rip anyhow, so I'm happy to present the patched set here, for free as it should be:
http://mikejmoffitt.com/bin/PuyoPuyo2-NoProtection.zip
I just played through the whole game a few times from start to finish, and all looks and sounds great. I'm glad to be able to play the arcade version of the game on my C2 Jamma board now!
