Action Replay rom Patch

[esel]

hi,

Since my amiga 500 has kick 3.1 i want to patch my action replay rom.

i saw it possible to use ar 3 in os 2+ in winuae so i am asking if it possible to patch the real ar roms ?

i can read and write the original roms with my eprom burner but bevor i desolder the roms i want to know if its possible to patch the roms to os 2+ and burn them back.

if this is the wrong forum to post am sorry

please to move it to the right one..

thx

[demolition]

~20 years ago when I had an A500+ (ks 2.04) I used it together with an AR. It was a little unstable from time to time, but generally worked most of the time. Is this what you want to patch or can you not get it to work at all?

[Toni Wilen]

I have gotten conflicting reports about 2.0+ support, some says it works, some says it does not work.

I finally checked the ROM code more carefully:

Action Replay 3 ROM v3.17 appears to be have KS 2.x+ support but v3.09 does not. (3.17 has two checks for reset exception ROM addresses, one for 256k rom and another for 512k rom, 3.09 only have one)

Updating physical ROMs to v3.17 should fix the problem. EDIT: Actually it may not, second ROM address requires different way to trigger the "AR reset exception" and it may require updated PAL chips. I can't confirm it.

[StingRay]

My version of the AR3 worked more or less "OK" with a 2.04 ROM. "OK" because after rebooting the machine the cartridge was entered which was somewhat annoying. But after the "x" command everything worked fine.

[Toni Wilen]

I was wrong, it can't work with KS3.x.

Extra ROM address check in v3.17 only works with 2.04 (37.175). Newer ROM = I can't see how it can work.

Not sure what AR developers were thinking of, hardware triggers NMI after reset when first access to low memory is done by the ROM. ROM code checks if PC equals hardcoded value (or two if 3.17). If match = initialize internal ROM, show boot image etc.. if no match = do something else and crash..

PC range check would have worked with all ROMs..

v3.09:

004002C6 0839 0000 0040 0001      BTST.B #$0000,$00400001
004002CE 6700 0018                BEQ.W #$0018 == $004002E8
004002D2 0caf 00fc 0144 0002      CMP.L #$00fc0144,(A7, $0002)
004002DA 6700 76ce                BEQ.W #$76ce == $004079AA

v3.17

004002C6 0839 0000 0040 0001      BTST.B #$0000,$00400001
004002CE 6700 0024                BEQ.W #$0024 == $004002F4
004002D2 0caf 00fc 0144 0002      CMP.L #$00fc0144,(A7, $0002)
004002DA 6700 7990                BEQ.W #$7990 == $00407C6C
004002DE 0caf 00f8 0160 0002      CMP.L #$00f80160,(A7, $0002)
004002E6 6700 7984                BEQ.W #$7984 == $00407C6C

fc0144 = KS 1.3 address, f80160 = matching KS 2.04 address.

Technically it should work with 3.1 if above address is changed to KS 3.1 address.

(VER command can be used to check version)

[esel]

Originally Posted by Toni Wilen

I was wrong, it can't work with KS3.x.

Extra ROM address check in v3.17 only works with 2.04 (37.175). Newer ROM = I can't see how it can work.

Not sure what AR developers were thinking of, hardware triggers NMI after reset when first access to low memory is done by the ROM. ROM code checks if PC equals hardcoded value (or two if 3.17). If match = initialize internal ROM, show boot image etc.. if no match = do something else and crash..

PC range check would have worked with all ROMs..

v3.09:

004002C6 0839 0000 0040 0001      BTST.B #$0000,$00400001
004002CE 6700 0018                BEQ.W #$0018 == $004002E8
004002D2 0caf 00fc 0144 0002      CMP.L #$00fc0144,(A7, $0002)
004002DA 6700 76ce                BEQ.W #$76ce == $004079AA

v3.17

004002C6 0839 0000 0040 0001      BTST.B #$0000,$00400001
004002CE 6700 0024                BEQ.W #$0024 == $004002F4
004002D2 0caf 00fc 0144 0002      CMP.L #$00fc0144,(A7, $0002)
004002DA 6700 7990                BEQ.W #$7990 == $00407C6C
004002DE 0caf 00f8 0160 0002      CMP.L #$00f80160,(A7, $0002)
004002E6 6700 7984                BEQ.W #$7984 == $00407C6C

fc0144 = KS 1.3 address, f80160 = matching KS 2.04 address.

Technically it should work with 3.1 if above address is changed to KS 3.1 address.

(VER command can be used to check version)

hmm.. ok so the only solution for me is using rom v3.17 and kick 2.04.
but as i have a ver 3.09 ar it may be possible that i have to update my gals on the ar3 board.

or is it possible to include the PC range check so it can work with any kickstart ?
i hoped thats its not a big deal to patch it to use any kickstart

are there any other changes in v3.17 exept the kick 2.04 patch ?

[Toni Wilen]

No GAL updating needed, it was wrong assumption by me. Both 1.3 and 2.04 methods are exact same (I got confused because I thought it was also 3.1 compatible)

Following modification (v3.17) may work with 3.1: ROM offset 2D4 = 00f801ba (original value = 00fc0144)

I think you should have erasable ROM chips + sockets before testing

[Retro1234]

It has worked under 3.x but it was buggy I had to increase ram 512k reset 1mb reset etc
I check it out at some point thanks

[Toni Wilen]

Ok, this is getting even more interesting.. Working with 3.x means above test and branch does not need to be executed for AR to work.

Could everyone with AR 2/3 and 2.0+ ROM report following:
- Full AR version (VER command)
- Any strange behavior?
- Does boot image appear normally after power up and after each reset?

[clenched]

version ACTION REPLAY AMIGA MK III (V3.17 12/17/91)
A500 rev 5 KS 2.04 37.175

power on - cycle gray screens, NO AR3 splash screen, purple kickstart screen.
EDIT:
reset - one gray screen, YES AR3 splash screen, cycle remaining lighter gray screens, purple kickstart screen.
END OF EDIT:
Nothing unusual, it has always been this way no matter trap door RAM, sidecar RAM connected and formerly rev 6A Amiga.

EDIT: remove comparison to WinUAE.

[esel]

i just bought 2 of these:http://cgi.ebay.de/ws/eBayISAPI.dll?...m=190625692197

as soon as they are here i will remove my original roms

cu

[Toni Wilen]

Can anyone test what happens when using v3.17 AR3 with >2.04 KS ROM?

There must be something unemulated in AR3 GALs (conditions for automatic freeze triggering) because current emulation can't work >2.04 ROM without rom patch.

[esel]

Originally Posted by Toni Wilen

Can anyone test what happens when using v3.17 AR3 with >2.04 KS ROM?

There must be something unemulated in AR3 GALs (conditions for automatic freeze triggering) because current emulation can't work >2.04 ROM without
rom patch.

my amiga ( a500+ with 2 MB chipram ) is going totally crazy with 3.17 and os 3.1.

i made a little video of the statup:
[ Show youtube player ]

and here the power led:
[ Show youtube player ]

hope this helps

[Toni Wilen]

Do you have 2.04 ROM too? Does it work? (Not so sure if A500+ newer Agnus causes some side-effects)

>2.04 ROMs not working makes sense but I'd like to get 100% confirmation by using regular A500 with 3.0+ ROMs.

[esel]

I just tried it with my 2.04 Rom and it works ! I get a message about a Resident programm as you can see in the picture.

[Toni Wilen]

Some notes and guesses:

AR 3 seems to detect between CPU reset (reset-instruction, short pulse) and keyboard reset (long pulse). I managed to duplicate AR3 real hardware behavior (power on = no title screen) if only keyboard reset triggers internal AR init condition.

AR 2 does not seem to have this kind of reset detection.

My guess is that AR2 hangs or crashes if CPU reset instruction is executed. AR3 has extra protection (with side-effect of not showing title screen at power up)

Following tests needed:

- Does AR3 work with Double Dragon II (original, OCS-only 3.84 version). It has protection code that uses RESET instruction. (Code runs before title screen)

- Does AR2 show boot screen at power up? or only after keyboard reset? (like AR3 does)

[Toni Wilen]

btw, AR2 has interesting copper pointer detection code. (Not anymore in AR3)

Something like this in pseudocode:

Get address of COPxLC from memory that stores all CPU custom accesses:
Run detection (COPxLC)
If detected: exit
address = 0
next:
Run detection(address)
if detected: exit
address = address + 2
if (address = end of chip): exit
goto next

Detection code does:
Clear INTREQ
Save LONG from address
Write Copper MOVE, 0x8001 to INTREQ, to address (LONG)
Write to COPxJMP
Enable Copper DMA
Disable Copper DMA
Restore old LONG value
Check if INTREQR bit 0 is set, if set, copper pointer found, exit

Really great idea but unfortunately it is too easy to detect by creating fake copper list.

[Galahad/FLT]

Originally Posted by Toni Wilen

btw, AR2 has interesting copper pointer detection code. (Not anymore in AR3)

Something like this in pseudocode:

Get address of COPxLC from memory that stores all CPU custom accesses:
Run detection (COPxLC)
If detected: exit
address = 0
next:
Run detection(address)
if detected: exit
address = address + 2
if (address = end of chip): exit
goto next

Detection code does:
Clear INTREQ
Save LONG from address
Write Copper MOVE, 0x8001 to INTREQ, to address (LONG)
Write to COPxJMP
Enable Copper DMA
Disable Copper DMA
Restore old LONG value
Check if INTREQR bit 0 is set, if set, copper pointer found, exit

Really great idea but unfortunately it is too easy to detect by creating fake copper list.

Setting the copperlist $dff080 as $ffffffff makes AR2 crash on entry on button push. This however does not defeat AR3

[Toni Wilen]

It looks like there is no checking for "shadow memory" stored copper list pointer, even if it is outside of chip ram region or is odd. It always does LONG read and write access to stored pointer...

[esel]

Originally Posted by Toni Wilen

Some notes and guesses:

AR 3 seems to detect between CPU reset (reset-instruction, short pulse) and keyboard reset (long pulse). I managed to duplicate AR3 real hardware behavior (power on = no title screen) if only keyboard reset triggers internal AR init condition.

AR 2 does not seem to have this kind of reset detection.

My guess is that AR2 hangs or crashes if CPU reset instruction is executed. AR3 has extra protection (with side-effect of not showing title screen at power up)

Following tests needed:

- Does AR3 work with Double Dragon II (original, OCS-only 3.84 version). It has protection code that uses RESET instruction. (Code runs before title screen)

- Does AR2 show boot screen at power up? or only after keyboard reset? (like AR3 does)

i have no original dd2 i tryed to write the ipf back but i cant as its a custom disk format.

sadly i dont have a cyroflux to write it back to disk.
is there any other way to test that ?

to test the ar2 boot screen i need dumps of the original roms as i only have the ar3.