Games that may damage PSG chips

Guardian (2341)

05-03-2018, 01:27

I've noticed a few times when running certain games on real machines that the relay in my MSX was clicking loudly. When running the same game in the OpenMSX emulator I noticed that it gives a warning about unsafe PSG settings exactly at the same moment. As the Red Book says, if both 6th and 7th bits of PSG register 7 are set to one, this may damage the older machines with the real PSG chip. So far I identified 2 games that are doing such nasty thing - Train and Blagger.

Thanks for the help from OpenMSX gurus, I am now able to set up a debugger trap for such events, debug them and create patches for the ROMs in my collection. I propose to everyone to notify the MSX community in case any game or other software attempts to use this dirty tricks due to a bug or a nasty copyprotection. Here are my 2 cents:

TRAIN.ROM
0F2D: FF -> BF

BLAGGER.ROM
21C8: FF -> BF
22EC: FE -> BE

Aangemeld of registreer om reacties te plaatsen

Van JohnHassink

Ambassador (5407)

05-03-2018, 01:35

Does Moonblaster 1.4 set the same bits to those registers?
And theoretically, how many MSX machines that would suffer damage from that are still in use?

Van Meits

Scribe (5482)

05-03-2018, 01:39

Moonblaster's original driver does it wrong and will trigger the error message in openMSX. On a real MSX I never heard things go bad. The updated driver by BIFI has fixed this bug.

Van gdx

Prophet (2977)

05-03-2018, 10:13

JohnHassink" wrote:

theoretically, how many MSX machines that would suffer damage from that are still in use?

It's hard to know. This seems to happen only in a few cases and it depends on the configuration. Only issues that it caused me is a malfunction of the joysticks. So even if this bug only damages PSG very rarely, it can interfere in many cases until the Turbo R. This is one of the biggest design flaws of MSXs.

Thank you Alexey. This is an opportunity to put here the data I had noted with the help of some guys.

3D Water Driver (probably tape version converted to ROM , crc32=d5af9e82)
0B40h: 3E 07 1E F8 CD 93 00 -> 3E 07 1E B8 CD 93 00
0C24h: 1E 07 3E 07 CD 93 00 -> 1E 87 3E 07 CD 93 00
1468h: 1E F8 3E 07 CD 93 00 -> 1E B8 3E 07 CD 93 00

Anty (ROM)
2A32h: 0E F8 -> 0E B8

Athletic Ball (ROM)
0E55h: 1FF000 -> 1FB000
0E71h: 00F810 -> 00B810
0E80h and 1B96h: F0 10 10 -> B0 10 10
0E8Dh: 00 FC 10 -> 00 BC 10
0E9Ch: F8 00 10 -> B8 00 10
12A4h, 1B87h, 1BA3h, 1BB1h, 1BBFh, 1BCDh ,1BDBh, 1BE9h, 1BF7h, 1C05h, 1C13h and 1C21h: 00FE10 -> 00BE10

Attack Four - Joshi Volley Ball (ROM)
30c1h: 3E071EFFCD9300 -> 3E071EBFCD9300
3100h: 3E071EFECD9300 -> 3E071EBECD9300
310Eh: 3E071EFFCD9300 -> 3E071EBFCD9300
To remove the clicking of keys:
0002h: 10 40 -> 0E 40
000Ch:
00 00 31 80 F3 CD A3 41 CD 00 B0 C3 E0 9B 00 00 00
->
3E 00 32 DB F3 31 80 F3 CD A3 41 CD 00 B0 C3 E0 9B

BeTiled! (ROM, CRC32=4F89A784)
01B5H: ED A3 0D -> CD F0 3F
3FF0H: 00 00 00 00 00 00 00 00 00 00 -> FE 07 20 02 CB B6 ED A3 0D C9

Car Race (ROM)
0E63h: 3E 07 1E FA CD 93 00 -> 3E 07 1E BA CD 93 00
0F05h: 07 DE -> 07 9E
0F14h: 07 FA -> 07 BA
1245h: CD 16 53 5F 3E 07 -> CD 00 58 5F 3E 07
1800h:
40 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
->
40 E5 3A 69 E0 FE 41 2A 63 E0 28 0A FE 42 2A 65 E0 28 03 2A 67 E0 7E E6 3F F6 80 E1 C9

Car Figther (ROM)
0008h: 00 00 00 00 00 00 00 00 91 and E6 BF 5F 3E 07 C3 93 00 91
1062h, 3BE7h, 3DCAh, 3DDDh and 3DF3h: 9EBD par 0880

Crazy Buggy (ROM)
308Ch: CD9300 -> CDF47F
3FF4h: 00 00 00 00 00 00 00 00 00 00 00 -> FE 07 C2 93 00 CB FB CB B3 C3 93
Joystick fix:
017Eh: C5 76 AF CD D8 00 FE FF C1 -> 76 3E 01 CD D8 00 FE FF 00 (Don't replace the same string at 019Dh)
033Bh: 20 05 3E 01 CD D5 00 -> B7 20 04 3C CD D5 00

Crazy Bullet (ROM)
2E24h: 0E3800 -> 0EB800

David II (ROM)
0083h: 3E 07 1E C5 CD 93 00 -> 3E 07 1E 85 CD 93 00
3A8Dh: 06 C0 B0 5F 3E 07 CD 93 00 -> 06 80 B0 5F 3E 07 CD 93 00

Eagle Fighter (ROM)
0032h: FF FF FF FF FF FF FF FF -> E6 BF 5F 3E 07 C3 93 00
58AEh, 6168h, 6394h, 63A7h, 63DFh, 6403h, 6442h et 6463h: 40A3 -> 3240
6333h: CD 93 00 C9 -> C3 93 00 C9
To improve compatibility with emulators and ROM loaders:
0000h:
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
->
41 42 10 40 00 00 00 00 00 00 00 00 00 00 00 00 CD 38 01 0F 0F E6 03 4F 06 00 21 C1 FC 09 B6 F0 4F 23 23 23 23 7E E6 0C B1 26 80 CD 24 00 2A 02 80 E9

Exoide-Z (ROM)
3B93h: CD 93 00 10 F9 3E 07 1E B8 C3 93 00 -> FE 07 20 02 1E B8 CD 93 00 10 F1 C9

Exoide-Z Area 5 (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
6F8Ch, 706Fh, 7082h, 70ACh et 70CFh: 43 B0 -> 08 40

Flappy Limited '85 (ROM)
1181h: 3E 07 CD FC 51 -> 3E 07 C3 9F 7F
3F9Fh: 00 FF FF FF FF FF FF FF FF FF -> 00 CB B3 D3 A0 0E A1 ED 59 C9

Flight simulator With Torpedo Attack (ROM)
6DFFh, EDFFh and 16DFEh: 05 0E 00 04 80 -> 05 0E 80 04 80
6E07h, EE07h and 16E06h: 1E F5 1A 00 -> 1E B5 1A 00

Ginga Hyouryou Vifam (ROM) (also called Bifamu by mistake)
2B1Ah:
E5 79 C6 08 67 FD 6E 00 CD 94 AB 26 07 3A F1 D0 2F 6F CD 94 AB E1 C9
->
79 C6 08 FD 5E 00 CD 93 00 3A F1 D0 2F E6 3F F6 80 5F 3E 07 C3 93 00
MSX2 fix:
3307h: CD 4E 04 -> 00 00 00

Godzilla vs 3 Daikaijuu (Godzilla vs The Three-Headed Monster) (ROM)
00CAh: 0E AF 1E 00 CD 93 00 3C 10 FA -> 0F AF 1E 00 CD 28 BF 3C 10 F8
00D6h, 3CCAh, 3D0Ah, 3DEEh et 3E33h: E4 F6 3F -> E4 F6 BF
3F26h: E5 C9 00 00 00 00 00 00 00 00 -> E5 C9 FE 07 20 02 1E BF C3 93

Hanafuda KoiKoi (ROM, crc32=17b160cb) (The version with crc32=7AF993E1 is a bad bump.)
001Ah: 24 07 CD 05 41 -> A4 07 CD 05 41
0076h and 00C2h: 3C 07 CD 05 41 -> BC 07 CD 05 41
00F3h: 3F 07 CD 05 41 -> BF 07 CD 05 41

Higemaru Makaijima Nana-tsu no Shima Daibouken (J) (ROM)
9BF4h: 00 00 00 00 00 00 00 00 00 00 00 00 C3 -> D5 57 7D 5C CB FB CD 93 00 7A D1 C9 C3
9C5Ah, A0E2h and A2E0h: 38 CD 20 A5 -> B8 CD 20 A5
A2EDh: 11 2E 07 67 CD 20 A5 -> 11 2E 07 67 CD F4 9B
A51Fh: 38 F5 D5 7D -> B8 F5 D5 7D
A54Ah: EF 2E 07 67 CD 20 A5 -> EF 2E 07 67 CD F4 9B

Ice World (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
1148h, 2142h, 236Eh, 2381h, 23B9h, 23DDh, 241Ch and 243D: 1A A3 -> 08 80

Iga Ninpouchou (Manual of Ninja) (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
239Fh, 2581h, 2594h, 25BEh and 25E0h: 55 A5 -> 08 80

Iga Ninpouchou Mangetsujo no Tatakai (Manual of Ninja Battle of Full Moon) (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
718Fh, 7371h, 7384h, 73AFh and 73D0h: 45 B3 -> 08 40

Issun Boushi no Donna Mondai (Any Matter of Inch-High Samurai) (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
7418h, 75FBh, 760Fh, 7638h and 765Ah: CF B5 -> 08 40

Knight Lore (ROM)
06B6h: 07 38 -> 07 B8

Koneko no daiboken Chibi-chan ga Iku (Kitten Adventure Runt Goes) (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
7886h, 7A69h, 7A7Ch, 7AA6h et 7AC8h: 3D BA -> 08 40

Moai no Hihou (The Treasure of Moai) (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
730Dh: 43 B6 -> 08 40

Mad Rider (ROM)
3025h:
F3 06 0D 21 40 C5 AF 5E F5 CD 93 00 F1 23 3C 10 F6 3A 4D C5 B7 28 07 3D 5F 3E 0D CD 93 00 C9
->
06 0D 21 40 C5 AF 5E FE 07 20 02 CB FB CD 93 00 2C 3C 10 F2 7E B7 28 07 3D 5F 3E 0D C3 93 00
To improve compatibility with emulators and ROM loaders:
0035h:
97 32 01 60 3E 01 32 50 68 3C 32 01 70 3C 32 33 78
->
3E 01 32 00 68 00 3E 02 32 00 70 00 3E 03 32 00 78
0162h, 027Ah, 74DFh, 755Eh, F500h et F57Fh: 32 01 68 -> 32 00 68

Mobile-Suit Gundam Last Shooting (ROM, crc32=1d27d31f) (The version with crc32=fbbfb454 is a bad bump.)
0BC0h and 316Eh: 07C8 -> 0788
2E2Ch: 3E 07 1E 38 -> 3E 07 1E B8

Polar Star
46C4h: 16 12 -> 16 92
48D6h: 16 ED -> 16 AD
4942h: 16 FF CD -> 16 BF CD
5943h: 16 3F -> 16 BF
6AA3h: 07 EC FF FF -> 07 AC FF FF

Scramble Eggs (ROM)
034Fh: 3E 07 1E D0 CD 93 00 -> 3E 07 1E 90 CD 93 00
1813h: CD E4 58 06 C0 -> CD 91 5D 06 80
1D90h:
40 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
->
40 E5 3A 69 E4 FE 41 20 05 2A 63 E4 18 0A FE 42 2A 65 E4 28 03 2A 67 E4 7E E6 3F E1 C9

Senjou no Ookami - The way to victory (aka: Wolf of Battlefield) (ROM)
123F4h and 12423h: F5 3E 80 B3 5F F1 -> CB FB CB B3 00 00

Sprites Man
1E F8 3E 07 CD 93 00 -> 1E B8 3E 07 CD 93 00

Snack It
3085h: 00 CD 93 00 23 -> 00 CD 97 97 23
3706h: C3 01 1F 69 -> C3 01 1F A9
37b1h: CD 00 D2 C9 -> CB FB CB B3
Replace:
3E C9 32 9A FD 06 0D 1E 80 78 D3 A0 FE 07 20 02 1E 80 7B D3 A1 1E 00 10 F0
->
21 A5 D4 11 9A FD 01 05 00 F3 ED B0 FB 06 0E 1E 00 78 D3 A0 7B D3 A1 10 F8
Replace:
96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
->
96 FE 07 20 04 CB FB CB B3 F3 D3 A0 F5 7B FB D3 A1 F1 C9

Soukoban (ROM)
0301h: F8 32 92 E4 -> B8 32 92 E4 (already replaced on an alternate version)
3DCAh: F8 07 -> B8 07

Super Suwanggi - Super Altered Beast (ROM)
6C01h: F8 -> B8
6DA1h: F8 -> B8
7FEEh: F8 -> B8
FBD7h: F1 -> B1

The Apeman Strikes Again (Eaglesoft)
1F 69 0F -> 1F A9 0F

The Roving Planet Styllus (aka: Panet mobile) (ROM)
6C85, 6E68, 6E7B, 6EA5 and 6EC7: 3CAE -> 858D
4D85: FB 00 FB 00 FB 00 FB 00 -> E6 BF 5F 3E 07 C3 93 00

Topple Zip MSX2 (ROM)
5325h: CD D0 93 -> CD CF 93
53CCh:
CD 9B 93 C9 E5 06 0E 16 00 1E 00 C5 CD F2 94 C1 14 05 20 F7 11 F8 07 CD F2 94 21 94 E8 AF
->
C3 9B 93 E5 3E 0E 1E 00 57 FE 07 20 02 1E 80 CD F2 94 3D 20 F1 11 B8 07 CD F2 94 21 94 E8

Volguard (ROM)
3B5FH: 3E 07 1E 8E CD 93 00 -> 3E 07 1E CE CD 93 00
72EEh: 3E 07 C3 70 B9 -> 3E 07 CD 69 B3
796Fh: C9 FF FF FF FF FF FF FF FF FF -> C9 CB B3 D3 A0 0E A1 ED 59 C9

Wasure no Nausicaa Game - Never forget to Nausicaa Game Forever (ROM)
0510h and 1510h: 3E 07 1E FF CD 93 00 -> 3E 07 1E BF CD 93 00
0520h and 1520h: 3E 07 1E E9 CD 93 00 -> 3E 07 1E A9 CD 93 00
2A6Fh: 3E 07 1E E1 CD 93 00 -> 3E 07 1E A1 CD 93 00
2FF7h: 1E F8 3E 07 CD 93 00 -> 1E B8 3E 07 CD 93 00
3232h: 1E E8 3E 07 CD 93 00 -> 1E A8 3E 07 CD 93 00
349Eh: 1E E0 3E 07 CD 93 00 -> 1E A0 3E 07 CD 93 00
Replace each 3E 07 1E E0 CD 93 00 by 3E 07 1E A0 CD 93 00
Replace each 3E 07 1E E0 CD 93 00 by 3E 07 1E A0 CD 93 00
Replace each 3E 07 1E E8 CD 93 00 by 3E 07 1E A8 CD 93 00

Yami no RyouOu Hades no Monsho - Hades Emblem (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
6E98h, 707Bh, 708Eh, 70B8h and 70DAh: 4F B0 -> 08 40

Yokai Tantei ChimaChima (ROM)
2AF9h: CD FD 6A C9 par CB FA C0 B2

Yokai Yashiki (Monster House) (ROM)
0008h: 00 00 00 00 00 00 00 00 F3 -> E6 BF 5F 3E 07 C3 93 00 F3
7892h, 7A75h, 7A88h, 7AB2h and 7AD4h: 49 BA -> 08 40

Zexas Limited (ROM)
5C3Eh: 3E 07 CD B9 9C C9 -> 3E 07 C3 F4 BF C9
5761h, 57EDh and 5835h: 3E 07 CD B9 9C -> 3E 07 CD F4 BF
5FF7h: 3E 07 CD 93 00 -> 3E 07 CD E8 BF
7FE8h:
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
->
F3 D3 A0 F5 7B E6 BF FB D3 A1 F1 C9 CB B3 D3 A0 0E A1 ED 59 C9

Van Pencioner

Paladin (930)

05-03-2018, 13:12

i report that Magical Kid Wiz by Sony has this PSG issue

Van Alexey

Guardian (2341)

05-03-2018, 13:16

Thanks, guys! I think this topic deserves its own MSX Wiki article with all the collected data. Who can create one?

Van ren

Paragon (1219)

05-03-2018, 14:19

Alexey wrote:

Thanks, guys! I think this topic deserves its own MSX Wiki article with all the collected data. Who can create one?

You could (of course)

I thought about this as well when I saw this topic. Suggestion: create a software/game page for each game (like it's done now for MSX machines), something like: Blagger (1984, Alligata) (perhaps there should be some consent regarding the formatting of the software/game page titles first).
Then, for every game that has this PSG flaw, add it to the category labelled 'Software that uses unsafe PSG port directions' (or something like that) (perhaps it could be made shorter).

And whoever feels like it, can add other info to that software page as well.

-edit: applying a software specs template would be nifty as well of course.. ;) (see hardware/machines again)

(edit(2) I seem to have some time ATM, will look into an example page.. ;) (suggestions are welcome in the meantime))

Van TomH

Champion (327)

05-03-2018, 16:21

If the issue is providing output to Port A rather than treating it as input, shouldn't the concern be both damage to the PSG and to a joystick and/or tape player? Though both would almost certainly be fine, I can easily imagine that a joystick that tries to offer autofire or some other gimmick might be affected?

Van JohnHassink

Ambassador (5407)

05-03-2018, 18:01

Super nice research, gdx.

Van gdx

Prophet (2977)

05-03-2018, 23:06

"Alexey" wrote:

TRAIN.ROM
0F2D: FF -> BF

Crazy Train, ok.

"Pencioner" wrote:

Magical Kid Wiz by Sony has this PSG issue

When?

Van Alexey

Guardian (2341)

18-03-2018, 13:46

@ren - any progress? Thanks.