TANGLEWOOD vs. the AtGames Flashback Console

Moving on from the – thankfully almost resolved – troubles of the AtGames Firecore, my QA team and I continued running through our stash of other weird and wonderful Mega Drive clone consoles, when once again we were rudely interrupted by the postman with another AtGames machine. You can thank our friends over at Bitmap Bureau for this one – the makers of Xeno Crisis, another successfully Kickstarter funded game for the world’s greatest videogame console. We’ve been pooling our resources together to help our projects along, and they’ve sent us an AtGames Flashback HD to play with!

It’s an entirely different design to the Firecore, right from the ground up. It looks more the part, a slightly shrunken Mega Drive 1-style casing, which houses an ARM-based Android system (as opposed to the Firecore’s proprietary probably-a-system-on-chip core) running a software emulator this time, with HDMI output pushing 720p, bluetooth gamepads, a scanline filter, and a slick new menu system. Nice to see things have improved! The audio from the built-in games sounded crisp and in tune, and the new HDMI output was a game changer with regards to visual quality, so we had high hopes for TANGLEWOOD running on it. How naive of us…

TANGLEWOOD fired up in complete silence. No intro theme, no menu UI sounds, nada, until we started the sound test and noticed that PCM sound effects and PSG sound was working. FM emulation was DOA, then. At least the PSG was in tune!

The Investigation

It was probably sensible to assume that we’d have to start over with our diagnostics, since the system is completely different from the Firecore so none of our previous findings would be of any use. We gave those special registers a quick poke just in case the manufacturers had carried over the concept for convenience, but there was no response.

Cracking open the case to look for clues immediately revealed an unexpected aide – the board was straight-up sporting a mini USB port!

Since it’s an Android based system, and we are wishful thinkers, we hooked it up to ADB to see if would respond, and to our surprise it did, root and all! A quick Google search showed this wasn’t new information (should have looked there first…) and the machine has already had a bit of probing from the SEGA fan community, but unfortunately it was all related to getting more games on the machine; nothing revealed anything about the emulator powering its games, and no sign of any other games suffering from the same problem as ours. We dumped the whole flash to poke around with and closed it back up.

The first thing to check was if any of its built-in games had been modified to work around any issues. With the flash dump to hand we were able to extract the ROM files, and started firing each one up in our modified megaEx build to log any unknown register pokes or other out-of-the-ordinary behaviour. Unlike our Firefore diagnostics, this unfortunately showed nothing.

The next thing to check was if any other games in our library suffered from the same issue. Popular games probably would have shown up in Google results if they had compatibility problems, so it was wise to start with some lesser known titles. We have quite the collection of homebrew carts! We tried things like Daytrip, Escape 2042, and some feature test carts, which all worked, but Miniplanets was silent!

Miniplanets and TANGLEWOOD share a common denominator: they both use the Echo Sound System from Sik – a rather superb Z80 driver for music, SFX, and PCM playback for the Mega Drive. Echo also comes with its own test program called Echoster, so we fired that up, and verified it suffered from the same issue.

Luckily, Echo is open source. Unluckily, I’ve never touched a line of Z80 assembly in my life, and those of you who already follow my blog will know I stopped writing devblog posts when I got to the PSG chip – I’ve never actually touched the YM2612 either! One 12 hour crash course in Z80 later (thanks, everyone at Plutiedev!) and I was totally not ready to track down a bug in a language I barely knew, on a chip I barely knew, on a clone I barely knew, at 3 o’clock in the morning. The first issue was figuring out how to debug anything on the Z80, since it has limited ways with which to communicate with the 68000 – it would require some sort of status byte or command queue to send data back to the 68000 to display info on screen. With limited time, I needed some debug output – or at least some way to identify if a particular line of code had been hit – available from the Z80 itself. It’s capable of sound output, so how about some sound queues to tell me if a condition was met? It’s primitive, sure, but it does the job.

Armed with a z80asm assembler, Echo’s source, and SEGA’s Mega Drive Programming Manual, I managed to follow the example register table for a single piano note:

With a PlayPiano routine written, I got a piano note when interesting code was hit! Jog on, printf()!

From there I was able to determine which parts of the codebase were being executed within Echo, and check some assertions – the initialisation, instrument loading, and note on/off routines were all being called. One thing I’d noticed was that once my debug piano note had played, all subsequent Note On events from that channel also triggered the same note, which meant that the AtGames was fully capable of producing sound output from Echo, but the instrument data didn’t seem to be written (or overwritten, after my piano had been loaded).

After some head scratching and fruitless attempts at tinkering with the instrument loading code, this desperate attempt at getting an answer worked:

    ex af, af'  ; Backup A+F
    ld c,iyh    ; Load top byte of IY
    ld a,c      ; To register A
    cp $40      ; Check it's $40
    jp z,.ok    ; If correct, bail
.piano:
    call Piano  ; IY is not $40XX
.ok:
    ex af, af'

On a genuine Mega Drive, this code ran silently. On the Flashback, it played a piano note.

Interesting. For those who have been following along with my assembly adventures, this should be quick to explain – the Z80 has a bunch (actual terminology) of 8-bit registers used for arithmetic and counters, and a handful of 16-bit registers used for addresses. The 16-bit registers have pairs of 8-bit counterparts allowing access to the upper or lower byte. For example, IY is a 16-bit register, IYH allows access to the top byte (IY High), IYL allows access to the bottom byte (IY Low).

In Echo, the YM chip is accessed via four ports – $4000 and $4001 for modifying parameters of channels 1-3, and $4002 and $4003 for modifying channels 4-6. During Echo’s initialisation, this happens:

ld iyh, $40

This keeps $40 in the upper byte of the IY register for the entirety of the program, and the lower byte is set to $00, $01, $02 or $03 when needed, depending on the channel being accessed.

The Fix

It turns out the AtGames Z80 emulator doesn’t correctly emulate loading to/from IYH! Another quick test determined that it does, however correctly emulate loading to/from IYL. The simple fix to the problem is just to initialise the IY register in full:

ld iy, $4000

Easy! TANGLEWOOD now boots up with the main menu playing, and all is well! Almost. Once again, the SSG-EG feature of the YM has not been emulated in this machine, resulting in the same screeching and whining as the Firecore when playing notes configured with it.

Thankfully, we already have a simple way to test if we’re running on this machine and disable SSG-EG during initialisation – just try accessing that IYH register:

ld iy, $1234
ld iyh, $40
ld a, iyh
cp $40
jp nz, .disableSSGEG

And that’s a wrap!

TANGLEWOOD vs. the AtGames Firecore Console

During the Kickstarter campaign for TANGLEWOOD, I made a very big promise – that TANGLEWOOD would run on just about every SEGA Mega Drive console, clone, emulator, and home arcade setup available. A golden rule I’ve been throwing around was “if it runs Sonic 2, it will run TANGLEWOOD” – no problem, since the game doesn’t perform any demo scene-style tricks or timing sensitive manoeuvres, nor does it rely on any hardware quirks or undocumented features of the various chips involved. It’s a big and ambitious game from a design perspective, but as far as pushing the hardware goes, I backed off a bit in order to uphold my promise of compatibility.

This proved quite a challenge, then, when once fateful afternoon the postman knocks on my door to deliver a box of goodies for our QA team to get busy with – some 6-button controllers from various third party manufacturers, a white label flash cartridge with SD slot, and an intriguing little black box with “At@Games” written on the front.

It was the first AtGames Mega Drive model that was sold en-mass here in the UK at our Argos stores – at its heart was AtGames’ Firecore technology. I’d had previous experience playing Streets of Rage on this thing in a noisy gaming cafe in Nottingham. The hustle and bustle of the venue did a good job of hiding the Trojan inside the little horse – its horrific audio. Just how bad was it? I didn’t believe the tales depicting it as the worst console ever released, since the Internet loves its hyperbole, but in this case everybody was right. All of the audio is pitched down, at differing values between FM and PSG, and there was some horrible screeching when some parts of soundtracks played.

TANGLEWOOD was shocking. It sounded like a horror game – dreary down-pitched FM, twisted PSG slides, and high pitched screeches where there should be PCM samples. I have a promise to keep, so I’m not taking this lying down.

The Investigation

Some quick searching around revealed that the menu ROM has already been dumped by a team of Russian hackers over at emu-land.net. The ROM seems to make use of 128kb VRAM mode, writes to ROM space, and pokes some addresses outside the usual Mega Drive range which crashes most emulators, but I’ve been working with megaEx (my fork of Mega by Lee Hammerton and Jake Turner) which happily executes broken code, instead logging to file anything it doesn’t understand. As expected, the graphics were garbled, but by pressing buttons I could hear the menu navigation sound in the background, so all was well.

Some modifications to the logging later, and I had a dump of unknown reads and writes when booting up the AtGames menu ROM:

Byte 0x00 written to cart address 0x00000000
Byte 0x0E written to cart address 0x00000001
Byte 0xFF written to unmapped address 0x00B01008
Byte 0x07 written to unmapped address 0x00B01009
Byte read from unmapped address 0x00B00010
Byte read from unmapped address 0x00B00011
Byte 0x00 written to unmapped address 0x00B00010
Byte 0x40 written to unmapped address 0x00B00011
Byte 0x53 written to unmapped address 0x00A14000
Byte 0x45 written to unmapped address 0x00A14001
Byte 0x47 written to unmapped address 0x00A14002
Byte 0x41 written to unmapped address 0x00A14003
Byte 0x00 written to cart address 0x00000000
Byte 0x0F written to cart address 0x00000001
Byte read from unmapped address 0x00B0001A
Byte read from unmapped address 0x00B0001B
...

Writing to address 0x0 seems a bit odd (it’s cartridge space), those in the range 0xB00000+ are not in any known Mega Drive space or any of its addons, and 0xA14000-0xA14003 are just the TMSS (the emulator hasn’t implemented it yet). This bit is particularly interesting:

Byte 0x30 written to unmapped address 0x00B01054
Byte 0x20 written to unmapped address 0x00B01055

From the Russian forum, although Google Translate makes a mess of it, you can make out that it changes the FM frequency, and the value 0x2820 is provided as an example. Writing this alone doesn’t work, it seems that those word writes to 0x0 are some sort of latch to tell the AtGames to pay attention to writes to 0xB00000+. Adding this to the top of my ROM seems to fix the FM frequency:

    move.w #0xFFFF, 0x00000000
    move.w #0x2620, 0x00B01054
    move.w #0xFFF7, 0x00000000

Simple enough. Latch 0x0, write 0x02620 to what seems to be the FM frequency register in the AtGames machine, un-latch 0x0. The example 0x2820 provided by the Russian folk didn’t seem to be quite in tune, 0x2620 sounded closer.

The PSG was still very out of tune, and there was still harsh screeching from some notes, so we needed more. I modified TANGLEWOOD’s sound test screen to include an address poker – an address (starting from 0xB00000) and its current value is shown on screen. Up and Down cycles the address, Left and Right cycles the value, and Start writes the new value.

After some experimentation I had a vague idea of what some of the registers were responsible for:

0x00B00000
Locks up the machine

0x00B00018
Affects PSG pitch, bingo!

0x00B01000
Cycles through various video modes

0x00B01002 - 0x00B0104
Various graphics output options, all resulting in a fuzzy, black and white display

0x00B01006
Possibly NTSC/PAL flag, but my TV has no OSD so can't tell for sure

0x00B01008
Seems to do a palette shift

0x00B01018
Screen Y offset in pixels

0x00B01016
Screen X offset in tiles

0x00B0101A
Changes screen to green/blue tints, possibly RGB order

0x00B01028
Slows audio down to a crawl, PSG glitches and screeches

0x00B0102A
Locks up the machine

0x00B01036
TV displays "no signal" but audio continues to play

0x00B01038
Adjusts VDP tile width

0x00B01054
Adjusts FM frequency - changed FM music pitch

0x00B01055
Adjusts FM and PSG clock - changed FM and PSG music tempo

So, with some trial and error, I managed to find the relevant addresses to change audio clocks:

• 0x00B00018 changes PSG frequency. The bottom 2 bits seem to be a fine tune setting (4 steps), whilst the rest of the byte seems to be a divider (for PSG, frequency*2 = one octave).
• 0x00B01054 changes FM music pitch, already known.
• 0x00B01055 changes FM and PSG clock, speeding up and slowing down the music tempo.

The Fix

Using the very scientific method of playing my game’s original soundtrack from a laptop, and listening to the AtGames sat next to it, I settled on the values 0x7A for the PSG freq, 0x26 for the FM freq, and 0x20 for the FM/PSG clock.

The code:

    ; AtGames audio fix
    move.w #0xFFFF, 0x00000000  ; Latch 0x0000
    move.b #0x78, 0x00B00018    ; Write new PSG frequency
    move.b #0x26, 0x00B01054    ; Write new FM frequency
    move.b #0x20, 0x00B01055    ; Write new FM clock
    move.w #0xFFF7, 0x00000000  ; Un-latch

Here’s the new and improved main menu theme tune:

It’s not 100% done yet. The next step is to fix the screeching sound from some of the instruments. After listening to some of the tracks, I’ve managed to determine that the affected notes all used the SSG-EG mode in their FM operators. It seems AtGames didn’t emulate this properly (if at all), and my only option – without adding more precious time to this – was to disable SSG-EG in all instruments as a test – which worked fine.

I’d like SSG-EG on the other consoles, so the plan is to disable SSG-EG on the fly in the audio engine if an AtGames is detected. I’ve yet to figure that part out, and so far it’s been easier said than done – reading from any of the AtGames’ config regs at 0xB00000+ hangs up a genuine Mega Drive, and reading from 0x0000 on the AtGames returns the first word of the stack vector rather than allowing us to read back the latch, which means we can’t verify that the latch was written/denied to check if it’s a port.

If I get time, I would like to investigate these registers further, and properly document the behaviour of all values written across the range. Perhaps we could fix other issues with this model, so homebrew and ROM hacks will be safe on the AtGames Firecore!

Matt

Hello! It’s been a long while since I’ve posted a programming article, since I’ve been pretty busy getting my game finished.

I do intend to return here with a full new set of tutorials (now that I know what I’m doing…) but in the meantime:

SEGA Mega Drive Assembly Programming Workshop

I’ve uploaded the slides from my workshop at the National Videogame Arcade last year, which details step-by-step the journey to getting Hello World on screen, plus a few extras like memory management, and bonus slides on sprites. You’ll need this pack of resources to go with it.

SEGA Mega Drive Hello World Example

For people trying to get started quickly, I’ve also created a peer reviewed, tried-and-tested on hardware, Hello World sample, all in one file.

Assemble with ASM68K.EXE:

asm68k.exe /p hello.asm,hello.bin

Matt

I’ll be running a workshop teaching the basics of 68000 assembly language and the SEGA Mega Drive at this year’s GameCity festival! It’s on Thursday 27th October, 11am – 2pm, at the National Videogame Arcade, Nottingham, and will last for around 3 hours.

Who is the workshop for?

• Those who have never written a line of assembly before
• Those with little or no understanding of how a CPU works
• Some higher level programming experience is required – functions, variables, logic and flow, signed and unsigned numbers
• Some higher level debugging experience is required – breakpoints, stepping, watch windows, swearing
• A basic understanding of binary and hexadecimal numbering is recommended (I’ll provide a quick refresher, though)

What will be covered?

• The basics of the 68000 CPU
• The basics of 68000 assembly language
• Writing your first line of assembly
• Building your first ROM
• Debugging assembly
• Basic arithmetic, branching, looping, and logic
• Initialising the SEGA Mega Drive
• The Mega Drive Video Display Processor
• Programming the VDP
• Palettes, tiles, maps and sprites
• Turning the screen pink!
• Creating a font
• Displaying “Hello, World!”
• Porting Crysis 3

What will you need?

• A computer
• A text editor
• DOSBox
• SNASM68K.EXE (ignore the warning about 64-bit systems)
• An emulator with built-in debugger (Regen D on Windows/Linux, DGen on Mac)
• The workshop support files: https://www.mediafire.com/?akxee28ius4gdox