Some 13 years after I first simulated the security c-chip in Operation Wolf, an upcoming version of MAME will finally have this chip emulated via the original microcontroller program. The Caps0ff team were able to get the raw data by milling the chip and then using acid to expose the eprom die. The data was then read out using a special adaptor – a work of art! Thanks to Haze also for his work on the microcontroller emulation for the c-chip games.
You can see more of the work by Caps0ff at http://caps0ff.blogspot.com
Certain sounds were missing – explosions and some gunshots. Culprit was quickly found as the 384kHz resonator that drives the two M5205 sample generators was snapped off the board.
Replacements for this item seem quite hard to find new these days, but I took one from a broken Kung Fu Master bootleg and everything worked again.
Board was stuck in a very fast watchdog reset loop, to the point where I thought the reset circuit itself may not be working. The watchdog reset can be disabled by shorting the pad marked JP near the edge connector.
With this done it was clear the CPU was executing just a few cycles then halting. When in halt mode all data and address lines are meant to be released by the CPU, but it seemed D0-D3 were still active. This could have been quite difficult to track down as the data bus connects to many components on the board, but the schematics showed the LS253 @ 19C connected to D0-D3 specifically (most other connections are D0-D7) and indeed a logic probe showed it had active outputs when it should not have.
So what was happening was the CPU would reset and try to read the reset and stack vector from ROM, but ended up getting values with the low four bits corrupted. When the LS253 was replaced, everything worked fine.
Another Track & Field.. no video output, but a logic probe on the CPU seemed to show it was running without the watchdog reset firing. With no video monitor sync is the first thing to check, and although this later revision of the pcb doesn’t match any available schematics sync is easy to find as it still terminates at the 470/100ohm resistors as seen on the regular board.
Tracing back from that point quickly found a Fujitsu LS74 chip @ 11G with dead outputs. Replacing this fixed monitor sync and everything was correct.