diff --git a/emulators/ace-dl.yml b/emulators/ace-dl.yml
index 53fa25297..043c4a1eb 100644
--- a/emulators/ace-dl.yml
+++ b/emulators/ace-dl.yml
@@ -6,7 +6,7 @@ upstream: "http://ace.cpcscene.net"
version_source:
url: "https://roudoudou.com/ACE-DL/"
pattern: 'New release [^<]* - (\d{4}/\d{2}/\d{2})'
-profiled_date: "2026-10-20"
+profiled_date: "2026-11-10"
core_version: "2026/10/16"
version_basis:
kind: package
@@ -23,21 +23,19 @@ mode: standalone
notes: |
SDL port of ACE, the Amstrad CPC/Plus emulator written by Philippe Rimauro
(OffseT) for MorphOS. ACE-DL is built by Edouard Bergé (Roudoudou) from the
- MorphOS sources and released for Windows, macOS, Linux and Raspberry Pi;
- a third port targets Haiku. All three are closed source, the original author
- keeps the sources private, so the entries below were established on the
- official Linux x86-64 builds: file opens traced with strace and
- required/optional decided by removing each file on the 2026-06-03 build, then
- path constants, error strings and plugin keys read again from the 2026/10/16
- build (BNDGEN.tar.gz), which ships the same ROM files byte for byte.
+ MorphOS sources and released for Windows, macOS, Linux and Raspberry Pi.
+ The sources are private. Every entry below was read from the stripped
+ Linux x86-64 executable AceDL of the 2026/10/16 BNDGEN.tar.gz (tarball
+ sha256 4f3567bb2196e32f, AceDL sha256 0f159a705028e80e). The binary has no
+ symbols, so functions are named FUN_ (file offset = virtual
+ address in this PIE).
Machines are CPC 464, 664 and 6128 plus the Plus range, which boots from a
- cartridge and covers the GX-4000. An operating system is one 32 KB file
- holding the 16 KB firmware ROM followed by the 16 KB BASIC ROM. The AMSDOS
- disc ROM is a separate 16 KB file mapped in slot 7. The upstream MorphOS
- release keeps the three ROMs apart under System/ and composes them at
- startup, ACE-DL ships them pre-joined under private/firmware/ with one file
- per machine and language. The pairs are exact:
+ cartridge and covers the GX-4000. An operating system is one file read by
+ FUN_248970 as two 16 KB halves, the firmware ROM then the BASIC ROM, each
+ fread having to return 0x4000 bytes. A shorter file is refused, bytes past
+ 32 KB are ignored. ACE-DL ships them pre-joined under private/firmware/,
+ one file per machine and language:
OS464_UK.rom Firmware v1 + BASIC 1.00
OS464_FR.rom Firmware f1 + French BASIC 1.0 (md5 824f5213...)
@@ -50,55 +48,55 @@ notes: |
XMEM_FW_3_15_FR.rom XMEM 3.15 firmware + BASIC 1.23
Firmware versions run 1 to 4 for the 464, 664, 6128 and Plus, and the letter
- is the country: v English, f French, s Spanish, d Danish. The BASIC revision
- attached to a version 3 firmware follows the country, 1.23 for France, 1.21
- for Spain, 1.20 elsewhere, which is what the pairs above show. The XMEM files
- replace the firmware half with the X-MEM expansion firmware and keep the
- stock BASIC.
+ is the country: v English, f French, s Spanish, d Danish.
- The nine operating systems are the entries of the Machine configuration
- selector. OS6128_UK.rom is the built-in default and is opened at every
- startup even when the config OS= key names another file. Command line -fuk,
- -ffr, -fsp and -fdk switch to the UK, French, Spanish and Danish 6128 files.
- A machine needs at least 32 KB in the file: truncated to 16384 bytes the
- emulator prints "Error initializing ROMs!" and dies, padded to 40000 bytes it
- boots, so the check is a lower bound rather than an exact length. The AMSDOS
- ROM is checked for presence only, an 8 KB stub boots. Every ROM path is built
- from the application directory. The -configDir option added in 2026/10/16
- only moves the directory holding config.cfg, while the firmware stays under
- private/ beside the executable.
+ main (FUN_3a479) builds OS6128_UK.rom and Amsdos.rom from the application
+ directory and creates the machine with them before the config file is read.
+ If either load fails the machine constructor returns NULL, main prints
+ "Initialisation Error should not happend" and the next call dereferences
+ the NULL machine, so startup dies. Afterwards the OS= config key
+ (FUN_2a4840) loads the path it holds, the firmware requester (FUN_373ad0)
+ lists every *.rom under private/firmware/ and loads the pick, and -fuk,
+ -ffr, -fsp, -fdk (FUN_345230, applied by FUN_2989f0 after the config) load
+ one of the four 6128 files. These three paths keep the current firmware
+ when the load fails. The Machine configuration page (FUN_377790) names the
+ loaded firmware by comparing its basename with the nine names above.
- Plus machines boot from a cartridge and no cartridge filename is compiled
- into the binary, the three Amstrad_?4.cpr files are the system cartridges the
- author ships in the same directory, which is also the default browse root of
- the cartridge requester. The loader walks the RIFF chunk list and reports
- "Cartridge Load Error (Header)" on a bad header and "truncated file!" when a
- cb00..cb07 bank is short, each bank being 16 KB for 128 KB total.
+ Two older code paths switch firmware by RAM size, 64 KB for a 464 or 664,
+ more for a 6128, keeping the language through a strstr for "FR" in the
+ current path: the SNA loader (FUN_369ce0) opens ./private/firmware/OS464_FR,
+ OS464_UK, OS664_UK, OS6128_FR or OS6128_UK and the RAM selector
+ (FUN_377790) opens the same names under ./firmware/, both without
+ extension and relative to the working directory. When the open fails the
+ current firmware stays.
- Plugins pull three more ROMs. Multiface II reads multiface2.rom, the Hacker
- plugin reads hackit400uk.rom in its UK flavour and hacker481fr.rom in its
- French one, and Play2CPC reads the YM2608 ADPCM rhythm ROM, warning with
- "ym2608_adpcm_rom.bin not found!" and running without it. The Windows package
- omits that ROM, the Linux and Raspberry Pi packages carry it.
+ Plus system cartridges are loaded by the CPR loader FUN_234870, reached
+ from the media loader FUN_2a30a0 on a .cpr extension (command line,
+ CARTRIDGE= config key, dropped file). No code names the three
+ Amstrad_?4.cpr files.
+
+ Plugins pull three more ROMs, each from a path under the application
+ directory, loaded when the PLUGIN_ key is 1 in the config file (FUN_2a4840)
+ or from the plugin menu (FUN_375320). Multiface II and Play2CPC are also
+ reachable with -plugin multiface2 and -plugin play2cpc. A missing
+ Multiface II or Hacker ROM leaves the plugin uninstalled, a short one also
+ clears its PLUGIN_ flag. A missing YM2608 ROM is reported and Play2CPC runs
+ without the rhythm samples. The Windows x64 package omits that ROM, the
+ Linux packages carry it.
Expansion ROMs are user business: config keys ROM0 to ROM255 hold whatever
- the user picks through the requester rooted at media/rom/, and the release
- seeds that directory with third-party ROMs (ParaDOS, Protext, Maxam, Utopia,
- uniDOS, SymbOS, FutureOS, Orgams, Discology and others). Disc, tape,
- snapshot, Dandanator and X-MASS images are user content the same way, and the
- Nova plugin regenerates its 32 KB private/Nova/nova.nvram when the file is
- absent. Outside emulation the binary loads its own payload: sixteen QOI
- images (fatal with "Error loading QOI file please reinstall"), seventeen WAV
- drive and monitor samples (each merely reported as not found), and the
- private/messages catalog holding the French, English and Spanish
- translations. private/sounds/hitachi_long_seek.wav and
- private/images/acelogo.qoi ship with every package but appear in no path
- constant.
+ the user picks through the requester rooted at media/rom/, loaded by
+ FUN_248ae0 with the ROM type check. Disc, tape, snapshot, Dandanator and
+ X-MASS images are user content the same way, and the Nova plugin
+ regenerates its 32 KB private/Nova/nova.nvram when the file is absent.
+ Outside emulation the binary loads its own payload: QOI images, WAV drive
+ and monitor samples, and the private/messages catalog.
files:
# -- Operating systems, firmware ROM + BASIC ROM joined in one 32 KB file --
- name: OS6128_UK.rom
path: "private/firmware/OS6128_UK.rom"
+ aliases: [OS6128_UK]
system: amstrad-cpc
required: true
bundled: true
@@ -106,13 +104,15 @@ files:
validation: [size]
md5: b96280dc6c95a48857b4b8eb931533ae
sha1: 5977adbad3f7c1e0e082cd02fe76a700d9860c30
- source_ref: "AceDL 2026/10/16: private/firmware/OS6128_UK.rom, default machine, opened at every startup"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_3a479 0x3a893-0x3a8ac (sprintf %sprivate/firmware/OS6128_UK.rom), 0x3a8fc FUN_26caf0, FUN_249ef0 0x249fc0 FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails), 0x249fda (Error initializing ROMs!), FUN_3a479 0x3a905-0x3a93e (NULL machine), FUN_247c50 0x247c54 (NULL dereference); FUN_2989f0 0x299450 (-fuk); FUN_372cb0 0x373077-0x3730a4 (reset to 6128 UK); FUN_369ce0 0x36b7f4 and FUN_377790 0x378298 (extensionless OS6128_UK)"
note: >-
CPC 6128 English. Firmware v3 followed by BASIC 1.20. Absence stops
- startup with "Error initializing ROMs!".
+ startup with "Error initializing ROMs!". The SNA loader and the RAM
+ selector also try the extensionless name.
- name: OS6128_FR.rom
path: "private/firmware/OS6128_FR.rom"
+ aliases: [OS6128_FR]
system: amstrad-cpc
region: [france]
required: false
@@ -121,8 +121,10 @@ files:
validation: [size]
md5: 5ee871d5600eb9b5a22989c295f902a5
sha1: 200d59076dfef36db061d6d7d21d80021cab1237
- source_ref: "AceDL 2026/10/16: Machine configuration entry OS6128_FR.rom, command line -ffr"
- note: "CPC 6128 French. Firmware f3 followed by BASIC 1.23."
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_345230 0x345f26-0x345f36 (-ffr sets 2), FUN_2989f0 0x298a03, 0x2993d7-0x2993ff (sprintf %sprivate/firmware/OS6128_FR.rom), 0x29946b FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails), 0x299472 (failure keeps the current firmware); FUN_373ad0 0x374ea6-0x374ed7 (requester); FUN_369ce0 0x36b2ad and FUN_377790 0x377dc5 (extensionless OS6128_FR)"
+ note: >-
+ CPC 6128 French. Firmware f3 followed by BASIC 1.23. The SNA loader and
+ the RAM selector also try the extensionless name.
- name: OS6128_S.rom
path: "private/firmware/OS6128_S.rom"
@@ -134,7 +136,7 @@ files:
validation: [size]
md5: 0246740371010333385665dfeb7cd0ec
sha1: 1acd01c2c03424a78b32c9440f4d890fb1104815
- source_ref: "AceDL 2026/10/16: Machine configuration entry OS6128_S.rom, command line -fsp"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_345230 0x345f6b-0x345f7b (-fsp sets 3), FUN_2989f0 0x2993c1-0x2993ff (sprintf %sprivate/firmware/OS6128_S.rom), 0x29946b FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails); FUN_373ad0 0x374ea6-0x374ed7 (requester)"
note: "CPC 6128 Spanish. Firmware s3 followed by BASIC 1.21."
- name: OS6128_DK.rom
@@ -147,11 +149,12 @@ files:
validation: [size]
md5: ca1635fd992e2aa7a776b30da13467e5
sha1: a9e7ee6355730f319a37c95ca0a714212b88c3b1
- source_ref: "AceDL 2026/10/16: Machine configuration entry OS6128_DK.rom, command line -fdk"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_345230 0x345fb0-0x345fc4 (-fdk sets 4), FUN_2989f0 0x299438-0x299449, 0x2993ff (sprintf %sprivate/firmware/OS6128_DK.rom), 0x29946b FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails); FUN_373ad0 0x374ea6-0x374ed7 (requester)"
note: "CPC 6128 Danish. Firmware d3 followed by BASIC 1.20."
- name: OS464_UK.rom
path: "private/firmware/OS464_UK.rom"
+ aliases: [OS464_UK]
system: amstrad-cpc
required: false
bundled: true
@@ -159,11 +162,14 @@ files:
validation: [size]
md5: a993f85b88ac4350cf4d41554e87fe4f
sha1: 56d39c463da60968d93e58b4ba0e675829412a20
- source_ref: "AceDL 2026/10/16: Machine configuration entry OS464_UK.rom"
- note: "CPC 464 English. Firmware v1 followed by BASIC 1.00."
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_373ad0 0x37407d-0x3740ad (firmware requester lists *.rom under %sprivate/firmware), 0x374ea6-0x374ed7 (sprintf %sprivate/firmware/ + pick, FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails)); FUN_2a4840 0x2a4bac-0x2a4c15 (OS= key); FUN_377790 0x3779fe (Machine configuration label); FUN_369ce0 0x36b918 and FUN_377790 0x378363 (extensionless OS464_UK)"
+ note: >-
+ CPC 464 English. Firmware v1 followed by BASIC 1.00. The SNA loader and
+ the RAM selector also try the extensionless name.
- name: OS464_FR.rom
path: "private/firmware/OS464_FR.rom"
+ aliases: [OS464_FR]
system: amstrad-cpc
required: false
bundled: true
@@ -171,13 +177,14 @@ files:
validation: [size]
md5: a588b7c9e1c142b5d8ebec65ac7713d8
sha1: c68d84f37ab9defbb19200598c24948c97c9a644
- source_ref: "AceDL 2026/10/16: Machine configuration entry OS464_FR.rom"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_373ad0 0x37407d-0x3740ad (firmware requester lists *.rom under %sprivate/firmware), 0x374ea6-0x374ed7 (sprintf %sprivate/firmware/ + pick, FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails)); FUN_2a4840 0x2a4bac-0x2a4c15 (OS= key); FUN_377790 0x3779e7 (Machine configuration label); FUN_369ce0 0x36b8e1 and FUN_377790 0x3782f4 (extensionless OS464_FR)"
note: >-
- CPC 464 French. Firmware f1 followed by a French BASIC 1.0 that the
- upstream MorphOS release does not carry.
+ CPC 464 French. Firmware f1 followed by a French BASIC 1.0. The SNA
+ loader and the RAM selector also try the extensionless name.
- name: OS664_UK.rom
path: "private/firmware/OS664_UK.rom"
+ aliases: [OS664_UK]
system: amstrad-cpc
required: false
bundled: true
@@ -185,8 +192,10 @@ files:
validation: [size]
md5: 5a384a2310f472c7857888371c00ed66
sha1: 073a7665527b5bd8a148747a3947dbd3328682c8
- source_ref: "AceDL 2026/10/16: Machine configuration entry OS664_UK.rom"
- note: "CPC 664 English. Firmware v2 followed by BASIC 1.10."
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_373ad0 0x37407d-0x3740ad (firmware requester lists *.rom under %sprivate/firmware), 0x374ea6-0x374ed7 (sprintf %sprivate/firmware/ + pick, FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails)); FUN_2a4840 0x2a4bac-0x2a4c15 (OS= key); FUN_377790 0x377a15 (Machine configuration label); FUN_369ce0 0x36b881 and FUN_377790 0x378168 (extensionless OS664_UK)"
+ note: >-
+ CPC 664 English. Firmware v2 followed by BASIC 1.10. The SNA loader and
+ the RAM selector also try the extensionless name.
- name: XMEM_FW_3_15_UK.rom
path: "private/firmware/XMEM_FW_3_15_UK.rom"
@@ -197,7 +206,7 @@ files:
validation: [size]
md5: 85accc17e98c79dbbdde826cbfaf4692
sha1: c7d7e5116665e4f21ae3b9bcdca2ce3685f00293
- source_ref: "AceDL 2026/10/16: Machine configuration entry XMEM_FW_3_15_UK.rom"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_373ad0 0x37407d-0x3740ad (firmware requester lists *.rom under %sprivate/firmware), 0x374ea6-0x374ed7 (sprintf %sprivate/firmware/ + pick, FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails)); FUN_2a4840 0x2a4bac-0x2a4c15 (OS= key); FUN_377790 0x377a9f (Machine configuration label)"
note: "X-MEM firmware 3.15 English, followed by BASIC 1.20."
- name: XMEM_FW_3_15_FR.rom
@@ -209,7 +218,7 @@ files:
validation: [size]
md5: 046fa182f7574bde3ab97ee873f6e736
sha1: faa49a3aeb1d7e972437f6b77515455d14e2d680
- source_ref: "AceDL 2026/10/16: Machine configuration entry XMEM_FW_3_15_FR.rom"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_373ad0 0x37407d-0x3740ad (firmware requester lists *.rom under %sprivate/firmware), 0x374ea6-0x374ed7 (sprintf %sprivate/firmware/ + pick, FUN_248970 (fopen rb 0x248a0f, fread 0x4000 at 0x248a2c and 0x248aa1, a short read fails)); FUN_2a4840 0x2a4bac-0x2a4c15 (OS= key); FUN_377790 0x377a88 (Machine configuration label)"
note: "X-MEM firmware 3.15 French, followed by BASIC 1.23."
# -- Disc ROM, mapped in slot 7 --
@@ -221,10 +230,11 @@ files:
size: 16384
md5: 25629dfe870d097469c217b95fdc1c95
sha1: 39102c8e9cb55fcc0b9b62098780ed4a3cb6a4bb
- source_ref: "AceDL 2026/10/16: private/amsdos/Amsdos.rom, opened at every startup"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_3a479 0x3a8bb-0x3a8d4 (sprintf %sprivate/amsdos/Amsdos.rom), FUN_249ef0 0x24a037 FUN_248ae0 (fopen rb 0x248b42, %s is missing. 0x248c31, 128-byte AMSDOS header skipped when its checksum matches 0x248b63-0x248b99, ROM type byte 0-3 or 0x80 else not a CPC ROM file 0x248bd2-0x248bfd, fread 0x3f80 unchecked 0x248bb7), 0x24a098 (Error loading AMSDOS ROM), 0x249fda, FUN_3a479 0x3a905-0x3a93e, FUN_247c50 0x247c54 (NULL dereference)"
note: >-
AMSDOS disc ROM. Absence prints "Error loading AMSDOS ROM" then
- "Error initializing ROMs!" and stops startup. Length is not checked.
+ "Error initializing ROMs!" and stops startup. Length is not checked,
+ the first byte must be a ROM type 0 to 3 or 0x80.
# -- Plus system cartridges, 8 banks of 16 KB in RIFF chunks --
- name: Amstrad_v4.cpr
@@ -235,7 +245,7 @@ files:
size: 131156
md5: 39b565e648172980aa552293e667070f
sha1: 405e341437fab8db477606238af0c20eca2e39ee
- source_ref: "AceDL 2026/10/16: private/firmware, cartridge requester root, CPR loader"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_2a30a0 0x2a31ae (.cpr extension), FUN_234870 (fopen rb 0x2348b3, 12-byte RIFF header 0x234927, form AMS! or CXME 0x234937-0x23494b else Cartridge Load Error (Header) 0x2349a0, chunk loop 0x234bad with truncated file! 0x234d20, cbNN bank number 0x234eb0, 16 KB bank read 0x235010-0x235042)"
note: "464plus/6128plus/GX-4000 system cartridge, English, firmware version 4."
- name: Amstrad_f4.cpr
@@ -246,7 +256,7 @@ files:
size: 131156
md5: e7159fd674022ba05f9b347ae3cdafc6
sha1: e5aa80c501cfb435e2cba35ad92e427240394164
- source_ref: "AceDL 2026/10/16: private/firmware, cartridge requester root, CPR loader"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_2a30a0 0x2a31ae (.cpr extension), FUN_234870 (fopen rb 0x2348b3, 12-byte RIFF header 0x234927, form AMS! or CXME 0x234937-0x23494b else Cartridge Load Error (Header) 0x2349a0, chunk loop 0x234bad with truncated file! 0x234d20, cbNN bank number 0x234eb0, 16 KB bank read 0x235010-0x235042)"
note: "464plus/6128plus/GX-4000 system cartridge, French, firmware version 4."
- name: Amstrad_s4.cpr
@@ -257,7 +267,7 @@ files:
size: 131156
md5: 6eeed3fdd4abc98a2a932da810410128
sha1: 05fb14df24b2b504a3ae463a086f02f0adcc07b9
- source_ref: "AceDL 2026/10/16: private/firmware, cartridge requester root, CPR loader"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_2a30a0 0x2a31ae (.cpr extension), FUN_234870 (fopen rb 0x2348b3, 12-byte RIFF header 0x234927, form AMS! or CXME 0x234937-0x23494b else Cartridge Load Error (Header) 0x2349a0, chunk loop 0x234bad with truncated file! 0x234d20, cbNN bank number 0x234eb0, 16 KB bank read 0x235010-0x235042)"
note: "464plus/6128plus/GX-4000 system cartridge, Spanish, firmware version 4."
# -- Plugin ROMs --
@@ -266,36 +276,44 @@ files:
system: amstrad-cpc
required: false
bundled: true
- size: 8192
+ min_size: 8192
+ validation: [size]
md5: 4c9f014e91d407cc6509fad0095ab909
sha1: 1431ec628d38f000715545dd2186b684c5fe5a6f
- source_ref: "AceDL 2026/10/16: private/multiface2/multiface2.rom, read when PLUGIN_MULTIFACE2=1"
- note: "Romantic Robot Multiface Two ROM. The plugin loads without it."
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_2a4840 0x2a735b-0x2a73c3 (PLUGIN_MULTIFACE2 into 0x50c410), 0x2a767b-0x2a7685, 0x2ac38a FUN_3aa850 (sprintf %sprivate/multiface2/multiface2.rom 0x3aa87b, fopen rb 0x3aa88c, missing returns uninstalled 0x3aa894, fread 0x2000 0x3aa8ad, short read clears the flag 0x3aa8ba, hooks installed 0x3aa8e0-0x3aa955); FUN_345230 0x346086 (-plugin multiface2), FUN_2989f0 0x29934c-0x299358"
+ note: >-
+ Romantic Robot Multiface Two ROM. Without it the plugin is not
+ installed, a file shorter than 8 KB also clears PLUGIN_MULTIFACE2.
- name: hackit400uk.rom
path: "private/hacker/hackit400uk.rom"
system: amstrad-cpc
required: false
bundled: true
- size: 16384
+ min_size: 16384
+ validation: [size]
md5: 9a293eaaebca601f671070ad56cb81b6
sha1: 56306e7234bcffd14b4f977d42d237c4ad9c12d5
- source_ref: "AceDL 2026/10/16: private/hacker/hackit400uk.rom, read when PLUGIN_HACKER=1"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_2a4840 0x2a743d-0x2a74a5 (PLUGIN_HACKER into 0x50c40c), 0x2a74ae-0x2a7516 (PLUGIN_HACKERFR into 0x50c408), 0x2a769b-0x2a76a3, 0x2ac36c FUN_3adac0 (0x3adaf1 %sprivate/hacker/hackit400uk.rom when PLUGIN_HACKERFR=0, fopen rb 0x3adb1d, missing returns uninstalled 0x3adb28, fread 0x4000 0x3adb3e, short read clears PLUGIN_HACKER 0x3adb4b)"
note: >-
- HackIt 4.00 by Siren Software, English, UK flavour of the Hacker plugin.
+ HackIt 4.00 by Siren Software, English, read when PLUGIN_HACKERFR is 0.
+ Without it the plugin is not installed, a file shorter than 16 KB also
+ clears PLUGIN_HACKER.
- name: hacker481fr.rom
path: "private/hacker/hacker481fr.rom"
system: amstrad-cpc
required: false
bundled: true
- size: 16384
+ min_size: 16384
+ validation: [size]
md5: dfdd9924295f491d54f30569874287f8
sha1: 0c15d6753cf0ae2a1737b6e857e8e82ee135a697
- source_ref: "AceDL 2026/10/16: private/hacker/hacker481fr.rom, read when PLUGIN_HACKER=1 and PLUGIN_HACKERFR=1"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_2a4840 0x2a74ae-0x2a7516 (PLUGIN_HACKERFR into 0x50c408), 0x2a769b-0x2a76a3, 0x2ac36c FUN_3adac0 (0x3adafb-0x3adaff %sprivate/hacker/hacker481fr.rom when PLUGIN_HACKERFR=1, fopen rb 0x3adb1d, missing returns uninstalled 0x3adb28, fread 0x4000 0x3adb3e, short read clears PLUGIN_HACKER 0x3adb4b)"
note: >-
Le Hackeur 4.81, the French edition of the same Siren Software ROM,
- French flavour of the Hacker plugin.
+ read when PLUGIN_HACKERFR is 1. Without it the plugin is not
+ installed, a file shorter than 16 KB also clears PLUGIN_HACKER.
- name: ym2608_adpcm_rom.bin
path: "private/sounds/ym2608_adpcm_rom.bin"
@@ -304,9 +322,9 @@ files:
size: 8192
md5: 8740932cda05e518a9955f1d08d6786f
sha1: 50b6c3e288eaa12ad275d4f323267bb72b0445df
- source_ref: "AceDL 2026/10/16: private/sounds/ym2608_adpcm_rom.bin, read when PLUGIN_PLAY2CPC=1"
+ source_ref: "AceDL 2026/10/16 linux-x64 FUN_2a4840 0x2a7584-0x2a758c (PLUGIN_PLAY2CPC flag 0x50c46c), 0x2ac31a FUN_3a7820, 0x3a7849 FUN_3ae520, FUN_3ae340 (sprintf %sprivate/sounds/ym2608_adpcm_rom.bin 0x3ae3d1, fopen rb 0x3ae3f1, missing prints Warning not found 0x3ae4ed-0x3ae505 and continues, whole file read by ftell size 0x3ae402-0x3ae463); FUN_345230 0x345a29 (-plugin play2cpc)"
note: >-
YM2608 internal ADPCM rhythm ROM used by the Play2CPC cartridge sound.
Missing file prints "Warning: ym2608_adpcm_rom.bin not found!" and the
- plugin keeps running. Shipped in the Linux and Raspberry Pi packages,
- absent from the Windows package.
+ plugin keeps running. The whole file is read, its length is not
+ checked. Absent from the Windows x64 package.
diff --git a/emulators/advanced_drastic.yml b/emulators/advanced_drastic.yml
index 0122152f0..8c673f0ab 100644
--- a/emulators/advanced_drastic.yml
+++ b/emulators/advanced_drastic.yml
@@ -29,14 +29,16 @@ systems:
mode: standalone
notes: |
- trngaje's package around the closed-source 64-bit Linux DraStic, whose
- screen output, input and settings menu it replaces through a hooked SDL2
- build (trngaje/SDL_drastic) and the drastic_layout library. The repository
- carries the DraStic binary itself, md5 59a7711eff41c640b8861b4d869c747d,
- which announces "Version r2.5.2.0", together with its system, config,
- resources and microphone directories, game_database.xml and usrcheat.dat.
- launch.sh changes to its own directory and runs ./drastic on the content.
- ref: README.md:1-12, launch.sh:1-9, drastic r2.5.2.0 0x135990
+ trngaje's package around the closed-source 64-bit Linux DraStic. The
+ repository carries the DraStic binary itself, md5 59a7711eff41c640b8861b4d869c747d
+ (sha256 6e11511907f21888), stripped, which draws "Version r2.5.2.0" in its
+ menu, together with its system, config, resources and microphone
+ directories, game_database.xml and usrcheat.dat. launch.sh puts libs/ under
+ its own directory on LD_LIBRARY_PATH, changes to that directory and runs
+ ./drastic on the content, so that directory is the root every path below is
+ joined to.
+ ref: launch.sh:1-9,
+ drastic r2.5.2.0 FUN_93140 0x931b4-0x931cc (draws the version string)
KNULLI builds this revision, installs the whole tree under
/usr/share/advanced_drastic, copies it to
@@ -55,11 +57,20 @@ notes: |
system files." It carries neither the firmware editor's
nds_firmware_modified.bin nor game_database_user.xml. The root also serves
game_database.xml, usrcheat.dat, microphone/.wav then
- microphone/microphone.wav, drastic_dldi.img for homebrew and the
- drastic_logo_.raw splash.
- ref: drastic r2.5.2.0 0x131018-0x1310f8, drastic r2.5.2.0 0x12fa18,
- drastic r2.5.2.0 0x12fce0, drastic r2.5.2.0 0x132128-0x132260,
- drastic r2.5.2.0 0x132a90-0x132aa8, drastic r2.5.2.0 0x1359b8
+ microphone/microphone.wav, scripts/.lua then scripts/default.lua,
+ cheats/.cht, slot2/.gba, drastic_dldi.img for homebrew and the
+ drastic_logo_.raw splash. The functions are unnamed and are matched to
+ their r2.5.2.2 names by the strings and calls they share: FUN_fbd0 is
+ load_system_file, FUN_1e7e0 initialize_memory, FUN_10920 initialize_system,
+ FUN_84640 initialize_gamecard, FUN_86cf0 initialize_game_database, FUN_94650
+ load_cheat_directory, FUN_81720 reset_spu, FUN_839d0 load_nds, FUN_951e0
+ load_custom_cheats, FUN_82c50 gamecard_load_gba, FUN_82480
+ gamecard_initialize_homebrew and FUN_93360 load_logo.
+ ref: drastic r2.5.2.0 FUN_fbd0 0xfc18-0xfd04, drastic r2.5.2.0 FUN_1e7e0 0x1ed78-0x1ef6c,
+ drastic r2.5.2.0 FUN_10920 0x10ab8-0x10b84, drastic r2.5.2.0 FUN_84640 0x84678-0x846d0,
+ drastic r2.5.2.0 FUN_81720 0x819c8-0x81a78, drastic r2.5.2.0 FUN_839d0 0x83c30-0x83cd0,
+ drastic r2.5.2.0 FUN_951e0 0x952a4-0x952c4, drastic r2.5.2.0 FUN_82c50 0x82c98-0x82cdc,
+ drastic r2.5.2.0 FUN_82480 0x824f4-0x825ac, drastic r2.5.2.0 FUN_93360 0x933b8-0x93400
files:
- name: nds_bios_arm9.bin
@@ -73,7 +84,7 @@ files:
validation: [size]
description: "Nintendo DS ARM9 BIOS"
note: "First candidate for the ARM9 slot, before the free replacement. The hashes are those of the copy the repository ships."
- source_ref: "drastic r2.5.2.0 0x131018, drastic r2.5.2.0 0x12fa18, drastic r2.5.2.0 0x135a5a"
+ source_ref: "drastic r2.5.2.0 FUN_1e7e0 0x1ed78-0x1ed94 (FUN_fbd0 of nds_bios_arm9.bin for 0x1000 bytes, failure branches to 0x1eea4), FUN_fbd0 0xfc18-0xfca4 (sprintf %s%csystem%c%s, fopen rb, fseek and ftell length compared to the requested size, fread), 0xfcec-0xfd04 (wrong size message, returns -1), FUN_10920 0x10ab8-0x10b84 (a negative return from FUN_1e7e0 draws the missing BIOS screen through FUN_93ae0, prints FATAL: Could not load system files. and quits)"
- name: drastic_bios_arm9.bin
sha1: 4dc29a1560e1cbd7afef1998f7a6c25c5db1cc3a
@@ -85,7 +96,7 @@ files:
size: 4096
validation: [size]
description: "DraStic free ARM9 BIOS replacement"
- source_ref: "drastic r2.5.2.0 0x131070"
+ source_ref: "drastic r2.5.2.0 FUN_1e7e0 0x1eea4-0x1eec8 (logs Can't find Nintendo ARM9 BIOS, then FUN_fbd0 of drastic_bios_arm9.bin for 0x1000 bytes), 0x1eecc-0x1eeec (sets the free ARM9 bit), 0x1f160 (failure returns -1)"
- name: nds_bios_arm7.bin
path: system/nds_bios_arm7.bin
@@ -98,7 +109,7 @@ files:
validation: [size]
description: "Nintendo DS ARM7 BIOS"
note: "First candidate for the ARM7 slot. The hashes are those of the copy the repository ships."
- source_ref: "drastic r2.5.2.0 0x131088, drastic r2.5.2.0 0x135a7b"
+ source_ref: "drastic r2.5.2.0 FUN_1e7e0 0x1ed9c-0x1edb8 (FUN_fbd0 of nds_bios_arm7.bin for 0x4000 bytes, failure branches to 0x1eefc), 0x1eed8-0x1eef8 (same load on the path that took the free ARM9 image)"
- name: drastic_bios_arm7.bin
sha1: 31ae916c85d012582c7cdf47de6943ac6778253b
@@ -110,7 +121,7 @@ files:
size: 16384
validation: [size]
description: "DraStic free ARM7 BIOS replacement"
- source_ref: "drastic r2.5.2.0 0x1310e0"
+ source_ref: "drastic r2.5.2.0 FUN_1e7e0 0x1eefc-0x1ef20 (logs the fallback message, then FUN_fbd0 of drastic_bios_arm7.bin for 0x4000 bytes), 0x1f160 (failure returns -1)"
- name: nds_firmware.bin
path: system/nds_firmware.bin
@@ -124,7 +135,7 @@ files:
validation: [size]
description: "Nintendo DS firmware"
note: "The hashes are those of the copy the repository ships."
- source_ref: "drastic r2.5.2.0 0x1310f8"
+ source_ref: "drastic r2.5.2.0 FUN_1e7e0 0x1edc0-0x1eddc, 0x1ef30-0x1ef50 (FUN_fbd0 of nds_firmware.bin for 0x40000 bytes), 0x1ef54-0x1ef6c (on failure the region is zeroed and FUN_1e250 writes the firmware header, then the boot carries on)"
- name: game_database.xml
path: game_database.xml
@@ -135,7 +146,7 @@ files:
size: 1610336
sha1: 7b84fef16d1d461a49c197709d174eb1ccd8f88d
description: "save type database, one entry per title"
- source_ref: "drastic r2.5.2.0 0x132a90, drastic r2.5.2.0 0x133468"
+ source_ref: "drastic r2.5.2.0 FUN_84640 0x84678-0x846a0 (sprintf %s%cgame_database.xml, then FUN_86cf0), FUN_86cf0 0x86d18-0x86d30 (fopen rb), 0x87684-0x8769c (a failed open logs Error: could not load game database file and returns)"
- name: usrcheat.dat
path: usrcheat.dat
@@ -146,7 +157,7 @@ files:
size: 13739796
sha1: 6dd1a5399403f39620061556d61f5c6f6c704219
description: "Action Replay cheat library"
- source_ref: "drastic r2.5.2.0 0x132aa8"
+ source_ref: "drastic r2.5.2.0 FUN_84640 0x846a8-0x846d0 (sprintf %s%cusrcheat.dat, then FUN_94650), FUN_94650 0x94680-0x9468c (fopen rb), 0x946cc-0x94704 (header read, Invalid cheat database header and close on a mismatch)"
- name: microphone.wav
path: microphone/microphone.wav
@@ -158,4 +169,79 @@ files:
sha1: ea9281c65ea39c9d1061a05b8b15d9a44f92918e
description: "default fake microphone input"
note: "Played when the game asks for the microphone and no microphone/.wav exists."
- source_ref: "drastic r2.5.2.0 0x132128-0x132190"
+ source_ref: "drastic r2.5.2.0 FUN_81720 0x81a40-0x81a78 (sprintf %s%cmicrophone%cmicrophone.wav, FUN_7f220 loads it, Loaded default fake microphone audio file), FUN_7f220 0x7f250-0x7f28c (fopen rb, length by fseek and ftell)"
+
+ - name: ".wav"
+ path: "microphone/.wav"
+ system: nintendo-ds
+ required: false
+ category: game_data
+ description: "per-title fake microphone input"
+ note: "Tried before microphone.wav and named after the running title."
+ source_ref: "drastic r2.5.2.0 FUN_81720 0x819c8-0x81a0c (sprintf %s%cmicrophone%c%s.wav, FUN_7f220 loads it, Loaded game specific fake microphone audio file)"
+
+ - name: ".lua"
+ path: "scripts/.lua"
+ required: false
+ category: game_data
+ description: "per-title Lua script"
+ note: "Tried before default.lua and named after the running title."
+ source_ref: "drastic r2.5.2.0 FUN_839d0 0x83c30-0x83c8c (sprintf %s%c%s%c%s.%s with scripts and lua, Attempting to load lua script, FUN_99850), FUN_99850 0x99884 (luaL_loadfilex of the path), 0x998a4 (lua_pcallk)"
+
+ - name: default.lua
+ path: scripts/default.lua
+ required: false
+ category: game_data
+ unsourceable: "script the user writes against the built-in Lua 5.3 interpreter"
+ description: "fallback Lua script"
+ note: "Loaded when no per-title script answers."
+ source_ref: "drastic r2.5.2.0 FUN_839d0 0x83ca4-0x83cd8 (sprintf %s%c%s%cdefault.%s, then FUN_99850, which hands it to luaL_loadfilex at 0x99884)"
+
+ - name: ".cht"
+ path: "cheats/.cht"
+ system: nintendo-ds
+ required: false
+ category: game_data
+ description: "custom cheat file"
+ note: "Read on top of the entries usrcheat.dat holds and written back when a cheat is toggled. Absent, the message No custom cheat file is logged."
+ source_ref: "drastic r2.5.2.0 FUN_951e0 0x952a4-0x952e0 (sprintf %s%ccheats%c%s.cht, fopen rb, No custom cheat file at %s), FUN_957e0 0x95824-0x95850 (same path opened wb)"
+
+ - name: ".gba"
+ path: "slot2/.gba"
+ system: nintendo-ds
+ required: false
+ category: game_data
+ unsourceable: "Game Boy Advance cartridge the title reads for bonus content"
+ description: "slot 2 cartridge image"
+ note: "Loaded into the slot 2 cart window, with its save read from slot2/.sav beside it."
+ source_ref: "drastic r2.5.2.0 FUN_82c50 0x82c98-0x82cdc (snprintf %s%cslot2%c%s.gba, fopen rb), 0x82d08-0x82d6c (length by fseek and ftell, read whole), 0x82dd0-0x82dec (slot2/.sav opened rb)"
+
+ - name: drastic_dldi.img
+ path: drastic_dldi.img
+ system: nintendo-ds
+ required: false
+ category: game_data
+ unsourceable: "FAT image the user builds for the emulated flashcart"
+ description: "R4 flashcart disk image"
+ note: "Opened read-write when a homebrew title is recognised and mounted as the fat:/ device. Absent, the error is logged and the title runs without a card."
+ source_ref: "drastic r2.5.2.0 FUN_82480 0x824a4-0x824cc (Homebrew recognized), 0x824f4-0x82518 (sprintf %s%cdrastic_dldi.img, open O_RDWR), 0x825a4-0x825b0 (perror Couldn't load drastic_dldi.img, then carries on)"
+
+ - name: drastic_logo_0.raw
+ path: drastic_logo_0.raw
+ required: false
+ category: game_data
+ size: 120000
+ validation: [size]
+ description: "boot splash, first of two"
+ note: "Read from the root in one 120000 byte request, so a shorter file is rejected. The index is the low bit of the time and a missing file skips the splash. The repository ships neither."
+ source_ref: "drastic r2.5.2.0 FUN_93360 0x93398-0x933d8 (index time() & 1, sprintf %s%cdrastic_logo_%d.raw, fopen rb), 0x933e0-0x93410 (fread of 0x1d4c0 bytes as one item, buffer freed when the read falls short)"
+
+ - name: drastic_logo_1.raw
+ path: drastic_logo_1.raw
+ required: false
+ category: game_data
+ size: 120000
+ validation: [size]
+ description: "boot splash, second of two"
+ note: "Same read as index 0."
+ source_ref: "drastic r2.5.2.0 FUN_93360 0x93398-0x933d8, 0x933e0-0x93410"
diff --git a/emulators/arcadeflashweb.yml b/emulators/arcadeflashweb.yml
index db394d5ad..9c5477947 100644
--- a/emulators/arcadeflashweb.yml
+++ b/emulators/arcadeflashweb.yml
@@ -181,8 +181,9 @@ files:
bundled: true
description: "Adobe Flash Access blob shipped with the runtime"
note: >-
- Named in the Flash library's own string table next to PepperFlashPlayer.
+ The Flash library joins its own directory and pepper.vch and hands the
+ path, with the name PepperFlashPlayer, to its Flash Access DRM callback.
PKCS#7 over 446144 opaque bytes, signed through the Adobe Flash Access
chain under subject CN AdobeIV-202002031156. It carries DRM material and
no plain SWF needs it.
- source_ref: "ArcadeFlashWeb v1.0.2 pepflashplayer.dll string table"
+ source_ref: "pepflashplayer.dll 32.0.0.371 (ArcadeFlashWeb v1.0.2, sha256 2b37e916199e1ef8) 0x104777be-0x104777d5 (plugin directory path joined with pepper.vch at 0x104777cb), 0x10477ca5-0x10477d3d (callback 0x10477c85 returns that path and PepperFlashPlayer), 0x104772a9 (callback stored in the DRM host table)"
diff --git a/emulators/capriceforever.yml b/emulators/capriceforever.yml
index aa49293db..602f8b1b4 100644
--- a/emulators/capriceforever.yml
+++ b/emulators/capriceforever.yml
@@ -20,20 +20,40 @@ notes: |
Closed source Amstrad CPC and PLUS emulator for Windows. The build read here
is the one RetroBat installs, capriceforever.7z sha256
54c9f7f3df96011bdbd09e72413fed798a395c241e8c2d05eb6af075a15b79b4, release
- 26.4 of 1 April 2026 (History.txt, version resource 26.4.0.0). Caprice.exe
- md5 a33e841c80e9fd9067a1c373492cd53b is a 32-bit Delphi program, cited by
- file offset.
+ 26.4 (version resource 26.4.0.0). Caprice.exe
+ md5 a33e841c80e9fd9067a1c373492cd53b is a 32-bit C++Builder (RAD Studio
+ 28.0) VCL program, cited by virtual address. Functions are named by their
+ address, or by the published method table entry for form event handlers.
- The machine ROMs are compiled into the executable as named defaults. The
- 464, 664 and 6128 OS and BASIC, AMSDOS and the Multiface Two ROM sit in the
- data section byte for byte equal to the usual dumps (os464.rom at 0x7f5348,
- basic464.rom at 0x7f9348, os6128.rom at 0x80d348, basic6128.rom at 0x811348,
- os664.rom at 0x815348, basic664.rom at 0x819348, amsdos.rom at 0x7e1348,
- the first 8 KiB of MF2.rom at 0x821348). A slot left blank in a device file
- takes the built-in image, and the names "Default OS", "Default BASIC",
- "Default AMSDOS", "Default Multiface Two", "Default Silicon Disc 1.3" and
- "Default DK'Tronics Speech" select them explicitly.
- ref: Caprice.exe 0x75d82c, 0x7314ad, 0x75d864, 0x75d884, 0x75d8a0
+ The machine ROMs are RT_RCDATA resources of the executable. None of them
+ is read from disc, so none is a file entry below. Each resource, with the
+ sha1 of its bytes and the dump it equals:
+
+ ROMCPC464_UK 32 KiB 56d39c463da6 cpc464.rom, os464.rom + basic464.rom
+ ROMCPC664_UK 32 KiB 073a7665527b cpc664.rom, os664.rom + basic664.rom
+ ROMCPC6128_UK 32 KiB 5977adbad3f7 cpc6128.rom, os6128.rom + basic6128.rom
+ ROMCPC464_FR 32 KiB c68d84f37ab9 OS464_FR.rom of ACE-DL
+ ROMCPC6128_FR 32 KiB 200d59076dfe OS6128_FR.rom of ACE-DL, CPC6128.ROM.FR of CPCemu
+ ROMCPC6128_SP 32 KiB 1acd01c2c034 OS6128_S.rom of ACE-DL, CPC6128.ROM.ES of CPCemu
+ ROMCPC464_SP 32 KiB 6291af67cb34 Spanish 464, same BASIC half as ROMCPC464_FR
+ ROMAmsdos 16 KiB 39102c8e9cb5 amsdos.rom
+ ROMMultiface2 8 KiB 1431ec628d38 multiface2.rom of ACE-DL and CPCemu
+ ROMDKSpeech 16 KiB bf28e07d5fad dkspeech.rom of MAME
+ ROMSiliconDisk13 16 KiB 932bc3bbe38a no other profile lists it
+
+ A slot left blank in a device file takes the built-in image,
+ and the names "Default OS", "Default BASIC", "Default AMSDOS", "Default
+ Multiface Two", "Default Silicon Disc 1.3" and "Default DK'Tronics Speech"
+ select them explicitly.
+ ref: Caprice.exe 26.4.0.0 FUN_006fa870 0x6faff6-0x6fb036 (TResourceStream
+ of ROMCPC464_UK, type 0xa), 0x6fba6e-0x6fbaa9 (ROMAmsdos),
+ 0x6fc0fc-0x6fc109 (ROMSiliconDisk13), 0x6fc168-0x6fc18f (ROMDKSpeech),
+ FUN_006fd4c0 0x6feae9-0x6feb6a (LowerROM compared to Default OS),
+ 0x6fde23-0x6fde70 (Default Silicon Disc, DK'Tronics, Empty and
+ AMSDOS names taken for the upper slot loop), 0x6fe839-0x6fe8b7 and 0x6fef2f-0x6fef65
+ (Default Multiface Two, TResourceStream of ROMMultiface2),
+ FUN_0074ebe4 0x74f95c-0x74fab5 (Default OS, BASIC and AMSDOS as the
+ initial slot values)
RetroBat writes Device.ini on every launch: CPC_6128_UK, or PLUS_6128_UK for
the gx4000 system, LowerROM and UpperROM0 blank, UpperROM7 "Default
@@ -42,13 +62,24 @@ notes: |
nothing outside the program is read for a RetroBat launch.
ref: emulatorLauncher Generators/CapriceForever.Generator.cs:277-405
- Files in Roms\ (16512 bytes, a 128 byte AMSDOS header then the 16 KiB
- image) are offered by name for the lower and upper ROM slots, and .cpr
- files in Cartridges\ for the cartridge port. The package ships four ROMs
+ Files of 1 to 16512 bytes in RomsDirectory (Roms\ by default) are offered
+ by name for the lower and upper ROM slots. A slot file whose first 128
+ bytes are an AMSDOS header with a valid checksum is read from offset 128
+ for its declared length, at most 16 KiB, and any other file is used as is.
+ A missing file is skipped and nothing is copied into the slot. The cartridge is
+ chosen through an open dialog filtered on *.cpr, and a CartridgeFilename
+ without a directory is looked up in CartridgesDirectory (Cartridges\ by
+ default). A RIFF AMS! file is split by its cb chunks into 16 KiB banks,
+ any other file into consecutive 16 KiB banks. The package ships four ROMs
and three PLUS system cartridges there. Only the bundled device template
"PLUS 6128 UK.ini" names one of them (the UK cartridge), and RetroBat
replaces that choice with the launched game.
- ref: Caprice.exe 0x72fb01, 0x7332cb, 0x726d86
+ ref: Caprice.exe 26.4.0.0 FUN_0074ebe4 0x74f621 (Roms\ default),
+ FUN_0072483c 0x740f0f-0x740f35 (Roms\ when the configured folder is
+ missing), 0x73e0b5 (RomsDirectory key), 0x73e481 (CartridgesDirectory
+ key), FUN_0059fc34 0x5a0e55-0x5a0ef5 (size filter),
+ FUN_007000f8 0x7001e6-0x700274 (AMSDOS header),
+ FUN_0071c58c 0x71ca9d-0x71cb48 (cartridge parsing)
files:
- name: "Burnin' Rubber + BASIC (UK).cpr"
@@ -60,7 +91,7 @@ files:
sha1: "405e341437fab8db477606238af0c20eca2e39ee"
md5: "39b565e648172980aa552293e667070f"
description: "Amstrad PLUS system cartridge, English"
- source_ref: "Caprice.exe 0x7332cb, 0x726d86"
+ source_ref: "Caprice.exe 26.4.0.0 settings loader FUN_0072483c 0x73e829-0x73e858 (Roms section, CartridgeFilename key), FUN_006fd1a8 0x6fd1f1-0x6fd361 (a name without directory is prefixed with CartridgesDirectory), 0x6fd394 (cartridge loader called), FUN_0071c58c 0x71c956-0x71c9d0 (FileOpen, whole file read), 0x71ca9d-0x71cac5 (RIFF and AMS! test), 0x71cb85-0x71cc46 (cb chunks copied to 16 KiB banks), 0x71cacb-0x71cb48 (any other file split into 16 KiB banks), TFormEmulatorSettings.PanelButtonCartridgeFileClick 0x5aa26a-0x5aa2d1 (open dialog filtered on *.cpr)"
note: "Named by the bundled Settings/PLUS 6128 UK.ini template."
- name: "Burnin' Rubber + BASIC (FR).cpr"
@@ -72,7 +103,7 @@ files:
sha1: "958437ad6292ecd368e8c6c963cb3ae7d48b9406"
md5: "2adf22a2046a18bd39de90ad01c15998"
description: "Amstrad PLUS system cartridge, French"
- source_ref: "Caprice.exe 0x7332cb, 0x726d86"
+ source_ref: "Caprice.exe 26.4.0.0 settings loader FUN_0072483c 0x73e829-0x73e858 (Roms section, CartridgeFilename key), FUN_006fd1a8 0x6fd1f1-0x6fd361 (a name without directory is prefixed with CartridgesDirectory), 0x6fd394 (cartridge loader called), FUN_0071c58c 0x71c956-0x71c9d0 (FileOpen, whole file read), 0x71ca9d-0x71cac5 (RIFF and AMS! test), 0x71cb85-0x71cc46 (cb chunks copied to 16 KiB banks), 0x71cacb-0x71cb48 (any other file split into 16 KiB banks), TFormEmulatorSettings.PanelButtonCartridgeFileClick 0x5aa26a-0x5aa2d1 (open dialog filtered on *.cpr)"
- name: "Burnin' Rubber + BASIC (SP).cpr"
path: "Cartridges/Burnin' Rubber + BASIC (SP).cpr"
@@ -83,7 +114,7 @@ files:
sha1: "076939a2cd7593b5e56c775d7a4752f2d138ff6c"
md5: "75632137fcbe51eaec1f47a22e55d6a3"
description: "Amstrad PLUS system cartridge, Spanish"
- source_ref: "Caprice.exe 0x7332cb, 0x726d86"
+ source_ref: "Caprice.exe 26.4.0.0 settings loader FUN_0072483c 0x73e829-0x73e858 (Roms section, CartridgeFilename key), FUN_006fd1a8 0x6fd1f1-0x6fd361 (a name without directory is prefixed with CartridgesDirectory), 0x6fd394 (cartridge loader called), FUN_0071c58c 0x71c956-0x71c9d0 (FileOpen, whole file read), 0x71ca9d-0x71cac5 (RIFF and AMS! test), 0x71cb85-0x71cc46 (cb chunks copied to 16 KiB banks), 0x71cacb-0x71cb48 (any other file split into 16 KiB banks), TFormEmulatorSettings.PanelButtonCartridgeFileClick 0x5aa26a-0x5aa2d1 (open dialog filtered on *.cpr)"
- name: "albireo.rom"
path: "Roms/albireo.rom"
@@ -94,7 +125,7 @@ files:
sha1: "9dd652574638682876a55febe3dca7b5bb3ad222"
md5: "9afe71e4c38040864576358a71474ab6"
description: "Albireo ROM (AMSDOS header, title ALBIREO ROM)"
- source_ref: "Caprice.exe 0x72fb01, 0x720ff1"
+ source_ref: "Caprice.exe 26.4.0.0 TFormEmulatorSettings.StringGridROMMappingSelectCell 0x5a386b (list builder FUN_0059fc34 called), FUN_0059fc34 0x5a08ab-0x5a0916 (FindFirst of RomsDirectory plus *.*), 0x5a0e55-0x5a0ef5 (FileOpen, FileSeek to the end, files of 1 to 16512 bytes added to ComboBoxAvailableROM), FUN_006fd4c0 0x6feae9-0x6febfa (LowerROM other than Default OS prefixed with RomsDirectory and loaded), 0x6fe3a7-0x6fe47b (UpperROM name prefixed with RomsDirectory, loaded, 0x4000 bytes copied to the bank), FUN_007000f8 0x700140-0x7001de (FileExists, FileOpen, whole file read), 0x7001e6-0x700274 (AMSDOS header: sum of bytes 0 to 0x42 against the word at 0x43, length at 0x40 capped at 0x4000, image taken from offset 0x80, any other file used as is)"
- name: "unidos.rom"
path: "Roms/unidos.rom"
@@ -105,7 +136,7 @@ files:
sha1: "e78a94ab8de917270179b80b071d3e90d98ea5dc"
md5: "a9d1b46e49701c85d9a3a66ff725c6e6"
description: "UniDOS ROM"
- source_ref: "Caprice.exe 0x72fb01, 0x720ff1"
+ source_ref: "Caprice.exe 26.4.0.0 TFormEmulatorSettings.StringGridROMMappingSelectCell 0x5a386b (list builder FUN_0059fc34 called), FUN_0059fc34 0x5a08ab-0x5a0916 (FindFirst of RomsDirectory plus *.*), 0x5a0e55-0x5a0ef5 (FileOpen, FileSeek to the end, files of 1 to 16512 bytes added to ComboBoxAvailableROM), FUN_006fd4c0 0x6feae9-0x6febfa (LowerROM other than Default OS prefixed with RomsDirectory and loaded), 0x6fe3a7-0x6fe47b (UpperROM name prefixed with RomsDirectory, loaded, 0x4000 bytes copied to the bank), FUN_007000f8 0x700140-0x7001de (FileExists, FileOpen, whole file read), 0x7001e6-0x700274 (AMSDOS header: sum of bytes 0 to 0x42 against the word at 0x43, length at 0x40 capped at 0x4000, image taken from offset 0x80, any other file used as is)"
- name: "unitools.rom"
path: "Roms/unitools.rom"
@@ -116,7 +147,7 @@ files:
sha1: "982e523b2d5b5c9873526a7363fcac4cbc1b6dfd"
md5: "83c6ecbf655b8f3c65e46a46c6bc7161"
description: "UniTools ROM for UniDOS"
- source_ref: "Caprice.exe 0x72fb01, 0x720ff1"
+ source_ref: "Caprice.exe 26.4.0.0 TFormEmulatorSettings.StringGridROMMappingSelectCell 0x5a386b (list builder FUN_0059fc34 called), FUN_0059fc34 0x5a08ab-0x5a0916 (FindFirst of RomsDirectory plus *.*), 0x5a0e55-0x5a0ef5 (FileOpen, FileSeek to the end, files of 1 to 16512 bytes added to ComboBoxAvailableROM), FUN_006fd4c0 0x6feae9-0x6febfa (LowerROM other than Default OS prefixed with RomsDirectory and loaded), 0x6fe3a7-0x6fe47b (UpperROM name prefixed with RomsDirectory, loaded, 0x4000 bytes copied to the bank), FUN_007000f8 0x700140-0x7001de (FileExists, FileOpen, whole file read), 0x7001e6-0x700274 (AMSDOS header: sum of bytes 0 to 0x42 against the word at 0x43, length at 0x40 capped at 0x4000, image taken from offset 0x80, any other file used as is)"
- name: "fw-v3-u5.rom"
path: "Roms/fw-v3-u5.rom"
@@ -127,4 +158,4 @@ files:
sha1: "bb9b4c487fa6e338d6b8f78b6fc10a3912263e22"
md5: "96c5c16e8db2f5c7d6c3c160d686725a"
description: "Firmware V3-U5 ROM (AMSDOS header title V3-U5 ROM)"
- source_ref: "Caprice.exe 0x72fb01, 0x720fd8"
+ source_ref: "Caprice.exe 26.4.0.0 TFormEmulatorSettings.StringGridROMMappingSelectCell 0x5a386b (list builder FUN_0059fc34 called), FUN_0059fc34 0x5a08ab-0x5a0916 (FindFirst of RomsDirectory plus *.*), 0x5a0e55-0x5a0ef5 (FileOpen, FileSeek to the end, files of 1 to 16512 bytes added to ComboBoxAvailableROM), FUN_006fd4c0 0x6feae9-0x6febfa (LowerROM other than Default OS prefixed with RomsDirectory and loaded), 0x6fe3a7-0x6fe47b (UpperROM name prefixed with RomsDirectory, loaded, 0x4000 bytes copied to the bank), FUN_007000f8 0x700140-0x7001de (FileExists, FileOpen, whole file read), 0x7001e6-0x700274 (AMSDOS header: sum of bytes 0 to 0x42 against the word at 0x43, length at 0x40 capped at 0x4000, image taken from offset 0x80, any other file used as is)"
diff --git a/emulators/chihiro-ds.yml b/emulators/chihiro-ds.yml
index 138ffa88a..4ea1f9a9b 100644
--- a/emulators/chihiro-ds.yml
+++ b/emulators/chihiro-ds.yml
@@ -29,7 +29,10 @@ notes: |
binaries carry "Chihiro-DS 1.0 (Mar 14 2025)". cxbxr-ldr.exe md5
d3675f7bb270072f33d9106497dd9bbc is the print DemulShooter lists for
"Chihiro-DS 1.0". cxbxr-emu.dll (md5 62f492f14b2af4bef7329ef269355a78) is
- cited by virtual address.
+ cited by virtual address. The package ships its cxbxr-emu.pdb (GUID
+ 7511A6DE-EA63-4F50-9FB8-AC9B37A49568, age 2, the values the DLL's debug
+ directory names), which gives the function names below. cxbx.exe is md5
+ 7f59a0156a426fd4dfec6ee4e556648c with its matching cxbx.pdb.
ref: emulatorLauncher Generators/Cxbx.Generator.cs:104-110, 202-214,
emulatorLauncher Installer.cs:46
@@ -46,17 +49,26 @@ notes: |
EmuDisk\Chihiro (this build predates the EmuMediaBoard folder).
ref: CI-6f32d89 src/common/Settings.cpp:880-915,
CI-6f32d89 src/common/FilePaths.cpp:82-109,
- cxbxr-emu.dll 0x1061c648
+ cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) CxbxrInitFilePaths 0x100cde5d-0x100cdf57 (data path
+ plus EmuDisk, filesystem::exists, created when absent),
+ JVS_Init 0x102c128a (data path plus EmuDisk Chihiro folder)
A title is Chihiro when its XBE type says so or a boot.id sits beside it.
- Launched directly, such a title needs the media board ROM: a missing file,
- an unreadable one or one that is not 2 MB ends the run. When either SEGABOOT
+ Launched directly with a boot.id beside its XBE, a title needs the media
+ board ROM: a missing file, an unreadable one or one that is not 2 MB ends
+ the run. When either SEGABOOT
file is missing both are rewritten from the two 1 MB halves of the ROM, then
SEGABOOT_MBROM1.XBE is launched and boots the title. boot.id is read again by
the media board for the region flags, and its absence ends the run.
ref: CI-6f32d89 src/core/kernel/init/CxbxKrnl.cpp:517-586,
CI-6f32d89 src/devices/chihiro/MediaBoard.cpp:46-57,
- cxbxr-emu.dll 0x10623190, 0x1062b60c, 0x1062b618
+ cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) CxbxrKrnlXbeSystemSelector 0x103e0fe9-0x103e105b (boot
+ flags zero and boot.id beside the XBE), 0x103e178f-0x103e1855 (XbeType
+ gives system 2, 4 or 8, filesystem::exists of xbeDirectory / boot.id
+ sets 8), 0x103e14c6-0x103e14cc
+ (CxbxLaunchNewXbe of SEGABOOT_MBROM1.XBE), MediaBoard::SetMountPath
+ 0x1041a468-0x1041a490 (fopen of the title path plus /boot.id),
+ 0x1041a56d (CxbxrAbortEx Could not open Chihiro boot.id)
The four JVS base board images are memory mapped read/write when the
system is Chihiro. Byte 0x1F00 of the QC firmware holds the board region and
@@ -64,7 +76,11 @@ notes: |
copy the package ships differs from the dump by that byte.
ref: CI-6f32d89 src/core/hle/JVS/JVS.cpp:127-142,
CI-6f32d89 src/core/hle/JVS/JVS.cpp:169-210,
- CI-6f32d89 src/core/hle/JVS/JVS.cpp:246-262
+ CI-6f32d89 src/core/hle/JVS/JVS.cpp:246-262,
+ cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) CxbxrKrnlInit 0x103e44cf-0x103e44d8 (JVS_Init called
+ when g_bIsChihiro is set), JVS_Init 0x102c2049-0x102c2081 (byte
+ 0x1F00 of the QC firmware tested against the boot.id region flags,
+ set to 2, 3 or 1)
The package ships every file below except xboxdash.xbe and keys.bin. It
also carries chihiro_xbox_bios.bin, ver1305.bin, 315-6215.bin,
@@ -88,7 +104,7 @@ files:
started, each failure ending the run. Read to write out the two SEGABOOT
files when either is missing, and launched when a Chihiro title reboots
with an empty launch path.
- source_ref: "cxbxr-emu.dll 0x10624bb4, 0x10623190"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) CxbxrKrnlXbeSystemSelector 0x103e10bb-0x103e1139 (data path plus EmuDisk and MediaBoardRomFile, filesystem::exists), 0x103e1168-0x103e116f (CxbxrAbortEx could not be found), 0x103e1174-0x103e119e (fopen rb, abort on failure), 0x103e11ab-0x103e11da (fseek and ftell, abort unless 0x200000), HalReturnToFirmware 0x1030f09d-0x1030f0d7 (empty launch path with g_bIsChihiro set: Device prefix plus MediaBoardRomFile), 0x1030f15b (CxbxLaunchNewXbe)"
- name: SEGABOOT_MBROM0.XBE
path: "EmuDisk/Chihiro/SEGABOOT_MBROM0.XBE"
@@ -103,7 +119,7 @@ files:
Mounted as the mbrom0 device. Written from the first megabyte of the media
board ROM when either SEGABOOT file is missing. The copy the package ships
is that first megabyte.
- source_ref: "cxbxr-emu.dll 0x10624b98"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) dynamic initializer for MediaBoardSegaBoot0 0x100c2457-0x100c246a, CxbxrKrnlXbeSystemSelector 0x103e11f0-0x103e122f (data path plus EmuDisk), 0x103e12ab-0x103e12cd (filesystem::exists, a miss starts the rewrite), 0x103e1363-0x103e137d (fopen wb), 0x103e13d8-0x103e13ff (fread then fwrite of the first 0x100000 bytes of the ROM), CxbxConvertFilePath 0x10408bdc-0x10408be1 (mbrom0 device mapped to this file)"
- name: SEGABOOT_MBROM1.XBE
path: "EmuDisk/Chihiro/SEGABOOT_MBROM1.XBE"
@@ -120,7 +136,7 @@ files:
SEGABOOT file is missing. The copy the package ships is not that half: it
differs in 661005 bytes from the second megabyte of the ROM beside it.
Hashes are those of the shipped copy.
- source_ref: "cxbxr-emu.dll 0x10624b7c"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) dynamic initializer for MediaBoardSegaBoot1 0x100c24b7-0x100c24ca, CxbxrKrnlXbeSystemSelector 0x103e1246-0x103e1285 (data path plus EmuDisk), 0x103e12de-0x103e12f9 (filesystem::exists), 0x103e1380-0x103e139a (fopen wb), 0x103e1408-0x103e142f (fread then fwrite of the second 0x100000 bytes), 0x103e14c6-0x103e14cc (CxbxLaunchNewXbe), CxbxConvertFilePath 0x10408cc7-0x10408ccc (mbrom1 device mapped to this file)"
- name: ic10_g24lc64.bin
path: "EmuDisk/Chihiro/ic10_g24lc64.bin"
@@ -136,7 +152,7 @@ files:
opened. Byte 0x1F00 is dereferenced right after and rewritten to USA,
export or Japan when the title's boot.id rejects the stored region.
Hashes are those of the copy the package ships.
- source_ref: "cxbxr-emu.dll 0x1061c648, 0x1061c620"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) JVS_Init 0x102c135d (name), 0x102c1576 (JVS_LoadFile), 0x102c15fa-0x102c15fe and 0x102c22a4-0x102c22b7 (CxbxrAbortEx Failed to load base board firmware), 0x102c2049-0x102c2081 (byte 0x1F00 read and rewritten), JVS_LoadFile 0x102c0ddd-0x102c0de7 (fopen rb), 0x102c0e14 (mio::make_mmap_sink, read/write mapping)"
- name: pc20_g24lc64.bin
path: "EmuDisk/Chihiro/pc20_g24lc64.bin"
@@ -147,7 +163,7 @@ files:
md5: "bf1cf24f8549137c0b1ad0fa61473c7e"
description: "Base board SC microcontroller firmware"
note: "Memory mapped read/write at JVS setup, the run ends when it cannot be opened."
- source_ref: "cxbxr-emu.dll 0x1061c648, 0x1061c634"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) JVS_Init 0x102c13ae (name), 0x102c1706 (JVS_LoadFile), 0x102c178a-0x102c178e and 0x102c22c1-0x102c22d4 (CxbxrAbortEx Failed to load base board qc firmware), JVS_LoadFile 0x102c0ddd-0x102c0de7 (fopen rb), 0x102c0e14 (mio::make_mmap_sink, read/write mapping)"
- name: ic11_24lc024.bin
path: "EmuDisk/Chihiro/ic11_24lc024.bin"
@@ -160,7 +176,7 @@ files:
note: >-
Memory mapped read/write at JVS setup, the run ends when it cannot be
opened. Writes from JvsEEPROM_Write are synced to disk at once.
- source_ref: "cxbxr-emu.dll 0x1061c648, 0x1061c688"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) JVS_Init 0x102c13ff (name), 0x102c189b (JVS_LoadFile), 0x102c191f-0x102c1923 and 0x102c22de-0x102c22f1 (CxbxrAbortEx Failed to load base board EEPROM), JVS_LoadFile 0x102c0ddd-0x102c0de7 (fopen rb), 0x102c0e14 (mio::make_mmap_sink, read/write mapping), EmuPatch_JvsEEPROM_Write 0x102c6275-0x102c629d (FlushViewOfFile and FlushFileBuffers after each write)"
- name: backup_ram.bin
path: "EmuDisk/Chihiro/backup_ram.bin"
@@ -172,7 +188,7 @@ files:
has_builtin: true
size_note: "Created as 128 KB of zeros when absent, then memory mapped"
description: "Base board backup memory"
- source_ref: "cxbxr-emu.dll 0x1061c648, 0x1061c69c"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) JVS_Init 0x102c1439 (name), 0x102c1a1b (filesystem::exists), 0x102c1bee (fopen w when absent), 0x102c1ca4-0x102c1cbc (fseek 0x1ffff, fputc 0, fclose: a 128 KB file), 0x102c2300-0x102c2310 (CxbxrAbortEx Could not create Backup File), 0x102c1dba (JVS_LoadFile), 0x102c1e3e-0x102c1e42 and 0x102c231a-0x102c232a (CxbxrAbortEx Failed to load base board BACKUP RAM)"
- name: xboxdash.xbe
path: "EmuDisk/Partition2/xboxdash.xbe"
@@ -183,7 +199,7 @@ files:
Launched when an Xbox title reboots with an empty launch path and by the
Open Dashboard menu entry. When it is missing the console's unrecoverable
error screen is shown.
- source_ref: "cxbxr-emu.dll 0x105f8c60"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) HalReturnToFirmware 0x1030f091-0x1030f103 (empty launch path with g_bIsChihiro clear: partition 2 path plus xboxdash.xbe), 0x1030f15b (CxbxLaunchNewXbe), Xbe::Xbe 0x1014d48a-0x1014d492 (fopen rb), 0x1014d5b4-0x1014d641 (on failure the file name is compared to xboxdash.xbe), 0x1014d6f2 (CxbxKrnlPrintUEM), and cxbx.exe Chihiro-DS 1.0 WndMain::OpenDashboard 0x4300fc (data location plus EmuDisk Partition2 xboxdash.xbe)"
- name: EEPROM.bin
path: "EEPROM.bin"
@@ -194,14 +210,14 @@ files:
md5: "6d497abbfb773a2e07f8ab71f2a2999d"
has_builtin: true
size: 256
- validation: [size]
description: "Xbox EEPROM image"
note: >-
Opened at startup and mapped read/write, created with defaults when
- absent, and a file that is not 256 bytes ends the run. Hashes are those of
- the copy the package ships. RetroBat writes the language into it only for
- the xbox system.
- source_ref: "cxbxr-emu.dll 0x105f6084, 0x105f5d84"
+ absent. The file is cut or extended to 256 bytes before its size is read,
+ so the 256 byte check ends the run only when that resize fails. Hashes
+ are those of the copy the package ships. RetroBat writes the language
+ into it only for the xbox system.
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) CxbxrInitFilePaths 0x100ce4c4-0x100ce4f2 (snprintf of the data path and EEPROM.bin), CxbxKrnlEmulate 0x103e2b7c-0x103e2b81 (CxbxRestoreEEPROM), CxbxRestoreEEPROM 0x100c565b-0x100c5695 (CreateFileA OPEN_EXISTING, then OPEN_ALWAYS when absent), 0x100c56bb-0x100c56cc (SetFilePointer 0x100 and SetEndOfFile), 0x100c5704-0x100c5718 and 0x100c586f-0x100c587b (GetFileSizeEx, CxbxrAbortEx unless 0x100), 0x100c572a (MapViewOfFile read/write), 0x100c576e-0x100c5777 (EmuEEPROMReset for a new file), 0x100c5821 (checksum mismatch warning)"
- name: keys.bin
path: "keys.bin"
@@ -211,7 +227,7 @@ files:
validation: [size]
description: "Xbox EEPROM and certificate keys"
note: "Two 16 byte keys, the EEPROM key then the certificate key. Any other length is refused with a warning."
- source_ref: "cxbxr-emu.dll 0x105f6094, 0x105f60a4"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) CxbxKrnlEmulate 0x103e2b77 (LoadXboxKeys), LoadXboxKeys 0x100ce5a7-0x100ce5d2 (data path plus keys.bin, fopen rb), 0x100ce5e7-0x100ce600 (fseek, ftell, size compared to 0x20), 0x100ce60f (fread of the two keys), 0x100ce63c-0x100ce645 (warning on any other size), 0x100ce659-0x100ce662 (warning when absent)"
- name: wm2_loader.dll
path: "wm2_loader.dll"
@@ -224,7 +240,7 @@ files:
Loaded with LoadLibraryW("./wm2_loader.dll") just before the XBE entry
point is called, on every launch. A failure logs a warning and the title
starts anyway.
- source_ref: "cxbxr-emu.dll 0x103e0260, 0x10622b38"
+ source_ref: "cxbxr-emu.dll Chihiro-DS 1.0 (Mar 14 2025) CxbxLaunchXbe 0x103e0272-0x103e0277 (LoadLibraryW of ./wm2_loader.dll), 0x103e027d-0x103e0288 (warning on failure), 0x103e029c (XBE entry point called)"
exclusion_note: >
ntdll.dll and the XInput libraries tried in turn (xinput1_4, xinput1_3,
diff --git a/emulators/cpcemu.yml b/emulators/cpcemu.yml
index d98a99f02..8ca87824b 100644
--- a/emulators/cpcemu.yml
+++ b/emulators/cpcemu.yml
@@ -6,7 +6,7 @@ upstream: "https://www.cpc-emu.org/"
version_source:
url: "https://www.cpc-emu.org/"
pattern: 'CPCemu (\d+(?:\.\d+)+) released'
-profiled_date: "2026-08-08"
+profiled_date: "2026-11-10"
core_version: "3.0.2"
version_basis:
kind: package
@@ -26,71 +26,64 @@ notes: |
6128. The firmware identifier and the message catalogue also know the 464+,
the 6128+ and the KC compact.
- Two packages were used. The 3.0.2 Windows portable and macOS builds of
- 2025-04-24 carry the same fourteen ROM files and the same data files, and
- provide the path constants, the message catalogue and the v3.0 help file. The
- 2.5 Linux x86-64 build of 2022-08-13 is still the newest Linux release, the
- 3.0.2 Linux archives listed on the download page being absent from the
- server, and provides the runtime behaviour:
- file opens traced with strace, required and optional decided by removing,
- truncating and patching each file and reading the emulator's own messages.
+ Reversed from cpcemu_portable.exe of the 3.0.2 Windows portable package of
+ 2025-04-24 (zip sha256 fa2cde7da210b0db, exe sha256 3560e3a9c52095f1, Borland
+ C++ PE32). Addresses below are virtual addresses in that executable. The 3.0.2
+ Linux archives listed on the download page are absent from the server. The
+ 2.5 Linux x86-64 package of 2022-08-13 ships the same ROM folder without
+ XDDOS210.ROM, and its binary has no National ROM selection.
- ROMs live in ROM_PATH, "./ROM/" in the shipped configuration, resolved against
- the working directory, while the macOS build reads them from the application bundle
- Resources folder. Slots are filled by ROM_BLOCK lines naming a ROM number, a
- file in ROM_PATH and a 16 KB block position inside that file:
+ Configuration comes from a file given on the command line, then the
+ cpcemu.cfg path assembled at 0x570a8c (FUN_00481bcc 0x481c96-0x481ca5) when
+ it exists, then the built-in name cpcemu0.cfg (pointer 0x570a84) in the
+ working directory, chosen at FUN_00481bcc 0x481d7a-0x481da2 and parsed by
+ FUN_00466680. ROM_PATH ("./ROM/" in the shipped cpcemu0.cfg) is stored by
+ FUN_00441008, which appends a backslash when the value does not end in one.
+ Each ROM_BLOCK line (FUN_004665d0: ROM number, file name, 16 KB block number)
+ becomes a node of the list at 0x5151a0. #IFCPC blocks are kept only when
+ their number equals the CPC type at 0x564590, set by -t or CPC_TYPE. The
+ shipped cpcemu0.cfg names CPC464.ROM for types 0 and 3, CPC664.ROM for type
+ 1, CPC6128.ROM for types 2, 4 and 5 (ROM 255 block 0, ROM 0 block 1),
+ CPCADOS.ROM as ROM 7 for every type, and M4.ROM as ROM 6 outside any #IFCPC.
- ROM_BLOCK = 255, "CPC6128.ROM", 0 lower ROM
- ROM_BLOCK = 0 , "CPC6128.ROM", 1 foreground ROM
- ROM_BLOCK = 7 , "CPCADOS.ROM", 0 AMSDOS
- ROM_BLOCK = 6 , "M4.ROM" , 0 M4 board
+ FUN_004407d0 loads every listed ROM from slot 0 to 255: ROM_PATH + file name,
+ an AMSDOS header skipped when its checksum matches (FUN_004721e4), a seek to
+ block * 0x4000 and a read of 0x4000 bytes with no length check
+ (FUN_0040a59c). A file that cannot be opened prints message 0xb8 "ROM: Cannot
+ open file" and counts one error. FUN_0046ac64 returns the count plus 2, and
+ FUN_00481bcc shows "CPCemu Error" and ends with that status for any value of
+ 3 or more, so a single missing file named by a ROM_BLOCK line stops startup
+ with status 3, whatever the slot and whatever device it serves.
- The shipped cpcemu0.cfg repeats the first three for every CPC_TYPE from 0 to
- 5, with CPC464.ROM for types 0 and 3, CPC664.ROM for type 1 and CPC6128.ROM
- for types 2, 4 and 5, and adds the M4 line once for all types. A file named by
- a ROM_BLOCK line that cannot be opened prints "ROM: Cannot open file" and ends
- the process with status 3 before audio initialisation, whichever slot it fills
- and whether or not the matching device is enabled. Deleting the line instead
- lets the emulator start.
+ The machine is identified from ROM 0 by FUN_00440bfc: byte 0 has to be 0x80
+ (else "ROM: No foreground ROM found.") and byte 2 selects 464 (0), 664 (1),
+ 6128 (2) or 6128+ (4), anything else giving "ROM: Unknown ROM version.". A
+ 6128 whose lower ROM has 0x21 at offset 0x5a1 is reported as a KC compact.
+ Without an identified machine startup ends on "CPC type not configured or
+ ROM for CPC type not available. Unable to continue." ROM 7 is accepted as
+ AMSDOS when its header is 01 00 05 or 01 00 07 (FUN_00440cc4), otherwise "ROM:
+ No AMSDOS ROM found." and disc support stays off. Types 3, 4 and 5 have no
+ dedicated ROM files: the shipped configuration loads the 464 and 6128 files
+ for them. There is no cartridge support.
- The machine is identified from the foreground ROM, not from the lower half and
- not from CPC_TYPE. CPCemu reads the four-byte CPC ROM header at the start of
- block 1: byte 0 has to be 0x80, and byte 2 selects the machine, 0x00 for the
- 464, 0x01 for the 664, 0x02 for the 6128. A random block 1 gives "ROM: No
- foreground ROM found.", an unlisted version byte gives "ROM: Unknown ROM
- version.", and both end on "CPC type not configured or ROM for CPC type not
- available. Unable to continue." The modification byte is ignored, the lower
- 16 KB half is never inspected, and padding past 32768 bytes is accepted, so
- the length requirement is a lower bound: a block 1 has to exist.
+ The M4 board is set up at every startup by FUN_0044c6c4, called from
+ FUN_0046ac64 0x46ae76 without reading M4_ENABLED (0x516cd0). It looks for the
+ ROM_BLOCK entry whose file name is exactly "M4.ROM" and checks the ROM's name
+ table for "M4 BOARD". It then reads M4_SD_PATH + /NMIROM.BIN, and only when
+ that file is absent, ROM_PATH + /HACK.ROM, 0x4000 bytes each. The M4 firmware
+ updater (routine at 0x449c1c) downloads cpc/M4FIRM.BIN from spinpoint.org and
+ rewrites ROM_PATH + /M4.ROM and /HACK.ROM, 0x4000 bytes each.
- Types 3, 4 and 5 need ROM images the packages do not carry. The help file
- states they have to be supplied in CPCEMU.CFG first, and no filename for them
- is compiled into the binary, the user names the file in the ROM_BLOCK line.
- Left on the shipped configuration those types load the 464 and 6128 files and
- report the machine those files describe. There is no cartridge support, the
- file types handled on the command line are dsk, sna, cfg and zip.
-
- M4 board emulation is on by default. HACK.ROM, the board's lower ROM, is
- opened at every startup whatever M4_ENABLED holds, after M4_SD_PATH +
- NMIROM.BIN has been tried, so a NMIROM.BIN placed on the emulated SD card
- replaces it. With neither present the emulator prints "Unable to load
- HACK.ROM" and keeps running. M4.ROM contents are checked, a zeroed file boots
- the CPC and reports "M4 ROM not valid." The firmware updater downloads
- M4FIRM.BIN from spinpoint.org and rewrites M4.ROM and HACK.ROM in place.
-
- Alongside the ROMs the binary reads its own payload from the program
- directory. cpcemu.msg is the message catalogue, and its absence leaves every
- message unprinted. cpcemu.dat holds colours and key tables, cpcemu.hlp is the
- online help opened on F1, cpcemu.dbf is the poke database opened from the poke
- menu, and cpcemu0.cfg is the template used when no user configuration exists.
- Configuration is looked up first in the user profile, ~/.CPCemu/cpcemu.cfg on
- Linux, then cpcemu0.cfg in the working directory. With neither, startup stops
- on "CPCEMU: Use INSTALL first". The disc, tape and snapshot folders and the
- M4 SD card folder hold user content.
+ Alongside the ROMs the program reads the message catalogue cpcemu.msg (name
+ passed at FUN_00481bcc 0x481c86) and the colour and key tables cpcemu.dat
+ (built-in name at 0x570a88, passed to FUN_0045f734 at FUN_00481bcc 0x481dd9). The help file and the
+ poke database are named only by the HELP_FILE and POKE_DATABASE lines of
+ cpcemu0.cfg, "./cpcemu.hlp" and "./cpcemu.dbf". The disc, tape and snapshot folders and the M4 SD card folder hold
+ user content.
files:
- # The 3.0.2 Windows, macOS and Android packages ship every ROM below in ROM/
- # (assets/DATA/ROM/ in the APK). The 2.5 Linux archive ships all but XDDOS210.ROM.
+ # The 3.0.2 Windows package ships every ROM below in ROM/. The 2.5 Linux
+ # package ships all but XDDOS210.ROM.
# -- Firmware, lower ROM in block 0 and foreground ROM in block 1 --
- name: CPC6128.ROM
path: "ROM/CPC6128.ROM"
@@ -98,13 +91,14 @@ files:
required: true
bundled: true
min_size: 32768
- validation: [size, signature]
+ validation: [signature]
md5: b96280dc6c95a48857b4b8eb931533ae
sha1: 5977adbad3f7c1e0e082cd02fe76a700d9860c30
- source_ref: "CPCemu 2.5/3.0.2: ROM/CPC6128.ROM, cpcemu0.cfg ROM_BLOCK 255 and 0 for CPC_TYPE 2, 4 and 5"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_004407d0 0x440848-0x4408b6 (ROM_PATH + ROM_BLOCK file name per slot, ifstream open), 0x4408d1-0x44093f (open failure: message 0xb8, error count), 0x440959-0x440976 (seek block * 0x4000, FUN_0040a59c reads 0x4000, no length check), FUN_0046ac64 0x46ae22-0x46ae2d and FUN_00481bcc 0x481efa-0x481f54 (count + 2 >= 3 ends startup), FUN_00440bfc 0x440c03-0x440c47 (ROM 0 byte 0 = 0x80, byte 2 = machine), cpcemu0.cfg ROM_BLOCK 255 and 0 under #IFCPC 2, 4 and 5, kept by FUN_00466680 0x466871-0x466879"
note: >-
- CPC 6128 firmware and BASIC. Loaded for the shipped CPC_TYPE 2 and opened
- twice, once per block. Foreground ROM header 80 01 02 00.
+ CPC 6128 firmware and BASIC, lower ROM in block 0 and foreground ROM in
+ block 1, opened once per block. Loaded for the shipped CPC_TYPE 2 and
+ for types 4 and 5. Foreground ROM header 80 01 02 00.
- name: CPC464.ROM
path: "ROM/CPC464.ROM"
@@ -112,13 +106,13 @@ files:
required: false
bundled: true
min_size: 32768
- validation: [size, signature]
+ validation: [signature]
md5: a993f85b88ac4350cf4d41554e87fe4f
sha1: 56d39c463da60968d93e58b4ba0e675829412a20
- source_ref: "CPCemu 2.5/3.0.2: ROM/CPC464.ROM, cpcemu0.cfg ROM_BLOCK 255 and 0 for CPC_TYPE 0 and 3"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_004407d0 0x440848-0x4408b6 (ROM_PATH + ROM_BLOCK file name, ifstream open), 0x4408d1-0x44093f (open failure: message 0xb8, error count), 0x440959-0x440976 (seek block * 0x4000, read 0x4000), FUN_00440bfc 0x440c03-0x440c47 (ROM 0 header), cpcemu0.cfg ROM_BLOCK 255 and 0 under #IFCPC 0 and 3, kept by FUN_00466680 0x466871-0x466879 when the CPC type at 0x564590 matches"
note: >-
- CPC 464 firmware and BASIC, selected by CPC_TYPE 0 or the -t 0 command
- line. Foreground ROM header 80 01 00 00.
+ CPC 464 firmware and BASIC, selected by CPC_TYPE 0 or 3 or the -t
+ command line. Foreground ROM header 80 01 00 00.
- name: CPC664.ROM
path: "ROM/CPC664.ROM"
@@ -126,12 +120,12 @@ files:
required: false
bundled: true
min_size: 32768
- validation: [size, signature]
+ validation: [signature]
md5: 5a384a2310f472c7857888371c00ed66
sha1: 073a7665527b5bd8a148747a3947dbd3328682c8
- source_ref: "CPCemu 2.5/3.0.2: ROM/CPC664.ROM, cpcemu0.cfg ROM_BLOCK 255 and 0 for CPC_TYPE 1"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_004407d0 0x440848-0x4408b6 (ROM_PATH + ROM_BLOCK file name, ifstream open), 0x4408d1-0x44093f (open failure: message 0xb8, error count), 0x440959-0x440976 (seek block * 0x4000, read 0x4000), FUN_00440bfc 0x440c03-0x440c47 (ROM 0 header), cpcemu0.cfg ROM_BLOCK 255 and 0 under #IFCPC 1, kept by FUN_00466680 0x466871-0x466879 when the CPC type at 0x564590 matches"
note: >-
- CPC 664 firmware and BASIC, selected by CPC_TYPE 1 or the -t 1 command
+ CPC 664 firmware and BASIC, selected by CPC_TYPE 1 or the -t command
line. Foreground ROM header 80 01 01 00.
# -- Disc ROM, slot 7 --
@@ -141,15 +135,15 @@ files:
required: true
bundled: true
size: 16384
+ validation: [signature]
md5: aa2fb251814bd971b2b9874ab0971b3f
sha1: 0e247123b9d3204784eeadb4629b9d35b9dfd984
- source_ref: "CPCemu 2.5/3.0.2: ROM/CPCADOS.ROM, cpcemu0.cfg ROM_BLOCK 7 for every CPC_TYPE"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_004407d0 0x440848-0x4408b6 (ROM_PATH + ROM_BLOCK file name, ifstream open), 0x4408d1-0x44093f (open failure: message 0xb8, error count), 0x440959-0x440976 (read 0x4000, no length check), FUN_0046ac64 0x46ae22-0x46ae2d and FUN_00481bcc 0x481efa-0x481f54 (count + 2 >= 3 ends startup), FUN_00440f10 0x440fae-0x440fbf and FUN_00440cc4 (ROM 7 header 01 00 05 or 01 00 07, else message 0xbb), cpcemu0.cfg ROM_BLOCK 7 under every #IFCPC"
note: >-
- AMSDOS disc ROM, the 8 KB image zero-padded to 16 KB. Declared for every
- machine by the shipped configuration, so startup ends on status 3 without
- it. Dropping the ROM_BLOCK line instead boots with "ROM: No AMSDOS ROM
- found." and no disc support. Length is not checked, an 8 KB file installs
- the AMSDOS speedup all the same.
+ AMSDOS disc ROM, the 8 KB image zero-padded to 16 KB. Named for every
+ machine by the shipped configuration, so startup ends with status 3
+ without it. Dropping the ROM_BLOCK line instead boots with "ROM: No
+ AMSDOS ROM found." and no disc support.
# -- M4 board, ROM slot 6 plus the board's own lower ROM --
- name: M4.ROM
@@ -161,11 +155,24 @@ files:
validation: [signature]
md5: 28a7e368badca8299ba24a15bb4ebe9b
sha1: 05f9447d307ab17eae9e2100f91c36b0c9560d4b
- source_ref: "CPCemu 2.5/3.0.2: ROM/M4.ROM, cpcemu0.cfg ROM_BLOCK 6, M4_ENABLED = 1"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_004407d0 0x440848-0x44093f (ROM_PATH + ROM_BLOCK file name, ifstream open, open failure counted), FUN_0046ac64 0x46ae22-0x46ae2d (count + 2 >= 3 ends startup), FUN_0044c6c4 0x44c6fa-0x44c74c (FUN_00440570 finds the ROM_BLOCK entry named \"M4.ROM\", else \"M4 ROM not found.\"), 0x44c751-0x44c7be (8-byte compare with \"M4 BOARD\" at the name table address in ROM bytes 4-5, else \"M4 ROM not valid.\"), routine at 0x449c1c 0x44a4f4-0x44a548 (updater writes ROM_PATH + /M4.ROM, 0x4000 bytes), cpcemu0.cfg ROM_BLOCK 6 outside any #IFCPC"
note: >-
- M4 board firmware by Duke. Declared by the shipped configuration, so
- startup ends on status 3 without it even when M4_ENABLED is 0. Contents
- are checked, a zeroed file boots and reports "M4 ROM not valid."
+ M4 board firmware by Duke. Named by the shipped configuration for every
+ machine, so startup ends with status 3 without it, whatever M4_ENABLED
+ holds. The board is recognised only by the file name M4.ROM in the
+ ROM_BLOCK line. A failed lookup or name table check clears M4_ENABLED and
+ emulation goes on without the board.
+
+ - name: NMIROM.BIN
+ path: "SDCARD/NMIROM.BIN"
+ system: amstrad-cpc
+ required: false
+ description: "M4 board NMI ROM on the emulated SD card"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_0044c6c4 0x44c966-0x44c9c4 (FUN_0044c238 builds M4_SD_PATH from 0x516cd8 + /NMIROM.BIN, fopen rb, fread 0x4000), called from FUN_0046ac64 0x46ae76"
+ note: >-
+ Read at every startup once M4.ROM has passed its check, in place of
+ HACK.ROM when present. The shipped cpcemu0.cfg sets M4_SD_PATH to
+ ./SDCARD/. Up to 0x4000 bytes are read, the length is not checked.
- name: HACK.ROM
path: "ROM/HACK.ROM"
@@ -175,11 +182,13 @@ files:
size: 7994
md5: ffcbcbce32223a152753d30766ad6215
sha1: 582dd1706391f6f0161ad3486ae75a04fb0f7d5b
- source_ref: "CPCemu 2.5/3.0.2: ROM_PATH + /HACK.ROM, opened after M4_SD_PATH + NMIROM.BIN"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_0044c6c4 0x44c966-0x44c9c4 (FUN_0044c238 builds M4_SD_PATH from 0x516cd8 + /NMIROM.BIN, fopen rb, fread 0x4000), 0x44c9c9-0x44ca3f (ROM_PATH from FUN_00440a5c + /HACK.ROM, fopen rb, fread 0x4000 into the buffer at 0x516210), 0x44ca41-0x44ca6a (\"Unable to load HACK.ROM\", returns 0), called from FUN_0046ac64 0x46ae76, routine at 0x449c1c 0x44a5b7-0x44a60b (updater writes ROM_PATH + /HACK.ROM, 0x4000 bytes)"
note: >-
M4 hack ROM, the lower ROM behind the Shift+F1 menu. Opened at every
- startup, and superseded by a NMIROM.BIN on the emulated SD card. Missing
- prints "Unable to load HACK.ROM" and emulation continues.
+ startup once M4.ROM has passed its check, and only when M4_SD_PATH +
+ NMIROM.BIN is absent. Missing prints "Unable to load HACK.ROM" and
+ emulation continues. Up to 0x4000 bytes are read, the length is not
+ checked.
# -- National firmware, configured by the 3.0.2 keyboard layout dialog --
- name: CPC6128.ROM.UK
@@ -188,13 +197,13 @@ files:
required: false
bundled: true
min_size: 32768
- validation: [size, signature]
+ validation: [signature]
md5: b96280dc6c95a48857b4b8eb931533ae
sha1: 5977adbad3f7c1e0e082cd02fe76a700d9860c30
- source_ref: "CPCemu 2.5/3.0.2: ROM/National/CPC6128.ROM.UK"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_004866e0 0x486881-0x486908 (system ROM picker: file selector FUN_00462fe0 rooted at ROM_PATH, path made relative, FUN_004405f0 sets ROM 255 or 0), FUN_004407d0 0x440848-0x440976 (ROM_PATH + name, open, read 0x4000 per block), no path constant names this file, the English layout of FUN_0048202c keeps CPC6128.ROM"
note: >-
- English CPC 6128 firmware, the same image as CPC6128.ROM. Ships in the
- National folder without being named by any path constant.
+ English CPC 6128 firmware, the same image as CPC6128.ROM. Loaded only when
+ the user names it in a ROM_BLOCK line or picks it in the setup menu.
- name: CPC6128.ROM.FR
path: "ROM/National/CPC6128.ROM.FR"
@@ -202,11 +211,11 @@ files:
required: false
bundled: true
min_size: 32768
- validation: [size, signature]
+ validation: [signature]
md5: 5ee871d5600eb9b5a22989c295f902a5
sha1: 200d59076dfef36db061d6d7d21d80021cab1237
- source_ref: "CPCemu 3.0.2: National/CPC6128.ROM.FR, keyboard layout dialog on first start"
- note: "French CPC 6128 firmware, configured when the French layout is picked."
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_0048202c 0x482045-0x48207d (layout dialog, keys 1, 3, 4, 5 give 0, 2, 3, 4), 0x4820c5 (layout 2: \"National/CPC6128.ROM.FR\"), 0x4820d8-0x4820f6 (FUN_004405f0 sets ROM 0 block 1 and ROM 255 block 0, reloaded by FUN_004407d0 through FUN_00440304 0x4403cc), called from FUN_00481bcc 0x481e23-0x481e5a when no keyboard layout is configured"
+ note: "French CPC 6128 firmware, configured when the French layout is picked on first start."
- name: CPC6128.ROM.ES
path: "ROM/National/CPC6128.ROM.ES"
@@ -214,11 +223,11 @@ files:
required: false
bundled: true
min_size: 32768
- validation: [size, signature]
+ validation: [signature]
md5: 0246740371010333385665dfeb7cd0ec
sha1: 1acd01c2c03424a78b32c9440f4d890fb1104815
- source_ref: "CPCemu 3.0.2: National/CPC6128.ROM.ES, keyboard layout dialog on first start"
- note: "Spanish CPC 6128 firmware, configured when the Spanish layout is picked."
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_0048202c 0x482045-0x48207d (layout dialog), 0x4820cc (layout 3: \"National/CPC6128.ROM.ES\"), 0x4820d8-0x4820f6 (FUN_004405f0 sets ROM 0 block 1 and ROM 255 block 0, reloaded by FUN_004407d0 through FUN_00440304 0x4403cc), called from FUN_00481bcc 0x481e23-0x481e5a when no keyboard layout is configured"
+ note: "Spanish CPC 6128 firmware, configured when the Spanish layout is picked on first start."
- name: CPC6128.ROM.DK
path: "ROM/National/CPC6128.ROM.DK"
@@ -226,11 +235,11 @@ files:
required: false
bundled: true
min_size: 32768
- validation: [size, signature]
+ validation: [signature]
md5: ca1635fd992e2aa7a776b30da13467e5
sha1: a9e7ee6355730f319a37c95ca0a714212b88c3b1
- source_ref: "CPCemu 3.0.2: National/CPC6128.ROM.DK, keyboard layout dialog on first start"
- note: "Danish CPC 6128 firmware, configured when the Danish layout is picked."
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_0048202c 0x482045-0x48207d (layout dialog), 0x4820d3 (layout 4: \"National/CPC6128.ROM.DK\"), 0x4820d8-0x4820f6 (FUN_004405f0 sets ROM 0 block 1 and ROM 255 block 0, reloaded by FUN_004407d0 through FUN_00440304 0x4403cc), called from FUN_00481bcc 0x481e23-0x481e5a when no keyboard layout is configured"
+ note: "Danish CPC 6128 firmware, configured when the Danish layout is picked on first start."
- name: CPC6128.ROM.SE
path: "ROM/National/CPC6128.ROM.SE"
@@ -238,14 +247,14 @@ files:
required: false
bundled: true
min_size: 32768
- validation: [size, signature]
+ validation: [signature]
md5: 8ca256a832e83c875f5432b3dee8a36f
sha1: 6765a91a42fed68a807325bf62a728e5ac5d622f
- source_ref: "CPCemu 2.5/3.0.2: ROM/National/CPC6128.ROM.SE"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_004866e0 0x486881-0x486908 (system ROM picker: file selector FUN_00462fe0 rooted at ROM_PATH, path made relative, FUN_004405f0 sets ROM 255 or 0), FUN_004407d0 0x440848-0x440976 (ROM_PATH + name, open, read 0x4000 per block), no path constant names this file, FUN_0048202c 0x4820b3-0x4820d3 maps layouts 2, 3, 4 only"
note: >-
- Swedish CPC 6128 firmware. Ships in the National folder without being
- named by any path constant, the layout dialog offering English, French,
- Spanish and Danish only.
+ Swedish CPC 6128 firmware. Loaded only when the user names it in a
+ ROM_BLOCK line or picks it in the setup menu, the layout dialog offering
+ no Swedish ROM.
# -- Expansion ROMs mapped through a user ROM_BLOCK line --
- name: XDDOS210.ROM
@@ -256,11 +265,13 @@ files:
size: 16384
md5: 1d91a9ef315b302d335cd7e04e8d8d86
sha1: 2f1bd4d6e2d2e62818b01e6e7a26488362a7a8ee
- source_ref: "CPCemu 3.0.2: ROM/XDDOS210.ROM, cpcemu0.cfg commented ROM_BLOCK 7, help topic DOBBERTIN HD20 ENABLED"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_00486fc4 0x487026-0x487113 (expansion ROM picker: file selector FUN_00462fe0 rooted at ROM_PATH, FUN_004405f0 sets the slot), FUN_004665d0 (ROM_BLOCK line parser), FUN_004407d0 0x440848-0x440976 (ROM_PATH + name, open, read 0x4000), cpcemu0.cfg commented ROM_BLOCK 7, no path constant names this file"
note: >-
- X-DDOS 2.10 by Dobbertin, the disc operating system of the HD20 hard disk.
- Required in a ROM slot to use DOBBERTIN_HD_ENABLED = 1. Added in 3.0, not
- shipped with 2.5.
+ X-DDOS 2.10 by Dobbertin, the disc operating system of the HD20 hard disk
+ that DOBBERTIN_HD_ENABLED emulates. Loaded once the user maps it to a ROM
+ slot. Its header 01 02 01 is not taken as AMSDOS by FUN_00440cc4, so the
+ AMSDOS speedup stays off with it in slot 7. Added in 3.0, not shipped
+ with 2.5.
- name: COPYMATE.ROM
path: "ROM/COPYMATE.ROM"
@@ -270,11 +281,11 @@ files:
size: 16512
md5: e9c4288eab8885a1e6ae7504a4736115
sha1: 15d52de01320d9b954e03b4c2e71ec75fd301bbb
- source_ref: "CPCemu 2.5/3.0.2: ROM/COPYMATE.ROM, cpcemu0.cfg commented ROM_BLOCK 4"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_004665d0 (ROM_BLOCK line parser), FUN_004407d0 0x440848-0x440976 (ROM_PATH + name, open, read 0x4000), FUN_004721e4 0x4721ef-0x472246 and 0x4722f8-0x472300 (128-byte AMSDOS header recognised by its checksum over bytes 0-0x42, data read from offset 0x80), cpcemu0.cfg commented ROM_BLOCK 4, FUN_00486fc4 0x487026-0x487113 (expansion ROM picker)"
note: >-
Copy utility ROM, carrying a 128-byte AMSDOS file header ahead of the
- 16 KB image. Shipped as the example expansion ROM of the configuration
- file and loaded once the line is uncommented.
+ 16 KB image, which the loader skips. Shipped as the example expansion ROM
+ of the configuration file and loaded once the line is uncommented.
- name: multface.rom
path: "ROM/multface.rom"
@@ -284,7 +295,7 @@ files:
size: 8192
md5: 4c9f014e91d407cc6509fad0095ab909
sha1: 1431ec628d38f000715545dd2186b684c5fe5a6f
- source_ref: "CPCemu 2.5/3.0.2: ROM/multface.rom, ROM_BLOCK filename or ROM Manager entry"
+ source_ref: "cpcemu_portable.exe 3.0.2 FUN_00486fc4 0x487026-0x487113 (expansion ROM picker: file selector FUN_00462fe0 rooted at ROM_PATH, FUN_004405f0 sets the slot), FUN_004665d0 (ROM_BLOCK line parser), FUN_004407d0 0x440848-0x440976 (ROM_PATH + name, open, read up to 0x4000), no path constant names this file"
note: >-
- Romantic Robot Multiface Two ROM. Ships in the ROM folder for the user to
- map into a slot, no path constant naming it.
+ Romantic Robot Multiface Two ROM. Ships in the ROM folder and enters only
+ as an ordinary ROM slot named by the user, no code path naming it.
diff --git a/emulators/cspect.yml b/emulators/cspect.yml
index fde57e9e5..34d4977ec 100644
--- a/emulators/cspect.yml
+++ b/emulators/cspect.yml
@@ -11,7 +11,7 @@ core_version: "3.3.1.0"
version_basis:
kind: package
url: "https://mdf200.itch.io/cspect"
- artifact: "CSpect zip from itch.io, CSpect.exe and ReadMe.txt"
+ artifact: "CSpect3_3_1_0.zip from itch.io, CSpect.exe AssemblyFileVersion 3.3.1.0"
display_name: "Sinclair - ZX Spectrum Next (#CSpect)"
verification: existence
cores: [cspect]
@@ -21,13 +21,18 @@ systems:
- sinclair-zx-spectrum
notes: |
- ZX Spectrum Next emulator, assembler and debugger for Windows, macOS and
- Linux, written in C# against .NET Framework 4.8 and run under Mono elsewhere.
- It is closed source and shipped as a zip from its itch.io page, so every
- reference below names a method and an IL offset in the CSpect.exe of 3.3.1.0.
- Type and member names in that build are obfuscated and the string literals sit
- XOR encoded in one 18146 byte blob, decoded at class load by b[i] ^ i ^ 0xAA.
- ref: CSpect.exe 3.3.1.0, ReadMe.txt:9-11
+ ZX Spectrum Next emulator, assembler and debugger written in C# against .NET
+ Framework 4.8. One assembly serves Windows, macOS and Linux and picks its host
+ from Environment.OSVersion at startup. It is closed source and shipped as
+ CSpect3_3_1_0.zip from its itch.io page (sha256 f6935abe6ed49b1e), so every
+ reference below names a method and an IL offset in its CSpect.exe, assembly
+ and file version 3.3.1.0. Type and member names in that build are obfuscated
+ and the string literals sit XOR encoded in one 18146 byte blob, decoded at
+ class load by b[i] ^ i ^ 0xAA.
+ ref: CSpect.exe 3.3.1.0 TargetFramework(".NETFramework,Version=v4.8"),
+ AssemblyFileVersion("3.3.1.0"), A.h::a(string[]) IL_0000-IL_0030,
+ .DB247AA5-38E0-44EF-99A2-2061F389A03D::.cctor
+ IL_000f-IL_0052
The machine carries no built-in ROM. A cold reset either loads the Next ROMs
or allocates them zero filled, 65536 bytes for the ROM banks and 8192 each for
diff --git a/emulators/drastic.yml b/emulators/drastic.yml
index 515a8da80..4efdef257 100644
--- a/emulators/drastic.yml
+++ b/emulators/drastic.yml
@@ -26,15 +26,17 @@ notes: |
Nintendo DS emulator by Exophase, closed source and distributed as a binary.
Two releases are read here and they name the same files: the Android build
r2.6.0.4a build 109, package com.dsemu.drastic, apk md5
- 7df979ef9420c5053b27c838e6a7e20c, whose loader is
- lib/arm64-v8a/libdrastic_arm64.so and whose installer is the smali of
- DraSticActivity. The second is the Linux AArch64 build r2.5.2.2, md5
- 17550db727f3b59d36b57746ad1944be, which ships unstripped with 2731 named
- functions and is cited by function name. r2.5.2.2 predates the firmware editor
- and the user database, and that is the whole of the divergence. Every
- reference below is an address in one of the two binaries or a line in the
- apktool decode of the Android one.
- ref: libdrastic_arm64.so, drastic r2.5.2.2 (DWARF comp_dir
+ 7df979ef9420c5053b27c838e6a7e20c (sha256 d3a45b9bfd5a68cc), v1 signed by
+ CN=Gilead Kutnick over every entry, whose loader is
+ lib/arm64-v8a/libdrastic_arm64.so (sha256 3b27eee0c480df81) and whose
+ installer is the smali of DraSticActivity. The second is the Linux AArch64
+ build r2.5.2.2, md5 17550db727f3b59d36b57746ad1944be (sha256
+ dab3275ef772451b), which ships unstripped with 2731 named functions and is
+ cited by function name. r2.5.2.2 predates the firmware editor and the user
+ database, and that is the whole of the divergence. Every reference below is
+ an address in one of the two binaries, a line in the apktool decode of the
+ Android one or a line of an asset it ships.
+ ref: libdrastic_arm64.so r2.6.0.4a, drastic r2.5.2.2 (DWARF comp_dir
/home/odroid/nds_emu/src/linux_odroid64), DraSticActivity.smali
One root holds everything. On Android it is a directory named DraStic at the
@@ -43,8 +45,8 @@ notes: |
microphone and scripts below it, and the Android build adds backgrounds,
icon_cache, users, shaders and virtual_controller. Paths below are relative to
that root.
- ref: drastic r2.5.2.2 initialize_system_directories 0xf780,
- drastic r2.5.2.2 0x11ac08-0x11ac80, drastic r2.5.2.2 initialize_system 0xf9e8,
+ ref: drastic r2.5.2.2 initialize_system_directories 0xf784-0xf838,
+ drastic r2.5.2.2 initialize_system 0xf9e8,
DraSticPathCache.smali:44-56, DraSticActivity.smali:4373-4429,
DraSticActivity.smali:4187, DraSticActivity.smali:4482
@@ -53,7 +55,7 @@ notes: |
for with "System file %s is the wrong size (should be %d bytes, is %d)", then
reads it whole. Size is the only test: no hash is computed on any file.
ref: drastic r2.5.2.2 load_system_file 0xea80-0xebe4,
- libdrastic_arm64.so 0x1b4d4-0x1b510
+ libdrastic_arm64.so r2.6.0.4a 0x1b4d4-0x1b510
Each BIOS slot has two candidates. The ARM9 slot takes nds_bios_arm9.bin, and
on failure logs "Can't find Nintendo ARM9 BIOS. Trying free DraStic ARM9
@@ -70,7 +72,7 @@ notes: |
drastic r2.5.2.2 initialize_system 0xf940-0xf944,
drastic r2.5.2.2 initialize_system 0xf9f8-0xfa10,
drastic r2.5.2.2 menu_bios_warning 0x801e0-0x80238,
- libdrastic_arm64.so 0x2b6d0-0x2b764
+ libdrastic_arm64.so r2.6.0.4a 0x2b6d0-0x2b764
Firmware is answered in code when no file loads: the 256 KB region is zeroed
and patch_firmware_header_data writes the header, the console identity and the
@@ -80,7 +82,7 @@ notes: |
ref: drastic r2.5.2.2 initialize_memory 0x1c3e0-0x1c3f8,
drastic r2.5.2.2 initialize_memory 0x1c560-0x1c578,
drastic r2.5.2.2 patch_firmware_header_data 0x1b920,
- libdrastic_arm64.so 0x2b768-0x2b7c4, libdrastic_arm64.so 0x774e0-0x7751c
+ libdrastic_arm64.so r2.6.0.4a 0x2b768-0x2b7c4, libdrastic_arm64.so r2.6.0.4a 0x774e0-0x7751c
The Nintendo ARM7 image still decides one thing. gamecard_load_program passes
the 0x1048 bytes at ARM7 BIOS offset 0x30 to gamecard_decrypt_secure_region as
@@ -98,7 +100,7 @@ notes: |
ref: drastic r2.5.2.2 initialize_gamecard 0x709bc-0x70a30,
drastic r2.5.2.2 initialize_game_database 0x73180,
drastic r2.5.2.2 initialize_game_database 0x73d24-0x73d38,
- libdrastic_arm64.so 0x76ab8-0x76b58
+ libdrastic_arm64.so r2.6.0.4a 0x76ab8-0x76b58
The Android package carries its own copies of the files it needs and lays them
down on first run: the two free BIOS images into system, the default layout
@@ -110,11 +112,22 @@ notes: |
DraSticActivity.smali:5645, DraSticActivity.smali:5834,
DraSticActivity.smali:5974
- A .dfx names the passes of a post-processing chain and pulls its GLSL stages,
- its included headers and its lookup textures from paths relative to itself.
- Nine chains ship: None, Linear, Quilez, Scale2X, Scanline, HQ2X, FXAA, FXAA HQ
- and SMAA, the last two reading .raw lookup textures.
- ref: assets/shaders/_shader_format_.txt:12-58, assets/shaders/SMAA.dfx:1-6
+ fxLoad hands the path of the chosen .dfx to the chain loader, which opens it,
+ keeps its directory and reads it line by line. An reads its file=
+ whole, a whose input= is neither null nor framebuffer reads that
+ file whole as a lookup texture, and the shader= of each opens a .dsd
+ and splits its and blocks, all three relative to the
+ .dfx. A stage that fails to compile has its log written to .log beside
+ the .dsd. A .dfx that does not open or parse leaves a built-in pass-through
+ shader. Nine chains ship: None, Linear, Quilez, Scale2X, Scanline, HQ2X,
+ FXAA, FXAA HQ and SMAA, and SMAA is the only one naming .raw textures.
+ ref: libdrastic_arm64.so r2.6.0.4a Java_com_dsemu_drastic_DraSticJNI_fxLoad 0x18eec,
+ libdrastic_arm64.so r2.6.0.4a FUN_1ff78 0x1ffd4-0x20214,
+ libdrastic_arm64.so r2.6.0.4a FUN_1f0a0 0x1f17c-0x1f1c8,
+ libdrastic_arm64.so r2.6.0.4a FUN_1f260 0x1f464-0x1f52c,
+ libdrastic_arm64.so r2.6.0.4a FUN_1f734 0x1f850-0x1f894,
+ libdrastic_arm64.so r2.6.0.4a FUN_1ebfc 0x1ec20-0x1ecec,
+ assets/shaders/SMAA.dfx:108-122
Per-title inputs are read beside the ROM name. reset_spu answers the
microphone with microphone/.wav then microphone/microphone.wav, load_nds
@@ -144,7 +157,7 @@ files:
validation: [size]
description: "Nintendo DS ARM9 BIOS"
note: "First candidate for the ARM9 slot. Booting continues on the free replacement when it is absent, and the slot ending empty is fatal."
- source_ref: "drastic r2.5.2.2 initialize_memory 0x1c398-0x1c3b0, drastic r2.5.2.2 load_system_file 0xea80-0xebe4, libdrastic_arm64.so 0x2b6d0-0x2b6ec"
+ source_ref: "drastic r2.5.2.2 initialize_memory 0x1c398-0x1c3b0, drastic r2.5.2.2 load_system_file 0xea80-0xebe4, libdrastic_arm64.so r2.6.0.4a 0x2b6d0-0x2b6ec"
- name: drastic_bios_arm9.bin
sha1: 4dc29a1560e1cbd7afef1998f7a6c25c5db1cc3a
@@ -156,8 +169,8 @@ files:
size: 4096
validation: [size]
description: "DraStic free ARM9 BIOS replacement"
- note: "Second candidate for the ARM9 slot, written by Exophase from public documentation and released under a BSD licence. Installed from the package assets on first run."
- source_ref: "drastic r2.5.2.2 initialize_memory 0x1c4b0-0x1c4d4, libdrastic_arm64.so 0x2b6f0-0x2b708, DraSticActivity.smali:4084-4090, drastic_bios_readme.txt:1-31"
+ note: "Second candidate for the ARM9 slot. Installed from the package assets on first run."
+ source_ref: "drastic r2.5.2.2 initialize_memory 0x1c4b0-0x1c4d4, libdrastic_arm64.so r2.6.0.4a 0x2b6f0-0x2b708, DraSticActivity.smali:4084-4090"
- name: nds_bios_arm7.bin
path: system/nds_bios_arm7.bin
@@ -167,7 +180,7 @@ files:
validation: [size]
description: "Nintendo DS ARM7 BIOS"
note: "First candidate for the ARM7 slot, and the only image carrying the Blowfish key table at offset 0x30 that the card secure area is decrypted with."
- source_ref: "drastic r2.5.2.2 initialize_memory 0x1c3bc-0x1c3d4, drastic r2.5.2.2 gamecard_load_program 0x6fb98-0x6fbac, libdrastic_arm64.so 0x2b724-0x2b73c"
+ source_ref: "drastic r2.5.2.2 initialize_memory 0x1c3bc-0x1c3d4, drastic r2.5.2.2 gamecard_load_program 0x6fb98-0x6fbac, libdrastic_arm64.so r2.6.0.4a 0x2b724-0x2b73c"
- name: drastic_bios_arm7.bin
sha1: 31ae916c85d012582c7cdf47de6943ac6778253b
@@ -180,7 +193,7 @@ files:
validation: [size]
description: "DraStic free ARM7 BIOS replacement"
note: "Second candidate for the ARM7 slot. Offset 0x30 is zero filled, so cards whose secure area is encrypted do not decrypt under it."
- source_ref: "drastic r2.5.2.2 initialize_memory 0x1c508-0x1c52c, libdrastic_arm64.so 0x2b740-0x2b758, DraSticActivity.smali:4078-4083"
+ source_ref: "drastic r2.5.2.2 initialize_memory 0x1c508-0x1c52c, libdrastic_arm64.so r2.6.0.4a 0x2b740-0x2b758, DraSticActivity.smali:4078-4083"
- name: nds_firmware.bin
path: system/nds_firmware.bin
@@ -191,7 +204,7 @@ files:
validation: [size]
description: "Nintendo DS firmware"
note: "Absent, the region is zeroed and patch_firmware_header_data writes a header, a console identity and a user settings block into it, so the emulator boots either way. r2.6.0.4a reads nds_firmware_modified.bin before this."
- source_ref: "drastic r2.5.2.2 initialize_memory 0x1c3e0-0x1c3f8, drastic r2.5.2.2 initialize_memory 0x1c560-0x1c578, drastic r2.5.2.2 patch_firmware_header_data 0x1b920, libdrastic_arm64.so 0x2b794-0x2b7c4"
+ source_ref: "drastic r2.5.2.2 initialize_memory 0x1c3e0-0x1c3f8, drastic r2.5.2.2 initialize_memory 0x1c560-0x1c578, drastic r2.5.2.2 patch_firmware_header_data 0x1b920, libdrastic_arm64.so r2.6.0.4a 0x2b794-0x2b7c4"
- name: nds_firmware_modified.bin
path: system/nds_firmware_modified.bin
@@ -203,7 +216,7 @@ files:
unsourceable: "written by the firmware editor of r2.6.0.4a from the emulated user settings, so no dump of it exists"
description: "firmware image edited in the emulator"
note: "Read before nds_firmware.bin in r2.6.0.4a and absent from r2.5.2.2."
- source_ref: "libdrastic_arm64.so 0x2b768-0x2b790, libdrastic_arm64.so 0x774e0-0x7751c"
+ source_ref: "libdrastic_arm64.so r2.6.0.4a 0x2b768-0x2b790, libdrastic_arm64.so r2.6.0.4a 0x774e0-0x7751c"
- name: game_database.xml
size: 1686069
@@ -225,7 +238,7 @@ files:
unsourceable: "user overlay of the save type database, authored per collection"
description: "user save type database"
note: "Read after game_database.xml in r2.6.0.4a and absent from r2.5.2.2."
- source_ref: "libdrastic_arm64.so 0x76af8-0x76b28"
+ source_ref: "libdrastic_arm64.so r2.6.0.4a 0x76af8-0x76b28"
- name: usrcheat.dat
path: usrcheat.dat
@@ -235,7 +248,7 @@ files:
category: game_data
description: "Action Replay cheat library"
note: "Read from the root of the data directory and written back when a cheat is toggled, so the file carries the enabled state. Installed from the package assets on first run."
- source_ref: "drastic r2.5.2.2 initialize_gamecard 0x70a0c-0x70a30, libdrastic_arm64.so 0x76b34-0x76b58, DraSticActivity.smali:5974"
+ source_ref: "drastic r2.5.2.2 initialize_gamecard 0x70a0c-0x70a30, libdrastic_arm64.so r2.6.0.4a 0x76b34-0x76b58, DraSticActivity.smali:5974"
- name: drastic_bios.zip
size: 15583
@@ -245,8 +258,8 @@ files:
bundled: true
category: game_data
description: "source archive of the free BIOS replacement"
- note: "Copied to the root of the data directory on first run and never read back. Holds bios_common.S, a Makefile, the BSD licence notice and the two built images."
- source_ref: "DraSticActivity.smali:5189-5200, drastic_bios_readme.txt:1-31"
+ note: "Copied to the root of the data directory on first run and never read back. Holds bios_common.S, a Makefile, drastic_bios_readme.txt and the two built images."
+ source_ref: "DraSticActivity.smali:5189-5200"
- name: LC_default.dat
size: 76
@@ -266,7 +279,7 @@ files:
category: game_data
description: "post-processing chain definition"
note: "Android only. Names the passes, the texture inputs and the headers of one chain, all resolved relative to its own path. The package ships None, Linear, Quilez, Scale2X, Scanline, HQ2X, FXAA, FXAA HQ and SMAA."
- source_ref: "DraSticActivity.smali:5619-5624, assets/shaders/_shader_format_.txt:11-21"
+ source_ref: "DraSticActivity.smali:5619-5624, libdrastic_arm64.so r2.6.0.4a Java_com_dsemu_drastic_DraSticJNI_fxLoad 0x18ea8-0x18f20 (path string handed to FUN_1d198, which tail-calls FUN_1ff78), FUN_1ff78 0x1ffd4-0x1ffe0 (open rb), 0x1fff4-0x20024 (strrchr '/' then '\\', directory kept for relative names), 0x20040-0x201d0 (fgets loop dispatching , , , , , ), 0x201ec-0x20214 (built-in pass-through shader when the file fails)"
- name: ".dsd"
path: "shaders/.dsd"
@@ -274,8 +287,8 @@ files:
bundled: true
category: game_data
description: "GLSL stage source named by a chain"
- note: "Android only. Named by the shader entry of a pass, and carrying the vertex and fragment code for it, together with the .h and .hlsl files the include tags pull in. A stage that fails to compile leaves a dsd.log beside it."
- source_ref: "assets/shaders/_shader_format_.txt:8-9, assets/shaders/_shader_format_.txt:36-40, assets/shaders/_shader_format_.txt:59-72, assets/shaders/_shader_format_.txt:75-98"
+ note: "Android only. Named by the shader entry of a pass relative to the .dfx, and carrying the vertex and fragment code for it. The .h and .hlsl headers an of the .dfx names are read whole the same way. A stage that fails to compile has its log written to .dsd.log beside it, and the chain falls back to the built-in shader."
+ source_ref: "libdrastic_arm64.so r2.6.0.4a FUN_1f734 0x1f850-0x1f894 (shader= value joined to the .dfx directory with %s/%s and passed to FUN_1ebfc), FUN_1ebfc 0x1ec20-0x1ec60 (open rb, FUN_1eaa4 splits and at 0x1eb10-0x1eb90, close), 0x1eca0-0x1ecec (compile, on failure FUN_1ed3c formats %s.log on the .dsd path and the log is written wb), FUN_1f0a0 0x1f17c-0x1f1c8 ( file= opened rb relative to the .dfx), 0x1f138 (read whole)"
- name: ".raw"
path: "shaders/.raw"
@@ -283,8 +296,8 @@ files:
bundled: true
category: game_data
description: "lookup texture named by a chain"
- note: "Android only. Loaded when a texture tag names a file instead of the framebuffer or an FBO, with the dimensions and the format taken from the tag. SMAA is the one shipped chain that names any, taking smaa/AreaTexRGB.raw and smaa/SearchTexRGB.raw. The package also carries the non-RGB pair of the same two tables, which no shipped chain names."
- source_ref: "assets/shaders/_shader_format_.txt:42-56, assets/shaders/SMAA.dfx:1-6"
+ note: "Android only. Loaded when a texture tag names a file instead of the framebuffer or an FBO, read whole with no length check and uploaded with the dimensions and the format taken from the tag. An absent file leaves the texture unloaded. SMAA is the one shipped chain that names any, taking smaa/AreaTexRGB.raw and smaa/SearchTexRGB.raw. The package also carries the non-RGB pair of the same two tables, which no shipped chain names."
+ source_ref: "libdrastic_arm64.so r2.6.0.4a FUN_1f260 0x1f464-0x1f49c (input= compared to null and framebuffer), 0x1f4c4-0x1f4d8 (any other name joined to the .dfx directory with %s/%s and opened rb), 0x1f4e0-0x1f52c (length by fseek and ftell, read whole), 0x1f628-0x1f638 (no upload when the open fails), 0x1f690 (glTexImage2D with the width, height, format and type of the tag), assets/shaders/SMAA.dfx:108-122"
- name: ".zip"
path: "virtual_controller/.zip"
@@ -339,7 +352,7 @@ files:
category: game_data
description: "custom cheat file"
note: "Plain text, one bracketed cheat name per block followed by its codes, a trailing plus marking the cheat active. Read on top of the entries usrcheat.dat holds and written back when a cheat is toggled."
- source_ref: "drastic r2.5.2.2 load_custom_cheats 0x817b4, drastic r2.5.2.2 save_custom_cheats 0x81d24, drastic_readme.txt:789-812"
+ source_ref: "drastic r2.5.2.2 load_custom_cheats 0x817b4-0x817d8 (sprintf %s%ccheats%c%s.cht, fopen rb), 0x81888 (line opening with [), 0x818b4-0x818d4 (code words parsed by strtoul), 0x819cc-0x81a04 (strrchr ], then + marks the cheat active), drastic r2.5.2.2 save_custom_cheats 0x81d24"
- name: ".gba"
path: "slot2/.gba"
@@ -397,8 +410,10 @@ exclusion_note: >
unzipped_rom.nds, crash_dump.txt, the profiler dumps under profiles, and the
drastic_mapped_memory.dat and drastic_mapped_memory_vram.dat scratch files of
the memory mapper.
- ref: official apk classes dex, libdrastic_arm64.so, drastic r2.5.2.2 0x11a938,
- drastic r2.5.2.2 0x11aca8, drastic r2.5.2.2 0x11b440, drastic r2.5.2.2 0x11b650,
- drastic r2.5.2.2 0x11edd8, drastic r2.5.2.2 0x120190, drastic r2.5.2.2 0x1201b0,
- drastic r2.5.2.2 0x1202d0, drastic r2.5.2.2 0x1217f0, drastic r2.5.2.2 0x121868,
- drastic r2.5.2.2 0x1249f8, drastic r2.5.2.2 0x124b08
+ ref: official apk classes dex, libdrastic_arm64.so r2.6.0.4a,
+ drastic r2.5.2.2 initialize_system 0xf8b4-0xf8d4, drastic r2.5.2.2 quit 0xea08,
+ drastic r2.5.2.2 reset_system 0xfdac, drastic r2.5.2.2 select_delete_config_local 0x7a7b0,
+ drastic r2.5.2.2 initialize_memory 0x1bfa4, drastic r2.5.2.2 initialize_memory 0x1c1bc,
+ drastic r2.5.2.2 gamecard_load_program 0x6f6a8, drastic r2.5.2.2 savestate_index_to_path 0x75138,
+ drastic r2.5.2.2 nds_file_open 0x75688-0x757c0, drastic r2.5.2.2 icon_cache_load 0x7af60,
+ drastic r2.5.2.2 update_input 0x88b00, drastic r2.5.2.2 reset_input 0x89028
diff --git a/emulators/dreamm.yml b/emulators/dreamm.yml
index e22c8ac61..d2e324e9a 100644
--- a/emulators/dreamm.yml
+++ b/emulators/dreamm.yml
@@ -51,9 +51,9 @@ notes: |
%APPDATA%\Aaron Giles\DREAMM on Windows,
~/Library/Application Support/Aaron Giles/DREAMM on macOS,
$XDG_DATA_HOME/Aaron Giles/DREAMM on Linux. Paths below are relative to that
- directory. Startup writes config.json and creates install, gamedelta,
- screenshots, logs and sounddata.
- ref: SDL_GetPrefPath, strace of DREAMM 4.0 linux-x64 with a clean HOME
+ directory.
+ ref: DREAMM 4.0 linux-x64 SDL_GetPrefPath("Aaron Giles", "DREAMM") at
+ 0x1aadaa6-0x1aadab4
Audio hardware is set per game and per variant: speaker, cms, adlib, sb16,
tandy, mt32 and gmidi. MT-32 and General MIDI output can go to an external
@@ -73,17 +73,19 @@ notes: |
both halves. The CM-32L sets name cm32l_pcm.rom as the full image,
mt32_pcm_l.rom as the low half and cm32l_pcm_h.rom as the high half. munt
identifies each file by size then SHA1 before opening the synth.
- ref: set table 0x23db4a8, id lookup 0x164d050, availability 0x164d2a8,
+ ref: set table 0x23db4a8 read by 0x164d050 (record picked at
+ 0x164d165-0x164d2a1, file names read from 0x164d2a8),
munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo
The SC-55 is emulated by the Nuked SC-55 CLAP plug-in, unpacked to
sounddata/Nuked-SC55.clap, which reads one model directory under
- Nuked-SC55-Resources/ROMs. Five models are probed at startup: SC-55 v1.00,
- v1.20, v1.21, v2.00 and SC-55mk2 v1.01. The plug-in identifies a set by
- hashing the directory contents, so its own loader does not depend on the
- file names.
- ref: strace of DREAMM 4.0 linux-x64, Nuked-SC55-CLAP nuked_sc55.cpp:145-212
- GetRomBasePaths and Init, rom_loader.cpp:31-80 DetectRomsetsByHash
+ Nuked-SC55-Resources/ROMs. The DREAMM manifest names five model
+ directories: SC-55 v1.00, v1.20, v1.21, v2.00 and SC-55mk2 v1.01. The
+ plug-in identifies a set by hashing the directory contents, so its own
+ loader does not depend on the file names.
+ ref: DREAMM 4.0 linux-x64 manifest entries 0x23db118-0x23db298,
+ Nuked-SC55-CLAP nuked_sc55.cpp:145-212 GetRomBasePaths and Init,
+ rom_loader.cpp:31-80 DetectRomsetsByHash
Both families install by dropping files on the Manage Sound Fonts & ROMs
screen, or by copying them into sounddata by hand. A dropped file is matched
@@ -93,7 +95,9 @@ notes: |
sizes agree with the bundled munt ROM table. mt32_ctrl_2_03.rom is named by
the v2.03 set but has no manifest entry, so it loads from sounddata and
cannot be installed by drag and drop.
- ref: manifest 0x23daf78, name match 0x16456a0, reverse lookup 0x1645880,
+ ref: manifest 0x23daf78 reached through the pointer at 0x242e9f0, name
+ match 0x16456a0 (load at 0x16456be), reverse lookup 0x1645880 (load
+ at 0x16458a1),
"To install Sound Fonts (.sf2 files) or ROMs for Roland MIDI emulation,
drop them onto this screen."
@@ -123,7 +127,7 @@ files:
crc32: "4c91fa96"
sha1: "5a5cb5a77d7d55ee69657c2f870416daed52dea7"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23dafc8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23dafc8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_04_a.rom
path: "sounddata/mt32emu/mt32_ctrl_1_04_a.rom"
@@ -133,7 +137,7 @@ files:
crc32: "a93b65f2"
sha1: "9cd4858014c4e8a9dff96053f784bfaac1092a2e"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23dafd8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23dafd8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_04_b.rom
path: "sounddata/mt32emu/mt32_ctrl_1_04_b.rom"
@@ -143,7 +147,7 @@ files:
crc32: "b5ee2192"
sha1: "fe8db469b5bfeb37edb269fd47e3ce6d91014652"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23dafe8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23dafe8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_05.rom
path: "sounddata/mt32emu/mt32_ctrl_1_05.rom"
@@ -153,7 +157,7 @@ files:
crc32: "e6bb2b77"
sha1: "e17a3a6d265bf1fa150312061134293d2b58288c"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23daff8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23daff8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_05_a.rom
path: "sounddata/mt32emu/mt32_ctrl_1_05_a.rom"
@@ -163,7 +167,7 @@ files:
crc32: "3281216c"
sha1: "57a09d80d2f7ca5b9734edbe9645e6e700f83701"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db008, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db008 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_05_b.rom
path: "sounddata/mt32emu/mt32_ctrl_1_05_b.rom"
@@ -173,7 +177,7 @@ files:
crc32: "e06d8020"
sha1: "52e3c6666db9ef962591a8ee99be0cde17f3a6b6"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db018, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db018 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_06.rom
path: "sounddata/mt32emu/mt32_ctrl_1_06.rom"
@@ -183,7 +187,7 @@ files:
crc32: "d63319e8"
sha1: "a553481f4e2794c10cfe597fef154eef0d8257de"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db028, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db028 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_06_a.rom
path: "sounddata/mt32emu/mt32_ctrl_1_06_a.rom"
@@ -193,7 +197,7 @@ files:
crc32: "29369ae1"
sha1: "cc83bf23cee533097fb4c7e2c116e43b50ebacc8"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db038, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db038 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_06_b.rom
path: "sounddata/mt32emu/mt32_ctrl_1_06_b.rom"
@@ -203,7 +207,7 @@ files:
crc32: "4d495d98"
sha1: "bf4f15666bc46679579498386704893b630c1171"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db048, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db048 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_07.rom
path: "sounddata/mt32emu/mt32_ctrl_1_07.rom"
@@ -213,7 +217,7 @@ files:
crc32: "a7c1531b"
sha1: "b083518fffb7f66b03c23b7eb4f868e62dc5a987"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db058, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db058 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_07_a.rom
path: "sounddata/mt32emu/mt32_ctrl_1_07_a.rom"
@@ -223,7 +227,7 @@ files:
crc32: "67fd8968"
sha1: "13f06b38f0d9e0fc050b6503ab777bb938603260"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db068, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db068 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_1_07_b.rom
path: "sounddata/mt32emu/mt32_ctrl_1_07_b.rom"
@@ -233,7 +237,7 @@ files:
crc32: "60f45882"
sha1: "c55e165487d71fa88bd8c5e9c083bc456c1a89aa"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db078, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db078 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_bluer.rom
path: "sounddata/mt32emu/mt32_ctrl_bluer.rom"
@@ -243,7 +247,7 @@ files:
crc32: "627b9a51"
sha1: "7b8c2a5ddb42fd0732e2f22b3340dcf5360edf92"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db0b8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db0b8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_bluer_a.rom
path: "sounddata/mt32emu/mt32_ctrl_bluer_a.rom"
@@ -253,7 +257,7 @@ files:
crc32: "d75fc3d9"
sha1: "11a6ae5d8b6ee328b371af7f1e40b82125aa6b4d"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db0c8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db0c8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_bluer_b.rom
path: "sounddata/mt32emu/mt32_ctrl_bluer_b.rom"
@@ -263,7 +267,7 @@ files:
crc32: "5816476f"
sha1: "e0934320d7cbb5edfaa29e0d01ae835ef620085b"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db0d8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db0d8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_2_03.rom
path: "sounddata/mt32emu/mt32_ctrl_2_03.rom"
@@ -272,7 +276,7 @@ files:
size: 131072
sha1: "5837064c9df4741a55f7c4d8787ac158dff2d3ce"
validation: [size, sha1]
- source_ref: "DREAMM 4.0 linux-x64: set table 0x23db5a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: set record 0x23db5a8 read by 0x164d050 (record picked at 0x164d28f, its file names read from 0x164d2a8), no manifest entry; munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_2_04.rom
path: "sounddata/mt32emu/mt32_ctrl_2_04.rom"
@@ -282,7 +286,7 @@ files:
crc32: "59a49d5c"
sha1: "2c16432b6c73dd2a3947cba950a0f4c19d6180eb"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db088, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db088 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_2_06.rom
path: "sounddata/mt32emu/mt32_ctrl_2_06.rom"
@@ -292,7 +296,7 @@ files:
crc32: "94815415"
sha1: "2869cf4c235d671668cfcb62415e2ce8323ad4ed"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db098, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db098 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_ctrl_2_07.rom
path: "sounddata/mt32emu/mt32_ctrl_2_07.rom"
@@ -302,7 +306,7 @@ files:
crc32: "a016b607"
sha1: "47b52adefedaec475c925e54340e37673c11707c"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db0a8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db0a8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: cm32l_ctrl_1_00.rom
path: "sounddata/mt32emu/cm32l_ctrl_1_00.rom"
@@ -312,7 +316,7 @@ files:
crc32: "ee62022f"
sha1: "73683d585cd6948cc19547942ca0e14a0319456d"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23daf88, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23daf88 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: cm32l_ctrl_1_02.rom
path: "sounddata/mt32emu/cm32l_ctrl_1_02.rom"
@@ -322,7 +326,7 @@ files:
crc32: "b998047e"
sha1: "a439fbb390da38cada95a7cbb1d6ca199cd66ef8"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23daf98, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23daf98 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: cm32ln_ctrl_1_00.rom
path: "sounddata/mt32emu/cm32ln_ctrl_1_00.rom"
@@ -332,7 +336,7 @@ files:
crc32: "4a3bb4ef"
sha1: "dc1c5b1b90a4646d00f7daf3679733c7badc7077"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23daf78, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23daf78 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
# -- MT-32 and CM-32L PCM ROMs --
- name: mt32_pcm.rom
@@ -343,7 +347,7 @@ files:
crc32: "573e31cc"
sha1: "f6b1eebc4b2d200ec6d3d21d51325d5b48c60252"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db0e8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db0e8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_pcm_l.rom
path: "sounddata/mt32emu/mt32_pcm_l.rom"
@@ -353,7 +357,7 @@ files:
crc32: "dd9deac3"
sha1: "3a1e19b0cd4036623fd1d1d11f5f25995585962b"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db108, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db108 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: mt32_pcm_h.rom
path: "sounddata/mt32emu/mt32_pcm_h.rom"
@@ -363,7 +367,7 @@ files:
crc32: "4ee6506c"
sha1: "2cadb99d21a6a4a6f5b61b6218d16e9b43f61d01"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db0f8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db0f8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: cm32l_pcm.rom
path: "sounddata/mt32emu/cm32l_pcm.rom"
@@ -373,7 +377,7 @@ files:
crc32: "4b961eba"
sha1: "289cc298ad532b702461bfc738009d9ebe8025ea"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23dafa8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23dafa8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
- name: cm32l_pcm_h.rom
path: "sounddata/mt32emu/cm32l_pcm_h.rom"
@@ -383,7 +387,7 @@ files:
crc32: "8e9ea06e"
sha1: "3ad889fde5db5b6437cbc2eb6e305312fec3df93"
validation: [size, crc32, sha1]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23dafb8, set table 0x23db4a8; sounddata/mt32emu-dreamm.so ROM table"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23dafb8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880; set record table 0x23db4a8 read by 0x164d050 (record picked at 0x164d165-0x164d2a1, its file names read from 0x164d2a8); munt ROMInfo.cpp:206-214 ROMInfo::getROMInfo, built into sounddata/mt32emu-dreamm.so"
# -- Roland SC-55, sounddata/Nuked-SC55-Resources/ROMs --
# One complete set per model directory, the plugin loads a single directory.
@@ -394,7 +398,7 @@ files:
size: 32768
crc32: "d072c251"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db118"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db118 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_rom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.00/sc55_rom2.bin"
@@ -403,7 +407,7 @@ files:
size: 262144
crc32: "dbaaae8f"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db128"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db128 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.00/sc55_waverom1.bin"
@@ -412,7 +416,7 @@ files:
size: 1048576
crc32: "1ac774d3"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db138"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db138 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.00/sc55_waverom2.bin"
@@ -421,7 +425,7 @@ files:
size: 1048576
crc32: "8dcc592a"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db148"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db148 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom3.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.00/sc55_waverom3.bin"
@@ -430,7 +434,7 @@ files:
size: 1048576
crc32: "e21ebc04"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db158"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db158 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_rom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.20/sc55_rom1.bin"
@@ -439,7 +443,7 @@ files:
size: 32768
crc32: "4ed0d171"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db168"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db168 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_rom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.20/sc55_rom2.bin"
@@ -448,7 +452,7 @@ files:
size: 262144
crc32: "ebd488fd"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db178"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db178 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.20/sc55_waverom1.bin"
@@ -457,7 +461,7 @@ files:
size: 1048576
crc32: "1ac774d3"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db188"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db188 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.20/sc55_waverom2.bin"
@@ -466,7 +470,7 @@ files:
size: 1048576
crc32: "8dcc592a"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db198"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db198 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom3.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.20/sc55_waverom3.bin"
@@ -475,7 +479,7 @@ files:
size: 1048576
crc32: "e21ebc04"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db1a8"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db1a8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_rom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.21/sc55_rom1.bin"
@@ -484,7 +488,7 @@ files:
size: 32768
crc32: "4ed0d171"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db1b8"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db1b8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_rom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.21/sc55_rom2.bin"
@@ -493,7 +497,7 @@ files:
size: 262144
crc32: "2dc58549"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db1c8"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db1c8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.21/sc55_waverom1.bin"
@@ -502,7 +506,7 @@ files:
size: 1048576
crc32: "1ac774d3"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db1d8"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db1d8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.21/sc55_waverom2.bin"
@@ -511,7 +515,7 @@ files:
size: 1048576
crc32: "8dcc592a"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db1e8"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db1e8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom3.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v1.21/sc55_waverom3.bin"
@@ -520,7 +524,7 @@ files:
size: 1048576
crc32: "e21ebc04"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db1f8"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db1f8 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_rom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v2.00/sc55_rom1.bin"
@@ -529,7 +533,7 @@ files:
size: 32768
crc32: "a160da90"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db208"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db208 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_rom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v2.00/sc55_rom2.bin"
@@ -538,7 +542,7 @@ files:
size: 262144
crc32: "1768cc18"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db218"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db218 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v2.00/sc55_waverom1.bin"
@@ -547,7 +551,7 @@ files:
size: 1048576
crc32: "1ac774d3"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db228"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db228 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v2.00/sc55_waverom2.bin"
@@ -556,7 +560,7 @@ files:
size: 1048576
crc32: "8dcc592a"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db238"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db238 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: sc55_waverom3.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55-v2.00/sc55_waverom3.bin"
@@ -565,7 +569,7 @@ files:
size: 1048576
crc32: "e21ebc04"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db248"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db248 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: rom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55mk2-v1.01/rom1.bin"
@@ -574,7 +578,7 @@ files:
size: 32768
crc32: "9b66631f"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db258"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db258 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: rom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55mk2-v1.01/rom2.bin"
@@ -583,7 +587,7 @@ files:
size: 524288
crc32: "fcee1e8e"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db268"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db268 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: rom_sm.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55mk2-v1.01/rom_sm.bin"
@@ -592,7 +596,7 @@ files:
size: 4096
crc32: "702c0a82"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db278"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db278 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: waverom1.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55mk2-v1.01/waverom1.bin"
@@ -601,7 +605,7 @@ files:
size: 2097152
crc32: "1519d3b3"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db288"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db288 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
- name: waverom2.bin
path: "sounddata/Nuked-SC55-Resources/ROMs/SC-55mk2-v1.01/waverom2.bin"
@@ -610,4 +614,4 @@ files:
size: 1048576
crc32: "0f826c7f"
validation: [size, crc32]
- source_ref: "DREAMM 4.0 linux-x64: ROM manifest 0x23db298"
+ source_ref: "DREAMM 4.0 linux-x64: ROM manifest entry 0x23db298 {crc32, size, path} read through the pointer at 0x242e9f0 by the name, size and CRC32 match 0x16456a0 and the size and CRC32 to path lookup 0x1645880"
diff --git a/emulators/epsxe.yml b/emulators/epsxe.yml
index 1598b88e8..334de3a24 100644
--- a/emulators/epsxe.yml
+++ b/emulators/epsxe.yml
@@ -61,13 +61,10 @@ notes: |
ends. The HLE branch, taken when the BiosHLE setting is on, skips the read
entirely and logs " * ePSXe: using HLE BIOS (compatibility limited)", so any
one of the images below fills the slot and none of them is needed on its own.
- HLE arrived in 1.9.25 and savestates made under it are not interchangeable
- with savestates made under a real image.
ref: ePSXe 2.0.5 Linux x64 load_bios 0x433540-0x433621,
ePSXe 2.0.5 Linux x64 bios_name_select 0x4334c0-0x4334f2,
ePSXe 2.0.5 Linux x64 write_configfiledefault 0x42ae99-0x42aeeb,
- ePSXeReadPreferences.java:20-30, ePSXe.java:445-453,
- docs/ePSXe_en.txt:260-271, docs/ePSXe_en.txt:883-888
+ ePSXeReadPreferences.java:20-30, ePSXe.java:445-453
Both consumer families carry a table of the images they recognise, and the two
tables are built differently and do not hold the same set. Android ships 21
@@ -90,11 +87,8 @@ notes: |
No region decides which image is taken. findBios keeps the first md5 that
answers anywhere in the walk, the Windows ids only pick a label to display, and
- the JP, US and PAL words are part of that label string. Automatic selection of
- a required BIOS per game existed once and was removed because it stopped
- Legend of Dragoon US and Wild Arms 2 US from running.
- ref: ScanBiosTask.java:167-171, ePSXe 2.0.18 Windows 0x42f5aa-0x42f5c2,
- docs/ePSXe_en.txt:1243-1244
+ the JP, US and PAL words are part of that label string.
+ ref: ScanBiosTask.java:167-171, ePSXe 2.0.18 Windows 0x42f5aa-0x42f5c2
Video, sound, cdrom and input go through the PSEmu Pro plugin interface.
init_gpu builds plugins/ from the configured name, dlopens it and
diff --git a/emulators/fpse-ng.yml b/emulators/fpse-ng.yml
index 9897c8943..5f38217fb 100644
--- a/emulators/fpse-ng.yml
+++ b/emulators/fpse-ng.yml
@@ -70,13 +70,11 @@ notes: |
of 0x80000 bytes after "Loading '%s'...", and a miss reports "Can't load
biosfile '%s', switching to HLE", sets the HLE bit and writes
"CEX-3000/1001/1002 by K.S.", "System ROM Version 2.2 12/04/95 A" and the Sony
- copyright line into BIOS memory, so no image is needed on its own. The FAQ on
- the emulator's own site states that a file named scph1001.bin is recommended
- and is not distributed with the emulator.
+ copyright line into BIOS memory, so no image is needed on its own.
ref: Main.java:1169, Main.java:21925-21927, Main.java:25833-25835,
Main.java:9943-9977, Main.java:30177-30192, Main.java:5392-5396,
Main.java:36446-36451, Main.java:28751-28754,
- libfpse.so 0x70e20-0x70f20, fpsece.net/faq.html
+ libfpse.so 0x70e20-0x70f20
Automatic detection recognises one dump and does it on content. Scanning
storage, FPseNG keeps files whose lowercased name ends in .bin and whose length
@@ -106,7 +104,8 @@ notes: |
Android runtime and are not files anyone supplies.
ref: Main.java:25134-25137, Main.java:27300-27312, Main.java:9985,
Main.java:1116-1133, Main.java:8496, Main.java:13854,
- Main.java:23615-23621, libfpse.so readelf -d
+ Main.java:23615-23621,
+ FPseNG 1.13 libfpse.so .dynamic DT_NEEDED 0x220ae0-0x220baf
Resources unpack through helpers that differ in one respect. The guarded one
writes only when the target is absent, so bios/kanji.rom, fpse.ini and the
@@ -171,7 +170,7 @@ files:
category: game_data
description: "software renderer plugin"
note: "Named by System.loadLibrary(\"soft1\") outside any catch and listed in DT_NEEDED by the core. Also holds the VR background loader."
- source_ref: "Main.java:27302, libfpse.so readelf -d"
+ source_ref: "Main.java:27302, FPseNG 1.13 libfpse.so DT_NEEDED libsoft1.so at 0x220af0 (loader-resolved)"
- name: libspuplugin.so
size: 51120
@@ -181,7 +180,7 @@ files:
category: game_data
description: "sound plugin"
note: "Named by System.loadLibrary(\"spuplugin\") outside any catch and listed in DT_NEEDED."
- source_ref: "Main.java:27301, libfpse.so readelf -d"
+ source_ref: "Main.java:27301, FPseNG 1.13 libfpse.so DT_NEEDED libspuplugin.so at 0x220b00 (loader-resolved)"
- name: libopengl.so
size: 688072
@@ -192,7 +191,7 @@ files:
aliases: ["libopengl1.so"]
description: "OpenGL renderer plugin"
note: "Named by System.loadLibrary(\"opengl\") outside any catch and listed in DT_NEEDED. A plugin chosen from the .so browser is copied over libopengl1.so under the root."
- source_ref: "Main.java:27304, Main.java:9985, libfpse.so readelf -d"
+ source_ref: "Main.java:27304, Main.java:9985, FPseNG 1.13 libfpse.so DT_NEEDED libopengl.so at 0x220ae0 (loader-resolved)"
- name: libnfsplugin.so
size: 300944
@@ -202,7 +201,7 @@ files:
category: game_data
description: "NFS client plugin, for discs read from a network share"
note: "Named by System.loadLibrary(\"nfsplugin\") outside any catch and listed in DT_NEEDED. Backs the isnfsbios and copyfromnfs entry points."
- source_ref: "Main.java:27303, Main.java:25670, libfpse.so readelf -d"
+ source_ref: "Main.java:27303, Main.java:25670, FPseNG 1.13 libfpse.so DT_NEEDED libnfsplugin.so at 0x220b30 (loader-resolved)"
- name: libsdl.so
size: 67536
@@ -212,7 +211,7 @@ files:
category: game_data
description: "SDL audio backend"
note: "Named by System.loadLibrary(\"sdl\") from a static block that catches UnsatisfiedLinkError, and listed in DT_NEEDED, so the core will not link without it."
- source_ref: "Main.java:25134, libfpse.so readelf -d"
+ source_ref: "Main.java:25134, FPseNG 1.13 libfpse.so DT_NEEDED libsdl.so at 0x220b20 (loader-resolved)"
- name: libneon.so
size: 5688
@@ -222,7 +221,7 @@ files:
category: game_data
description: "NEON colour conversion routines"
note: "Named by System.loadLibrary(\"neon\") from the same static block and listed in DT_NEEDED."
- source_ref: "Main.java:25135, libfpse.so readelf -d"
+ source_ref: "Main.java:25135, FPseNG 1.13 libfpse.so DT_NEEDED libneon.so at 0x220b10 (loader-resolved)"
- name: libuncompress.so
size: 1512392
@@ -232,7 +231,7 @@ files:
category: game_data
description: "archive extractor for .zip, .rar, .7z, .ape and .ecm images"
note: "Named by System.loadLibrary(\"uncompress\") outside any catch, and the only one of the plugins the core does not list in DT_NEEDED."
- source_ref: "Main.java:27300, Main.java:25408, libfpse.so readelf -d"
+ source_ref: "Main.java:27300, Main.java:25408, FPseNG 1.13 libfpse.so .dynamic DT_NEEDED 0x220ae0-0x220baf (no libuncompress.so)"
# The Shaders setting walks FPse64/shaders and reads the selected pair,
# passing the bytes to setVSH and setFSH. The packaged set below is copied
diff --git a/emulators/fpse.yml b/emulators/fpse.yml
index 6386b8238..d8538e43e 100644
--- a/emulators/fpse.yml
+++ b/emulators/fpse.yml
@@ -95,7 +95,7 @@ notes: |
ref: Main.java:29686-29698, Main.java:20405-20406, Main.java:11010,
Main.java:3417-3423, Main.java:1120-1137,
FPse 0.11.190 Main.java:24126-24207, FPse 0.11.190 Main.java:860-871,
- FPse 12.1 libfpse.so readelf -d,
+ FPse 12.1 libfpse.so .dynamic DT_NEEDED 0x37652c-0x376593,
fpse.net/plugins605v7.zip md5 ae5dbdc27452092af3e712448f427fd3
Resources unpack through two helpers that differ in one respect. b2 writes only
@@ -181,7 +181,7 @@ files:
category: game_data
description: "SDL 1.2 audio backend"
note: "Named by System.loadLibrary(\"sdl\") and listed in DT_NEEDED."
- source_ref: "Main.java:20405, FPse 12.1 libfpse.so readelf -d"
+ source_ref: "Main.java:20405, FPse 12.1 libfpse.so DT_NEEDED libsdl.so at 0x37654c (loader-resolved)"
- name: libneon.so
size: 5308
@@ -191,7 +191,7 @@ files:
category: game_data
description: "NEON colour conversion routines"
note: "Named by System.loadLibrary(\"neon\") and listed in DT_NEEDED, which resolves bgr555rgb565neon for the core."
- source_ref: "Main.java:20406, FPse 12.1 libfpse.so readelf -d"
+ source_ref: "Main.java:20406, FPse 12.1 libfpse.so DT_NEEDED libneon.so at 0x376544 (loader-resolved)"
- name: libuncompress.so
size: 1138680
diff --git a/emulators/future-pinball-fploader.yml b/emulators/future-pinball-fploader.yml
index 6e141e1c1..33c191bca 100644
--- a/emulators/future-pinball-fploader.yml
+++ b/emulators/future-pinball-fploader.yml
@@ -7,8 +7,9 @@ profiled_date: "2026-08-11"
source_commit: "e13007994011ae57dd9d9f48674c1f774183914b"
core_version: "1.5-408"
version_basis:
- kind: unverified
- why: no_artifact
+ kind: package
+ url: "https://www.ravarcade.pl/files/BAM_v1.5-408.zip"
+ artifact: "BAM_v1.5-408.zip, BAM/BAM.dll fixed file version 1.5.408.0"
display_name: "Future Pinball (BAM)"
cores:
- future-pinball-fploader
@@ -42,7 +43,10 @@ notes: |
/Open, /Play, /Exit and /ArcadeRender reach it.
ref: BAM_FPloader FPLoader.cpp:40-48, 87-111, 166-240, 249-257
- BAM.dll is closed source. Its version resource reads 1.5.408 and its debug
+ BAM.dll is closed source. The copy in BAM_v1.5-408.zip, served by
+ ravarcade.pl, has sha256
+ f3163c34adc3423d0b4c1f64399a91d090b4f7d0c54dc35049833466645645f7. Its version
+ resource reads 1.5.408 and its debug
tags name BAM.cpp, dllmain.cpp, BallManager.cpp, RenderEngine.cpp,
plugin.cpp, pbo.cpp, stereo3d.cpp and debug.cpp. Twenty five entry points are
detoured in one pass: CreateFileA, CreateFileW, ReadFile, WriteFile,
@@ -87,24 +91,36 @@ notes: |
path and is what the presets under XML\ are edited copies of. The 83 GLSL
programs BAM renders with are
resources of type TEXT inside BAM.dll, so no shader file is read from disk.
- ref: BAM.dll 1.5-408 .text:0x1002d4f3-0x1002d52d, 0x100ae8ec-0x100ae990,
+ ref: BAM.dll 1.5-408 FUN_1002d470 0x1002d4ff-0x1002d58b, FUN_1002d0d0 0x1002d2b8-0x1002d33c,
+ FUN_100ae3b0 0x100ae8ec-0x100ae990,
0x10037130-0x100371de, 0x1007e83b-0x1007e896, .rsrc TEXT,
Future Pinball.exe 1.9.1.20101231 .rsrc BMP, SHADERS, XML
Plugins are loaded by changing the working directory to plugins\, walking
- *.dll with FindFirstFileA, calling LoadLibraryA on each and binding
- BAM_PluginStart and BAM_PluginStop. A plugin keeps its settings by writing a
- raw structure to .cfg in that working directory, which is why
- the cfg files beside the plugins carry no text.
- ref: BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c,
- BAM_Plugins Common/BAM.h:116-157
+ *.dll with FindFirstFileA and calling LoadLibraryA on each under
+ SetErrorMode(SEM_FAILCRITICALERRORS). A module without BAM_load is freed, so a
+ plugin whose own imports are missing is skipped and BAM carries on. The rest
+ get BAM_PluginStart, BAM_PluginStop, BAM_GetCOM and the other entry points
+ bound. BAM_Plugins, published by the same author, holds the source of the
+ OpenVR and PostFX plugins and the common header, read at commit aa27aa3a.
+ A plugin keeps its settings by writing a raw structure to
+ .cfg in that working directory, which is why the cfg files
+ beside the plugins carry no text.
+ ref: BAM.dll 1.5-408 FUN_100cf360 0x100cf3d2-0x100cf48c (GetModuleFileNameA,
+ plugins\, *.dll, _getcwd, _chdir, FindFirstFileA), 0x100cf74f-0x100cf767
+ (SetErrorMode, LoadLibraryA), 0x100cf78e-0x100cf7aa (BAM_load, FreeLibrary),
+ 0x100cf7cf-0x100cf8c7 (BAM_PluginStart, BAM_PluginStop, BAM_GetCOM),
+ BAM_Plugins Common/BAM.h:117-157
renderingengine.dll is bound in BAM.dll's import directory through
FindProgram, SetModuleWithResources, LoadFileToMemory and SaveFileFromMemory,
so the loader resolves it before any BAM code runs. It carries Assimp, zlib,
libpng and libjpeg, reads the zip packs and writes the per table shadow cache
under Cache\.
- ref: BAM.dll 1.5-408 import directory, .text:0x10105c18-0x1010697f
+ ref: BAM.dll 1.5-408 import descriptor renderingengine.dll IAT 0x1055ea0c-0x1055eb1f (69 functions,
+ no delay-load directory), FUN_1007d650 0x1007dccd-0x1007dcd6 (SetModuleWithResources, RE::Init),
+ FUN_101053d0 0x10105c65-0x10105cca (Cache\%s-shadows, %s\%s.%s with zip),
+ 0x10105df9 (LoadFileToMemory)
ES-DE declares the emulator as FUTURE-PINBALL-FPLOADER for Windows only,
finding FPLoader.exe under BAM\, BAM-OpenVR\ or BAM-OpenVR-OC\, and invokes it
@@ -141,10 +157,11 @@ files:
size: 8791552
sha1: "b471bb4affb974e0af9874ee6fe28c4417809926"
description: "Rendering engine and asset loader behind BAM"
- source_ref: "BAM.dll 1.5-408 import directory, BAM_FPloader FPLoader.cpp:249-257"
+ source_ref: "BAM.dll 1.5-408 import descriptor renderingengine.dll IAT 0x1055ea0c-0x1055eb1f (69 functions, no delay-load directory, so loader-resolved), FUN_1007d650 0x1007dccd (SetModuleWithResources), 0x1007dcd6 (RE::Init), FUN_1002d0d0 0x1002d2b8 (GetZipHandler on a ball zip), BAM_FPloader FPLoader.cpp:249-257"
note: >-
Bound statically by BAM.dll, so the injected LoadLibraryA fails without
- it. The loader adds its own directory to %PATH% for this file alone.
+ it and no BAM code runs. The loader adds its own directory to %PATH% for
+ this file alone.
- name: Future Pinball.exe
system: fpinball
@@ -166,11 +183,12 @@ files:
bundled: true
size: 207104
description: "Head tracking calibration host"
- source_ref: "BAM-Tracker.exe import directory, BAM.dll 1.5-408 .text:0x1008320e"
+ source_ref: "BAM-Tracker.exe 1.5-408 (sha256 b2841b993dafde56) import descriptor BAM.dll IAT 0x41702c-0x41703b (BT::GetTrackersList, SetTracker, GetData, Kill, loader-resolved), FUN_00407460 0x407480 (GetTrackersList), 0x40750e (SetTracker), BAM.dll 1.5-408 FUN_100829a0 0x100831f0-0x10083260 (GetCommandLineA, _strlwr, strstr for bam-tracker.exe, flag 0x108009ab)"
note: >-
- Imports BAM.dll and runs it outside the game. BAM.dll lowercases the host
- command line and looks for this name to know it is hosted by the tracker
- rather than by Future Pinball.
+ A separate program the user starts. It imports BAM.dll and drives its
+ trackers outside the game. BAM.dll lowercases the host command line and
+ looks for this name to know it is hosted by the tracker rather than by
+ Future Pinball. Nothing in the loader or in BAM.dll starts it.
- name: ModelImporter.exe
sha1: dd3874742bfe5f9c2828cb9c4e249c2f4722bd51
@@ -179,10 +197,11 @@ files:
bundled: true
size: 4553472
description: "Converts models to the .fpm form tables import"
- source_ref: "ModelImporter.exe import directory, .rdata dialog filter"
+ source_ref: "ModelImporter.exe 1.5-408 (sha256 a693549f20697b02) import descriptor renderingengine.dll IAT 0x71e4bc-0x71e60b (84 functions, loader-resolved), 0x42db53 (lpstrFilter 3D Models *.fpm;*.obj;*.ms3d;*.md5mesh;*.fbx), FUN_0042da70 0x42dae9 (GetOpenFileNameA), FUN_00431d40 0x431dc3 (ImportedModel::Load on the chosen file)"
note: >-
- Bound to renderingengine.dll for the Assimp side. Its open dialog accepts
- .fpm, .obj, .ms3d, .md5mesh and .fbx.
+ A separate program the user starts. It needs renderingengine.dll beside it
+ for the Assimp side. Its open dialog accepts .fpm, .obj, .ms3d, .md5mesh
+ and .fbx.
# -- Settings read from the BAM directory. BAM writes each of them, so a fresh
# install has only default.seq and the first save creates the rest.
@@ -294,7 +313,7 @@ files:
category: game_data
size: 480842
description: "Ball texture showing the rotation axes"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: Baseball.zip
sha1: badfe5b7ab16c88f3fe255143546932c09fc2097
@@ -305,7 +324,7 @@ files:
category: game_data
size: 248548
description: "Baseball ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: Basketball 1.zip
sha1: 5aff2d72c317d58a6f1951811a31ec1b99dfdfe4
@@ -316,7 +335,7 @@ files:
category: game_data
size: 148883
description: "Basketball ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: Basketball 2.zip
sha1: 1fa517b848c69c0b2c2f3a32e4097a157fff3aa2
@@ -327,7 +346,7 @@ files:
category: game_data
size: 74296
description: "Second basketball ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: Cue Black.zip
sha1: 9238286e57f346fd9b9ed3d8ffa977083b9d3feb
@@ -338,7 +357,7 @@ files:
category: game_data
size: 548084
description: "Black cue ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: Cue White.zip
sha1: 948eec0af66150dc908622bd48e867e85fb0d6c5
@@ -349,7 +368,7 @@ files:
category: game_data
size: 554040
description: "White cue ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: earth.zip
sha1: 0b30d717df74d90c26769d58055b507b89fdc1fc
@@ -360,7 +379,7 @@ files:
category: game_data
size: 728508
description: "Globe ball texture, three BMP resources"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: EYETOY.zip
sha1: 89d8f29048176e8faff89cd48d0eda7b4875bf49
@@ -371,7 +390,7 @@ files:
category: game_data
size: 373860
description: "EyeToy ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: Fireball.zip
sha1: 28a08c3911ef46aca8880587bed56dfa4f99062a
@@ -382,7 +401,7 @@ files:
category: game_data
size: 240337
description: "Fireball ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: Knight.zip
sha1: 969d38e02a6759629cc827501a049c60582d9531
@@ -393,7 +412,7 @@ files:
category: game_data
size: 421287
description: "Knight ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: latlong.zip
sha1: d2f65f0f32e21dfc65d61a384df525dedbc57a8a
@@ -404,7 +423,7 @@ files:
category: game_data
size: 1066167
description: "Latitude and longitude grid ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
- name: Soccer Ball 1.zip
sha1: 0a1e886e991d88761502d8434248e986bf9c238f
@@ -415,7 +434,7 @@ files:
category: game_data
size: 54397
description: "Soccer ball texture"
- source_ref: "BAM.dll 1.5-408 .text:0x1002d513-0x1002d52d"
+ source_ref: "BAM.dll 1.5-408 FUN_1002d470 0x1002d513-0x1002d52b (balls\\*.zip beside BAM.dll, FindFirstFileA), 0x1002d58b (FUN_1002d0d0: GetZipHandler 0x1002d2b8, LoadTexture BMP/452.BMP 0x1002d2e0)"
# -- Physics documents, reached through XML_Presets.txt --
@@ -592,7 +611,7 @@ files:
required: false
size: 3388680
description: "Head tracking from any webcam, desktop geometry"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
note: "Bound to AVICAP32 and MSVFW32 and reads the cascade files below. The 1.5-408 zip moves it to removed_plugins\\, while bam-setup.exe installs it here."
- name: Simple Cam.dll
@@ -601,7 +620,7 @@ files:
required: false
size: 3262728
description: "Head tracking from any webcam, cabinet geometry"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
note: "The 1.5-408 zip moves it to removed_plugins\\, while bam-setup.exe installs it here."
- name: PS3Eye.dll
@@ -610,7 +629,7 @@ files:
required: false
size: 1699080
description: "Head tracking from a PlayStation Eye"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
note: "Bound to CLEyeMulticam.dll, which comes from the CL-Eye SDK. The 1.5-408 zip moves it to removed_plugins\\, while bam-setup.exe installs it here."
- name: DesktopPS3Eye.dll
@@ -619,7 +638,7 @@ files:
required: false
size: 1813768
description: "PlayStation Eye tracking with desktop geometry"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
note: "The 1.5-408 zip moves it to removed_plugins\\, while bam-setup.exe installs it here."
- name: HT-PS3Eyes.dll
@@ -630,7 +649,7 @@ files:
bundled: true
size: 1432272
description: "Two PlayStation Eye cameras tracking an infrared marker"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
note: >-
Keeps its calibration in HT-PS3Eyes.dat and HT-PS3Eyes-FixCamExport.dat
beside itself, both produced by the calibration pass.
@@ -643,7 +662,7 @@ files:
bundled: true
size: 2792144
description: "Head tracking from a Kinect for Xbox 360"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
note: "Bound to Kinect10.dll and FaceTrackLib.dll."
- name: DesktopKinect.dll
@@ -654,7 +673,7 @@ files:
bundled: true
size: 31952
description: "Kinect tracking with desktop geometry"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
- name: Kinect2.dll
sha1: 22e32cd595f825b004c10d46746cd28c973f649b
@@ -664,7 +683,7 @@ files:
bundled: true
size: 2791632
description: "Head tracking from a Kinect for Windows v2"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
note: "Bound to Kinect20.dll."
- name: FaceTrackLib.dll
@@ -675,7 +694,11 @@ files:
bundled: true
size: 920272
description: "Microsoft face tracking library used by the Kinect plugins"
- source_ref: "DesktopKinect.dll, Kinect.dll import directories"
+ source_ref: "Kinect.dll (sha256 3e3225474bfca5ad) import descriptor FaceTrackLib.dll IAT 0x1021e000-0x1021e007 (FTCreateImage, FTCreateFaceTracker, loader-resolved), 0x10003ae2 (FTCreateFaceTracker), DesktopKinect.dll (sha256 4aa59e24530b739e) import descriptor FaceTrackLib.dll IAT 0x10005000-0x10005007, 0x10002954 (FTCreateFaceTracker)"
+ note: >-
+ A load time dependency of the two Kinect 1 plugins, resolved from the
+ plugins\ working directory. Without it their LoadLibraryA fails and BAM
+ skips them.
- name: FaceTrackData.dll
sha1: aeb806a4330ce8716feffdd844e71084a86b2f88
@@ -685,7 +708,11 @@ files:
bundled: true
size: 10650832
description: "Model data for the face tracking library"
- source_ref: "FaceTrackLib.dll .rdata, wide literal FaceTrackData.dll"
+ source_ref: "FaceTrackLib.dll (sha256 381e24c0dc0e8471) FUN_10051fe0 0x10052072-0x100520af (no model path from the caller: GetModuleFileNameW, cut at the last backslash, StringCchCopyW of FaceTrackData.dll), 0x10052408 (FUN_1004d830 on \\AAMModel\\3DModel.txt), FUN_10009460 0x10009520 (the part of the path up to .dll passed to FUN_10009390), FUN_10009390 0x1000940c (LoadLibraryExW with flags 0x22, as a data file), FUN_10009460 0x1000956a (FUN_10008fc0, FindResourceW type RT_RCDATA at 0x10009032 for the rest)"
+ note: >-
+ The face tracker's models are RCDATA resources inside this file, named
+ AAMModel, MouthModel, EvalModel, NeuralNet and ViewModel paths under it.
+ FaceTrackLib looks for it beside itself, so in plugins\.
- name: FreeTrack.dll
sha1: 8bb00560edc99048cda818cb81afa823e8d1a682
@@ -695,7 +722,7 @@ files:
bundled: true
size: 95440
description: "Head tracking from a FreeTrack server"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
- name: TrackIR.dll
sha1: 000deaf4533b239cd3c22f250dcbb0d55123dc16
@@ -705,11 +732,12 @@ files:
bundled: true
size: 20176
description: "Head tracking from a NaturalPoint TrackIR"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c, TrackIR.dll .text:0x100018c7"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent), TrackIR.dll (sha256 101dc5958e8e3df0) 0x10001970-0x1000198a (detours LoadLibraryA and GetProcAddress, originals kept at 0x100043c4 and 0x100043c8), FUN_100018c0 0x100018c7-0x100018e1 (strstr for NPClient, module handle kept), FUN_10001900 0x10001917-0x10001962 (NP_GetData from that module answered by the plugin's wrapper)"
note: >-
- Matches the name NPClient with strstr and pairs LoadLibraryA with
- GetProcAddress on it. The plugin imports no registry function, so the
- client library is resolved as a plain module name.
+ Loads nothing itself. It detours LoadLibraryA and GetProcAddress in the
+ game, so when Future Pinball loads NPClient.dll from the TrackIR install
+ the plugin keeps the module handle and puts its own NP_GetData in front of
+ the real one.
- name: PostFX.dll
sha1: 52a49fdbb9328a54e9add344def6636be3d151e1
@@ -719,7 +747,7 @@ files:
bundled: true
size: 39632
description: "Bloom and the unfinished ambient occlusion pass"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf5ff, BAM_Plugins PostFX/PostFX.cpp:41-45"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent), 0x100cf5ff-0x100cf605 (_stricmp of the file name with PostFX.dll), BAM_Plugins PostFX/PostFX.cpp:41-45"
note: >-
Named in BAM.dll and compared against the enumerated file names, so it is
the one plugin the mod knows by name. Its nine GLSL programs are TEXT
@@ -727,6 +755,17 @@ files:
under this name, the 39632 bytes of bam-setup.exe and 191240 bytes in
BAM-OpenVR.zip.
+ - name: PostFX.cfg
+ sha1: a191e0c95a4ef116d073f18ae7ccb8c0af3f68bb
+ system: fpinball
+ path: "plugins/PostFX.cfg"
+ required: false
+ bundled: true
+ size: 104
+ description: "Settings block of the PostFX plugin"
+ source_ref: "PostFX.dll (sha256 30f9ce9cc725420f) FUN_10001280 0x100012ca-0x100012db (PostFX, .cfg after the working directory), FUN_10001320 0x10001668 (fopen_s rb), 0x10001683 (fread 0x68 bytes), BAM_Plugins PostFX/main.cpp:101, BAM_Plugins PostFX/main.cpp:130, BAM_Plugins Common/BAM.h:117-157"
+ note: "Read as a raw 104 byte structure and written back when a value changes. The OpenVR package carries its own copy for its PostFX build."
+
- name: PinballHighScore.dll
sha1: 7734aecaa3cd1d019db365aecfd9df2a5ef8efbe
system: fpinball
@@ -735,7 +774,7 @@ files:
bundled: true
size: 918224
description: "Records high scores across tables"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent)"
- name: PinballHighScore.cfg
sha1: 852b39ba5db64e8a84e4b0612521caa5bd44fe02
@@ -745,7 +784,11 @@ files:
bundled: true
size: 1016
description: "Settings block the high score plugin reads and writes"
- source_ref: "BAM_Plugins Common/BAM.h:136-157"
+ source_ref: "PinballHighScore.dll (sha256 f6fd7ed1c79302a7) FUN_10086c90 0x10086caa-0x10086cf9 (GetCurrentDirectoryA, backslash, PinballHighScore, .cfg), FUN_10084240 0x100842c5 (fopen_s rb), 0x100842e2 (fread 0x3f8 bytes), FUN_10084310 0x10084367 (fopen_s wb when the block changed)"
+ note: >-
+ Read whole as a 1016 byte block from the working directory, which BAM has
+ set to plugins\. Missing, the defaults stay in memory and the next change
+ writes it.
- name: PinballHighScore.db
system: fpinball
@@ -753,7 +796,7 @@ files:
required: false
size: 45056
description: "Score database the plugin opens by name"
- source_ref: "PinballHighScore.dll .rdata"
+ source_ref: "PinballHighScore.dll (sha256 f6fd7ed1c79302a7) FUN_100847e0 0x100847f5-0x100847fa (SQLite open of PinballHighScore.db, FUN_1007f9b0), 0x1008480e, 0x10084825 (CREATE TABLE localPlayerData and config), FUN_10085320 0x10085345-0x1008534a (the same open)"
note: "Only BAM-OpenVR.zip carries a copy. The plugin creates one otherwise."
- name: PuPPlugin.dll
@@ -764,8 +807,10 @@ files:
bundled: true
size: 240216
description: "PuPCOM script object drawing PinUP Player video onto table textures"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c, PuPPlugin.dll .rdata IPuPCOM, PuPPlugin.dll PuPVideo"
- note: "Takes BAM_GetTextureId and BAM_ReplaceTexture from the plugin API."
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent), 0x100cf8c7 (GetProcAddress BAM_GetCOM), PuPPlugin.dll (sha256 a9b3f1d04621cfc2) FUN_10001f50 0x10002167-0x1000217f (GetProcAddress BAM_GetTextureId, BAM_ReplaceTexture), BAM_GetCOM 0x10002687-0x100026ea (GetModuleFileNameW of itself, LoadTypeLib, GetTypeInfoOfGuid)"
+ note: >-
+ Takes BAM_GetTextureId and BAM_ReplaceTexture from the plugin API and
+ hands BAM the PuPCOM object described by its own embedded type library.
- name: icom.dll
sha1: 83a3b55b2cc1b29997d50cf38108f6725d9a0df2
@@ -775,11 +820,21 @@ files:
bundled: true
size: 67280
description: "Gives a table script the COM objects the cabinet stack exposes"
- source_ref: "BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c, icom.dll .rdata ProgID pattern"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent), icom.dll (sha256 b569f792df2cc10e) FUN_10001670 0x100016d1-0x100016d9 (std::wregex over the ProgID), 0x10001720 (CLSIDFromProgID), 0x1000173b (CoCreateInstance)"
note: >-
- Matches created objects against
- PinUpPlayer, Vpinmame, B2S, PUPDMDControl, UltraDMD, PinSSF and
- DirectOutput.
+ Creates the object a script asks for when its ProgID matches
+ (PinUpPlayer|Vpinmame|B2S|PUPDMDControl|UltraDMD|PinSSF|DirectOutput)\.(.*).
+
+ - name: iCom.cfg
+ sha1: 0aaf76f425c6e0f43a36197de768e67d9e035abb
+ system: fpinball
+ path: "plugins/iCom.cfg"
+ required: false
+ bundled: true
+ size: 4
+ description: "Security level setting of the icom plugin"
+ source_ref: "icom.dll (sha256 b569f792df2cc10e) FUN_100015f0 0x1000160a-0x10001659 (GetCurrentDirectoryA, backslash, iCom, .cfg), FUN_100019f0 0x10001a74 (fopen_s rb), 0x10001a8e (fread 4 bytes)"
+ note: "The one value behind the menu entry Security Level."
- name: OpenVR.dll
system: fpinball
@@ -787,7 +842,7 @@ files:
required: false
size: 419328
description: "Renders the table to an OpenVR headset"
- source_ref: "BAM_Plugins OpenVR/main.cpp, BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c"
+ source_ref: "BAM.dll 1.5-408 FUN_100cf360 (plugins::Load) 0x100cf48c (FindFirstFileA on plugins\\*.dll), 0x100cf75a (LoadLibraryA), 0x100cf794 (GetProcAddress BAM_load, FreeLibrary when absent), OpenVR.dll (sha256 52d598d0c964cd67) exports BAM_load 0x10001b90 and BAM_PluginStart 0x10001bf0, BAM_Plugins Common/BAM_inc.h:67-81, BAM_Plugins OpenVR/main.cpp:106"
note: "Ships only in BAM-OpenVR.zip, a separate build with its own BAM.dll, which ES-DE also looks for as BAM-OpenVR\\."
- name: openvr_api.dll
@@ -796,7 +851,19 @@ files:
required: false
size: 620760
description: "Valve OpenVR runtime interface"
- source_ref: "OpenVR.dll import directory"
+ source_ref: "OpenVR.dll (sha256 52d598d0c964cd67) import descriptor openvr_api.dll IAT 0x1003e1cc-0x1003e1e3 (6 functions, loader-resolved), FUN_100066f0 0x1000670e (VR_InitInternal2), BAM_Plugins OpenVR/OpenVR_client.cpp:785"
+ note: "A load time dependency of OpenVR.dll, resolved from the plugins\\ working directory."
+
+ - name: OpenVR.cfg
+ sha1: 21cedece67cf04ee71617462c27b9b4a455e4fd7
+ system: fpinball
+ path: "plugins/OpenVR.cfg"
+ required: false
+ bundled: true
+ size: 128
+ description: "Settings block of the OpenVR plugin"
+ source_ref: "OpenVR.dll (sha256 52d598d0c964cd67) FUN_10001b10 0x10001b23-0x10001b77 (GetCurrentDirectoryA, backslash, OpenVR, .cfg), FUN_10001ef0 0x10002238-0x10002265 (FUN_10001b10, fopen rb, fread 0x90 bytes), reached from BAM_load at 0x10001bdd, BAM_Plugins OpenVR/main.cpp:42, BAM_Plugins OpenVR/main.cpp:106, BAM_Plugins OpenVR/main.cpp:291"
+ note: "The plugin reads up to 144 bytes, the copy in BAM-OpenVR.zip holds 128, and the rest keeps its defaults. Written back whenever the settings change."
- name: haarcascade_frontalface_alt.xml
sha1: 035eef24478ebf4b16c788dbd02f8b3a3f9b8951
@@ -807,7 +874,8 @@ files:
category: game_data
size: 919871
description: "OpenCV Haar cascade for frontal faces"
- source_ref: "DesktopCam.dll, PS3Eye.dll, Simple Cam.dll .rdata"
+ source_ref: "BAM 1.5-408 plugins, PS3Eye.dll (sha256 191996d48372d75f) BAM_load 0x1000208d (FUN_10001c10 caches GetCurrentDirectoryA plus a backslash at 0x10228d48 while plugins::Load holds plugins\\ as the working directory), FUN_10002440 0x10002581-0x100025e3 (that directory, then entry 0 of the table 0x10175008, index 0x1018e360 clamped to 0..2), 0x1000266d (load FUN_100e2420: FileStorage 0x100e2529, open 0x10057fa3 reaching cvOpenFileStorage FUN_10067eb0, isOpened 0x100e2558, cvLoad FUN_100679d0 at 0x100e25a3), detectMultiScale empty test 0x100e01d0-0x100e01db, DesktopCam.dll (sha256 4928c27ab0ea5bd0) BAM_load 0x10001856 (FUN_100011d0, buffer 0x103b3330), FUN_10001ee0 0x10001fc0-0x10002022 (entry 0 of 0x1031aee0), 0x10002096 (load FUN_10127870: FileStorage 0x101279c8, isOpened 0x101279f3, cvLoad FUN_100732d0 at 0x10127a62), empty test 0x10127cbb-0x10127cc6, Simple Cam.dll (sha256 3b232df5e99b23c0) BAM_load 0x10002173 (FUN_10001cf0, buffer 0x103a09b8), FUN_10002370 0x1000245e-0x100024c0 (entry 0 of 0x102d9020), 0x1000254a (load FUN_10111db0: FileStorage 0x10111eb9, isOpened 0x10111ee8, cvLoad FUN_1006b1b0 at 0x10111f33), empty test 0x1010fb64-0x1010fb6b, DesktopPS3Eye.dll (sha256 14dbb5b11749622c) BAM_load 0x100018cd (FUN_10001250, buffer 0x1023d748), FUN_100021c0 0x1000231c-0x1000237e (entry 0 of 0x101a6fd8), 0x100023f5 (load FUN_100f97a0: FileStorage 0x100f98f8, isOpened 0x100f9923, cvLoad FUN_10070830 at 0x100f9992), empty test 0x100f9beb-0x100f9bf6"
+ note: "One cascade is read at a time, the one the plugin index selects (0, 1 or 2), from the plugins\\ directory cached by BAM_load. All four plugins link OpenCV 2.4 statically. cvLoad is the one function holding \"Could not find the/an object in file storage\", and its only caller is the routine the plugin calls with the path, which constructs a FileStorage, returns false when isOpened fails, then falls back to cvLoad: cv::CascadeClassifier::load. The plugin never tests the result. With no cascade, detectMultiScale returns at its empty() test, so no face is reported and the game runs on."
- name: haarcascade_frontalface_default.xml
sha1: 85a317ce2fc0415741a41736e99bd281d2437568
@@ -818,7 +886,8 @@ files:
category: game_data
size: 1254733
description: "Second OpenCV Haar cascade for frontal faces"
- source_ref: "DesktopCam.dll, PS3Eye.dll, Simple Cam.dll .rdata"
+ source_ref: "BAM 1.5-408 plugins, PS3Eye.dll (sha256 191996d48372d75f) BAM_load 0x1000208d (FUN_10001c10 caches GetCurrentDirectoryA plus a backslash at 0x10228d48 while plugins::Load holds plugins\\ as the working directory), FUN_10002440 0x10002581-0x100025e3 (that directory, then entry 1 of the table 0x10175008, index 0x1018e360 clamped to 0..2), 0x1000266d (load FUN_100e2420: FileStorage 0x100e2529, open 0x10057fa3 reaching cvOpenFileStorage FUN_10067eb0, isOpened 0x100e2558, cvLoad FUN_100679d0 at 0x100e25a3), detectMultiScale empty test 0x100e01d0-0x100e01db, DesktopCam.dll (sha256 4928c27ab0ea5bd0) BAM_load 0x10001856 (FUN_100011d0, buffer 0x103b3330), FUN_10001ee0 0x10001fc0-0x10002022 (entry 1 of 0x1031aee0), 0x10002096 (load FUN_10127870: FileStorage 0x101279c8, isOpened 0x101279f3, cvLoad FUN_100732d0 at 0x10127a62), empty test 0x10127cbb-0x10127cc6, Simple Cam.dll (sha256 3b232df5e99b23c0) BAM_load 0x10002173 (FUN_10001cf0, buffer 0x103a09b8), FUN_10002370 0x1000245e-0x100024c0 (entry 1 of 0x102d9020), 0x1000254a (load FUN_10111db0: FileStorage 0x10111eb9, isOpened 0x10111ee8, cvLoad FUN_1006b1b0 at 0x10111f33), empty test 0x1010fb64-0x1010fb6b, DesktopPS3Eye.dll (sha256 14dbb5b11749622c) BAM_load 0x100018cd (FUN_10001250, buffer 0x1023d748), FUN_100021c0 0x1000231c-0x1000237e (entry 1 of 0x101a6fd8), 0x100023f5 (load FUN_100f97a0: FileStorage 0x100f98f8, isOpened 0x100f9923, cvLoad FUN_10070830 at 0x100f9992), empty test 0x100f9beb-0x100f9bf6"
+ note: "One cascade is read at a time, the one the plugin index selects (0, 1 or 2), from the plugins\\ directory cached by BAM_load. All four plugins link OpenCV 2.4 statically. cvLoad is the one function holding \"Could not find the/an object in file storage\", and its only caller is the routine the plugin calls with the path, which constructs a FileStorage, returns false when isOpened fails, then falls back to cvLoad: cv::CascadeClassifier::load. The plugin never tests the result. With no cascade, detectMultiScale returns at its empty() test, so no face is reported and the game runs on."
- name: lbpcascade_frontalface.xml
sha1: d668cbe8712f062bcc6af898ebb2937b73dcfd2d
@@ -829,7 +898,8 @@ files:
category: game_data
size: 51856
description: "OpenCV local binary pattern cascade for frontal faces"
- source_ref: "DesktopCam.dll, PS3Eye.dll, Simple Cam.dll .rdata"
+ source_ref: "BAM 1.5-408 plugins, PS3Eye.dll (sha256 191996d48372d75f) BAM_load 0x1000208d (FUN_10001c10 caches GetCurrentDirectoryA plus a backslash at 0x10228d48 while plugins::Load holds plugins\\ as the working directory), FUN_10002440 0x10002581-0x100025e3 (that directory, then entry 2 of the table 0x10175008, index 0x1018e360 clamped to 0..2), 0x1000266d (load FUN_100e2420: FileStorage 0x100e2529, open 0x10057fa3 reaching cvOpenFileStorage FUN_10067eb0, isOpened 0x100e2558, cvLoad FUN_100679d0 at 0x100e25a3), detectMultiScale empty test 0x100e01d0-0x100e01db, DesktopCam.dll (sha256 4928c27ab0ea5bd0) BAM_load 0x10001856 (FUN_100011d0, buffer 0x103b3330), FUN_10001ee0 0x10001fc0-0x10002022 (entry 2 of 0x1031aee0), 0x10002096 (load FUN_10127870: FileStorage 0x101279c8, isOpened 0x101279f3, cvLoad FUN_100732d0 at 0x10127a62), empty test 0x10127cbb-0x10127cc6, Simple Cam.dll (sha256 3b232df5e99b23c0) BAM_load 0x10002173 (FUN_10001cf0, buffer 0x103a09b8), FUN_10002370 0x1000245e-0x100024c0 (entry 2 of 0x102d9020), 0x1000254a (load FUN_10111db0: FileStorage 0x10111eb9, isOpened 0x10111ee8, cvLoad FUN_1006b1b0 at 0x10111f33), empty test 0x1010fb64-0x1010fb6b, DesktopPS3Eye.dll (sha256 14dbb5b11749622c) BAM_load 0x100018cd (FUN_10001250, buffer 0x1023d748), FUN_100021c0 0x1000231c-0x1000237e (entry 2 of 0x101a6fd8), 0x100023f5 (load FUN_100f97a0: FileStorage 0x100f98f8, isOpened 0x100f9923, cvLoad FUN_10070830 at 0x100f9992), empty test 0x100f9beb-0x100f9bf6"
+ note: "One cascade is read at a time, the one the plugin index selects (0, 1 or 2), from the plugins\\ directory cached by BAM_load. All four plugins link OpenCV 2.4 statically. cvLoad is the one function holding \"Could not find the/an object in file storage\", and its only caller is the routine the plugin calls with the path, which constructs a FileStorage, returns false when isOpened fails, then falls back to cvLoad: cv::CascadeClassifier::load. The plugin never tests the result. With no cascade, detectMultiScale returns at its empty() test, so no face is reported and the game runs on."
# -- Named by the code, absent from both distributions --
@@ -847,28 +917,33 @@ files:
system: fpinball
required: false
description: "CL-Eye Platform SDK driver interface for the PlayStation Eye"
- source_ref: "PS3Eye.dll, DesktopPS3Eye.dll, HT-PS3Eyes.dll import directories"
+ source_ref: "HT-PS3Eyes.dll (sha256 eda430e18e445668) import descriptor CLEyeMulticam.dll IAT 0x10108000-0x10108023 (9 functions, loader-resolved), 0x10004962 (CLEyeGetCameraCount), 0x10004a2f (CLEyeCreateCamera), PS3Eye.dll 0x10002480, 0x10002501, DesktopPS3Eye.dll 0x10002200, 0x1000229a (the same two calls)"
+ note: "A load time dependency of the three PlayStation Eye plugins. Without it their LoadLibraryA fails and BAM skips them."
- name: Kinect10.dll
system: fpinball
required: false
description: "Kinect for Windows SDK 1.x runtime"
- source_ref: "Kinect.dll, DesktopKinect.dll, FaceTrackLib.dll import directories"
+ source_ref: "Kinect.dll (sha256 3e3225474bfca5ad) import descriptor Kinect10.dll IAT 0x1021e1d8-0x1021e1fb (9 functions by ordinal, loader-resolved), FUN_10006980 0x10006ade (NuiInitialize, ordinal 14), DesktopKinect.dll (sha256 4aa59e24530b739e) FUN_10002e10 0x10002fa1 (NuiInitialize)"
+ note: "A load time dependency of the two Kinect 1 plugins. FaceTrackLib.dll does not import it."
- name: Kinect20.dll
system: fpinball
required: false
description: "Kinect for Windows SDK 2.0 runtime"
- source_ref: "Kinect2.dll import directory"
+ source_ref: "Kinect2.dll (sha256 3038bd37cfb6abff) import descriptor Kinect20.dll IAT 0x1021c1c8 (GetDefaultKinectSensor, loader-resolved), FUN_100036b0 0x100036c5 (GetDefaultKinectSensor)"
+ note: "A load time dependency of the Kinect 2 plugin. Without it its LoadLibraryA fails and BAM skips it."
- name: NPClient.dll
system: fpinball
required: false
description: "NaturalPoint TrackIR client library"
- source_ref: "TrackIR.dll .rdata"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_0045eff0 0x45f01a-0x45f08e (RegOpenKeyExA HKCU Software\\NaturalPoint\\NATURALPOINT\\NPClient Location, RegQueryValueExA Path), FUN_0045f100 0x45f1d9 (LoadLibraryA), TrackIR.dll FUN_100018c0 0x100018c7-0x100018e1 (the detoured LoadLibraryA keeps the handle of a name holding NPClient)"
note: >-
- Comes from a TrackIR install rather than from any BAM distribution, which
- is why no path is given here.
+ Loaded by Future Pinball itself from the TrackIR install directory the
+ registry names, and intercepted by the TrackIR plugin. It comes from a
+ TrackIR install rather than from any BAM distribution, which is why no
+ path is given here.
analysis:
written_not_read:
diff --git a/emulators/future-pinball.yml b/emulators/future-pinball.yml
index 2e069ac97..878d11988 100644
--- a/emulators/future-pinball.yml
+++ b/emulators/future-pinball.yml
@@ -35,7 +35,9 @@ notes: |
The release is named 1.9.1.20101231 but the executable inside it carries
FileVersion 1.9.2008.1225 in its version resource and prints
- "Version 1.9.1.20091231" in its own banner.
+ "Version 1.9.1.20091231" in its own banner. The executable unpacked from
+ FuturePinballSetup_v1.9.1.20101231.exe has sha256
+ da400d3b80ab855a6a6f63fd1b552cb9900cd3355925e6086a2d409df3b27a2d.
ref: Future Pinball.exe 1.9.1.20101231 .rsrc version, .text:0x0043d288-0x0043d298
Every relative path below hangs off one root. At startup GetModuleFileNameA
@@ -51,20 +53,16 @@ notes: |
out of the table file and no external media is opened while a table plays.
ref: Future Pinball.exe 1.9.1.20101231 .text:0x00457ede,0x00457f6f,0x00457fe6,0x0045805b,0x004417f6
- What a table can pull from outside itself is a resource library. Libraries
- are .fpl files, also OLE compound documents, holding models, textures, sounds,
- DMD fonts and scripts under one storage per item. The Texture, Sound, Model
- and DMD Font managers each offer Import, which copies the item into the table,
- and Link, which records the library name and the item name instead. The manual
- recommends always linking to the shipped model library. A linked library is
- opened by StgOpenStorage on the name as written, which resolves against the
- table's own folder, and on failure against the install directory plus
- "Libraries\". Both failing raises "Unabled to Open Library - ''" followed
- by "There will be some functions missing from the game." as a warning box, and
- the program carries on.
- ref: Future Pinball.exe 1.9.1.20101231 .text:0x004e6cf0-0x004e6ebf, .rsrc string 149-150,
- Future Pinball Manual.chm LibraryResourceManager.html, ModelManager.html, TextureManager.html,
- SoundManager.html, FontManager.html
+ What a table can pull from outside itself is a resource library, an .fpl
+ file that is also an OLE compound document. A library the table names is
+ opened by StgOpenStorage on the name as written, which resolves
+ against the table's own folder, and on failure against the install directory
+ plus "Libraries\". Both failing raises "Unabled to Open Library - ''"
+ followed by "There will be some functions missing from the game." as a warning
+ box, and the program carries on.
+ ref: Future Pinball.exe 1.9.1.20101231 FUN_004e6cf0 0x4e6d66 (StgOpenStorage on the name
+ as written), 0x4e6d8d-0x4e6dd8 (install directory, Libraries\, name, second StgOpenStorage),
+ 0x4e6e1c-0x4e6eb7 (string resources 149 and 150, MessageBoxA with MB_ICONWARNING)
A table script reaches outside itself through LoadExternalScript, whose result
is handed to VBScript's ExecuteGlobal. When the reference ends in .fpl the
@@ -73,34 +71,46 @@ notes: |
"Scripts\" prefix, then with "Tables\", and a miss reports
"Unable to load external script". No Scripts directory ships, so what it holds
is whatever a given table asks for.
- ref: Future Pinball.exe 1.9.1.20101231 .text:0x004797c0-0x00479905, 0x00478be0-0x00478c66,
- 0x00478d20, Future Pinball Manual.chm GlobalScript.html
+ ref: Future Pinball.exe 1.9.1.20101231 FUN_004797c0 0x47985a-0x479881 (lstrcmpiA of the
+ extension with fpl, then FUN_00478d20, which reaches the library opener FUN_004e6cf0
+ through FUN_004ed9c0 at 0x4eda31), 0x479891, 0x4798a7, 0x4798bd (FUN_00478be0 bare, with
+ Scripts\, with Tables\), 0x4798dc (the error string), FUN_00478be0 0x478c60 (CreateFileA
+ GENERIC_READ OPEN_EXISTING)
Settings live in the registry under HKCU\Software\Future Pinball, split into
GamePlayer, GamePlayer\Joypads and Editor keys. There is no ini file.
RetroBat writes resolution, aspect ratio, camera, render preset and the whole
- joypad map there before launching. Per table state is written to
- fpRAM\.fpRAM beside the program. Nothing in the program verifies a size
- or a hash on any file it opens, so the figures recorded below are those of the
- 1.9.1.20101231 release and are informative.
- ref: Future Pinball.exe 1.9.1.20101231 .text:0x0043aa80,0x00475602,0x00475892,
+ joypad map there before launching. Per table state is a compound file,
+ fpRam\.fpRAM under the install directory, holding one nvRam stream.
+ Nothing in the program verifies a size or a hash on any file it opens, so the
+ figures recorded below are those of the 1.9.1.20101231 release and are
+ informative.
+ ref: Future Pinball.exe 1.9.1.20101231 FUN_0046fac0 0x46faf4-0x46fb65 (HKCU
+ 0x80000001, Software\Future Pinball\ plus the key, RegOpenKeyExA,
+ RegQueryValueExA), 0x46fbbc-0x46fc32 (the same key, RegCreateKeyExA,
+ RegSetValueExA), FUN_004362e0 0x43639b (GamePlayer), FUN_0043bc40 0x43bc6e
+ (GamePlayer\Joypads), FUN_00431e30 0x431e55 (Editor), FUN_004755a0
+ 0x4755da-0x47562f (install directory, fpRam\, table name, .fpRAM),
+ 0x475752 (StgOpenStorage read, failure skips the restore at 0x47575a),
+ 0x475770 (nvRam stream), FUN_00475830 0x475892-0x475927 (same path,
+ StgCreateDocfile), FUN_00439f60 0x43aa5f-0x43aab7 (same path, DeleteFileA),
retrobat emulatorLauncher/Generators/Fpinball.Generator.cs:326-491
- Front ends drive it with the documented switches /Open "", /Play, /Exit
- and /ArcadeRender. ES-DE declares it for Windows only, as FUTURE-PINBALL
- finding "Future Pinball.exe" and as FUTURE-PINBALL-FPLOADER finding
+ Front ends drive it with the switches /Open "", /Play, /Exit and
+ /ArcadeRender, which WinMain compares beside RegServer, UnregServer,
+ Minimise, DemoMode and TableNumber. ES-DE declares it for Windows only, as
+ FUTURE-PINBALL finding "Future Pinball.exe" and as FUTURE-PINBALL-FPLOADER finding
"BAM\FPLoader.exe", both invoked with /Exit /Play /Open. The fpinball system
is a placeholder on its six other platforms. RetroBat maps the emulator keys
fpinball and bam to one generator, one install folder and the same
"Future Pinball.exe" presence check, swapping only the launched binary, and
- optionally starts dmdext against DmdDevice.ini to mirror the DMD. Batocera ran
- it in a wine bottle on x86_64 and dropped it for Visual Pinball. BAM is
+ optionally starts dmdext against DmdDevice.ini to mirror the DMD. BAM is
ravarcade's loader: FPLoader.exe starts the same executable with BAM.dll
injected, and it names none of its own files from inside Future Pinball.
ref: es-de resources/systems/windows/es_find_rules.xml:438-461,
- es-de resources/systems/windows/es_systems.xml, Future Pinball Manual.chm CommandLine.html,
- retrobat emulatorLauncher/Generators/Fpinball.Generator.cs:109-181,
- batocera-linux batocera-Changelog.md:214
+ es-de resources/systems/windows/es_systems.xml,
+ Future Pinball.exe 1.9.1.20101231 WinMain FUN_0042c480 0x42c5f0-0x42c710,
+ retrobat emulatorLauncher/Generators/Fpinball.Generator.cs:109-181
files:
@@ -115,10 +125,12 @@ files:
bundled: true
size: 446464
description: "Newton Game Dynamics, the rigid body solver under the ball physics"
- source_ref: "Future Pinball.exe 1.9.1.20101231 import directory"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 import descriptor Newton.dll IAT 0x53f340-0x53f48b (83 functions, no delay-load directory, so loader-resolved), FUN_00455b10 0x4581c4 (status line Initialising Newton..), 0x45823d (NewtonCreate, world kept in [esi+0x2d08] and 0x5cc80c), 0x458250 (NewtonWorldSetUserData), 0x45825f (NewtonSetSolverModel)"
note: >-
83 functions are bound from it, the largest third party surface in the
- binary. The process does not start without it.
+ binary. The loader resolves the import before WinMain, so the process does
+ not start without it. FUN_00455b10, reached from 0x4ede62, creates the
+ physics world.
- name: fmod.dll
sha1: ee8f68d94645de24be930d6f453297d5b7b4d052
@@ -127,11 +139,13 @@ files:
bundled: true
size: 162816
description: "FMOD 3 audio engine"
- source_ref: "Future Pinball.exe 1.9.1.20101231 import directory"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 import descriptor fmod.dll IAT 0x53f820-0x53f877 (22 functions, loader-resolved), FUN_0044a0f0 0x44a3ff-0x44a413 (FSOUND_SetHWND, FSOUND_SetOutput 2, FSOUND_SetDriver 0, FSOUND_SetMixer 4 through the thunks at 0x51b656-0x51b668), 0x44a420 (FSOUND_Init 44100 Hz, 32 channels), 0x44a425-0x44a434 (a failed init sends WM_CLOSE to the window at [esi+0xac])"
note: >-
- 22 functions bound, FSOUND_Init through the sample and stream calls. Every
- one of those calls passes FSOUND_LOADMEMORY, so it decodes the table's own
- buffers rather than reading files.
+ 22 functions bound, FSOUND_Init through the sample and stream calls. The
+ import makes it a start condition. FUN_0044a0f0 is the startup routine
+ WinMain calls at 0x42c8d8. Every sample and stream call passes
+ FSOUND_LOADMEMORY, so it decodes the table's own buffers rather than
+ reading files.
- name: devil.dll
sha1: 313a23600a169adbe130b1ae1784d8de437ce7d9
@@ -142,9 +156,11 @@ files:
bundled: true
size: 269312
description: "DevIL image decoder"
- source_ref: "Future Pinball.exe 1.9.1.20101231 import directory"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 import descriptor DevIL.dll IAT 0x53f074-0x53f093 (8 functions, loader-resolved), FUN_0044a0f0 0x44a3ea (ilInit at startup), FUN_00463420 0x463430 (ilGenImages), 0x46343b (ilBindImage), 0x463485 (ilLoadL on an image held in memory), 0x463495 (ilConvertImage to IL_RGB, IL_UNSIGNED_BYTE)"
note: >-
- 8 functions bound, ilInit through ilLoadL. Spelled DevIL.dll in the import
+ 8 functions bound, ilInit through ilLoadL, so the process does not start
+ without it. FUN_00463420 is the decoder the texture and preview paths call
+ (0x43f522, 0x4e6a7c, 0x4fb100). Spelled DevIL.dll in the import
descriptors and shipped lowercase, which the case insensitive loader treats
as one name.
@@ -157,10 +173,11 @@ files:
bundled: true
size: 27648
description: "DevIL image utility library, scaling and canvas resize"
- source_ref: "Future Pinball.exe 1.9.1.20101231 import directory"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 import descriptor ILU.dll IAT 0x53f13c-0x53f14b (4 functions, loader-resolved), FUN_0044a0f0 0x44a3f0 (iluInit at startup), FUN_00463420 0x463519 (iluImageParameter ILU_FILTER), 0x463523 (iluScale)"
note: >-
4 functions bound: iluInit, iluScale, iluEnlargeCanvas and
- iluImageParameter, used to fit imported artwork to texture dimensions.
+ iluImageParameter, used to fit decoded artwork to texture dimensions. The
+ import makes it a start condition.
- name: ilut.dll
sha1: 30566eda672fef3036fbd3998af3cc9fdcef38e7
@@ -171,10 +188,11 @@ files:
bundled: true
size: 16384
description: "DevIL toolkit layer, image to Windows bitmap conversion"
- source_ref: "Future Pinball.exe 1.9.1.20101231 import directory"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 import descriptor ILUT.dll IAT 0x53f150-0x53f15b (3 functions, loader-resolved), FUN_0044a0f0 0x44a3f8 (ilutRenderer ILUT_WIN32), FUN_00463420 0x4634a3 (ilutConvertToHBitmap), 0x4634b2 (ilutGetBmpInfo)"
note: >-
3 functions bound: ilutRenderer, ilutConvertToHBitmap and ilutGetBmpInfo,
- which produce the preview bitmaps the editor's manager windows draw.
+ which turn a decoded image into the Windows bitmap the manager windows
+ draw. The import makes it a start condition.
- name: libcurl.dll
sha1: 8189136493d48adc2bdeff1e77297ab988ae789d
@@ -183,13 +201,12 @@ files:
bundled: true
size: 626688
description: "HTTP client for the table feed"
- source_ref: "Future Pinball.exe 1.9.1.20101231 import directory, .text:0x0043dc70"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 import descriptor libcurl.dll IAT 0x53f87c-0x53f88b (4 functions, loader-resolved), FUN_0043d300 (dialog procedure of resource 0x1f0, DialogBoxParamA at 0x449559) 0x43dd3c (curl_easy_init), 0x43dd4f-0x43dd8d (curl_easy_setopt user agent FuturePinball-agent/1.0, URL http://www.pinsimdb.org/fpreleases/backend_xml.php, write callback 0x46e450), 0x43dd90 (curl_easy_perform), 0x43d694-0x43d6ff (the same sequence for a screenshot not yet in feeds\\)"
note: >-
Only four functions are bound, curl_easy_init, setopt, perform and cleanup,
- and the single use is fetching the table list from
- http://www.pinsimdb.org/fpreleases/backend_xml.php under the user agent
- FuturePinball-agent/1.0. The binding is static all the same, so the process
- still refuses to start without the file.
+ and both uses sit in the latest tables dialog, the table list and its
+ screenshots. The binding is static all the same, so the process still
+ refuses to start without the file.
- name: SciLexer.dll
sha1: 661675f4d8539e14f2be10d144ab986fc5fccb46
@@ -198,7 +215,7 @@ files:
bundled: true
size: 407552
description: "Scintilla, the editing control behind the table script editor"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x0042c501-0x0042c528"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 WinMain FUN_0042c480 0x42c4fc-0x42c501 (LoadLibraryA SciLexer.DLL), 0x42c511-0x42c524 (null handle: MessageBoxA The Scintilla DLL could not be loaded., handle stored as 0, startup continues at 0x42c528)"
note: >-
The one library taken with LoadLibraryA rather than the import directory.
A null return puts up "The Scintilla DLL could not be loaded.", stores a
@@ -206,8 +223,7 @@ files:
and only the script editor is lost.
# -- Resource libraries, resolved against the table's folder then against
- # \Libraries. Shipped names all start with fp and the manual asks
- # designers not to modify them, because a release replaces them.
+ # \Libraries.
- name: fpModels.fpl
sha1: 81f809456ad9fba296eff46f035a607a3d2cfba2
@@ -217,13 +233,12 @@ files:
bundled: true
category: game_data
size: 5166080
- description: "260 pinball part models, the library the manual tells tables to link"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x004e6cf0-0x004e6ebf, Future Pinball Manual.chm ModelManager.html"
+ description: "260 pinball part models"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004e6cf0 0x4e6d66 (StgOpenStorage on the linked name), 0x4e6d8d-0x4e6dd8 (install directory, Libraries\\, name, second StgOpenStorage)"
note: >-
- Models cannot be authored outside the development team, so a table that
- wants a bumper cap or a flipper bat either embeds a copy or links here, and
- the Model Manager documents linking as the recommended choice. Absent, the
- table still loads and every model it linked is missing.
+ A table that links a model from here instead of embedding it loses that
+ model when the library is absent. The table still loads, after the warning
+ box.
- name: fpTextures.fpl
sha1: 255cb14da5f49c7aaa210135638cfdc924130397
@@ -234,7 +249,7 @@ files:
category: game_data
size: 3495424
description: "90 textures for the standard table objects"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x004e6cf0-0x004e6ebf, Future Pinball Manual.chm TextureManager.html"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004e6cf0 0x4e6d66 (StgOpenStorage on the linked name), 0x4e6d8d-0x4e6dd8 (install directory, Libraries\\, name, second StgOpenStorage)"
note: >-
Carries the surface art the built in parts expect, bulbs, triggers,
plungers and the rest. Resolved the same way as every other library.
@@ -248,7 +263,7 @@ files:
category: game_data
size: 2813440
description: "82 ramp models, keyed by profile, width and height"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x004e6cf0-0x004e6ebf"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004e6cf0 0x4e6d66 (StgOpenStorage on the linked name), 0x4e6d8d-0x4e6dd8 (install directory, Libraries\\, name, second StgOpenStorage)"
note: >-
Storage names encode the shape and the dimensions, ramp-pool-t1_w30_h20
and so on, with a left and a right variant of each.
@@ -262,7 +277,7 @@ files:
category: game_data
size: 170496
description: "20 machine sounds, ball release, bumpers, coin in and the rest"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x004e6cf0-0x004e6ebf, Future Pinball Manual.chm SoundManager.html"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004e6cf0 0x4e6d66 (StgOpenStorage on the linked name), 0x4e6d8d-0x4e6dd8 (install directory, Libraries\\, name, second StgOpenStorage)"
- name: fpSphereMaps.fpl
sha1: 04efb8fe46d0ba6381b160afa92b87bb213ba461
@@ -273,7 +288,7 @@ files:
category: game_data
size: 223744
description: "11 sphere maps giving metal and plastic parts their reflections"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x004e6cf0-0x004e6ebf"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004e6cf0 0x4e6d66 (StgOpenStorage on the linked name), 0x4e6d8d-0x4e6dd8 (install directory, Libraries\\, name, second StgOpenStorage)"
note: >-
Storage names are bracketed, [chrome-silver], [chrome-gold] and similar,
which is how a material references one.
@@ -287,7 +302,7 @@ files:
category: game_data
size: 58880
description: "6 dot matrix fonts, named for their cell size"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x004e6cf0-0x004e6ebf, Future Pinball Manual.chm FontManager.html"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004e6cf0 0x4e6d66 (StgOpenStorage on the linked name), 0x4e6d8d-0x4e6dd8 (install directory, Libraries\\, name, second StgOpenStorage)"
note: >-
dmd05x05p through dmd08x13p. A DMD display element with no font draws
nothing.
@@ -301,7 +316,7 @@ files:
category: game_data
size: 364032
description: "3 playfield images, including the plunger cutout template"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x004e6cf0-0x004e6ebf"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004e6cf0 0x4e6d66 (StgOpenStorage on the linked name), 0x4e6d8d-0x4e6dd8 (install directory, Libraries\\, name, second StgOpenStorage)"
- name: fpScripts.fpl
sha1: 5a928b81cb1a3364605158e0c0b573c51b0f468f
@@ -311,13 +326,11 @@ files:
bundled: true
category: game_data
size: 4096
- description: "Script library, holding the one sample script the manual quotes"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x00478d20, Future Pinball Manual.chm GlobalScript.html"
+ description: "Script library"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004797c0 0x47985a-0x479881 (a reference whose extension is fpl goes to FUN_00478d20), FUN_004ed9c0 0x4eda31 (FUN_004e6cf0, the library opener)"
note: >-
- The manual's worked example is
- ExecuteGlobal LoadExternalScript("fpScripts.fpl\myscript"), which is the
- branch taken when a reference carries the .fpl extension. What ships is a
- single storage named testscript.
+ Reached by any LoadExternalScript reference whose library part ends in
+ .fpl. What ships is a single storage named testscript.
# -- Named individually elsewhere in the binary --
@@ -329,7 +342,7 @@ files:
category: game_data
size: 226816
description: "Template opened by File then New"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x00448ea9-0x00448edb"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004486d0 0x448ea9-0x448ed0 (install directory then NewTable.fpt into the table path buffer), 0x448edb (FUN_0043ec20, the table open, which calls FUN_004fc580 at 0x43ec67 for StgOpenStorage at 0x4fc650)"
note: >-
The install directory is copied into the default table path buffer and this
name appended, then the result goes through the ordinary table open. It is
@@ -343,11 +356,11 @@ files:
bundled: true
size: 8992653
description: "Development guide, 79 topics"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x00478477-0x004784c4"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_00478250 0x478477-0x4784ad (install directory, then Help\\Future Pinball Manual.chm when the command id is 0x8043), 0x4784be-0x4784c4 (ShellExecuteA open)"
note: >-
Opened with ShellExecuteA on the install directory plus this path when the
- help command carries id 0x8043. It is the only description of the library
- link mechanism and of LoadExternalScript.
+ help command carries id 0x8043. The program hands the path to the shell
+ and reads nothing itself.
- name: Script56.chm
installed_on: [retrobat]
@@ -355,13 +368,12 @@ files:
path: "Help/Script56.chm"
required: false
description: "Microsoft Windows Script 5.6 documentation, the VBScript reference"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x004784a3-0x004784c4"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_00478250 0x47848f-0x4784ad (any command id other than 0x8043 appends Help\\Script56.chm), 0x4784be-0x4784c4 (ShellExecuteA open)"
note: >-
The script editor's help falls to this path for every command id other
than 0x8043, again through ShellExecuteA against the install directory. No
Future Pinball release ships it: table scripts are VBScript and this is
- Microsoft's own reference for the language, expected to be dropped into
- Help beside the manual.
+ Microsoft's own reference for the language.
- name: fpLatestTables.xml
sha1: bd9de21def48b65b5382c403971a9062928b9345
@@ -371,12 +383,13 @@ files:
bundled: true
size: 752639
description: "Cached table list from pinsimdb.org"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x0043dc70-0x0043dc99, 0x0043e776-0x0043e79c"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_0043d300 0x43dc46-0x43dca6 (install directory, feeds\\, fpLatestTables.xml, CreateFileA GENERIC_READ OPEN_EXISTING), 0x43dccf-0x43dd1e (GetFileTime against GetSystemTimeAsFileTime, a copy 7 days old or more is fetched again), 0x43ddbf (FUN_00470ff0, fopen w, UTF-8 BOM, the fetched list written back), 0x43e755-0x43e79c (DeleteFileA on command 0x17b)"
note: >-
- libcurl writes it, CreateFileA with OPEN_EXISTING reads it back and
- DeleteFileA drops it when the panel refreshes. The code builds the path as
- feeds\ against a directory the installer creates as Feeds. A snapshot ships
- with the release, so the panel has something to show before any fetch.
+ Read with CreateFileA when present and younger than 7 days, fetched and
+ rewritten otherwise, deleted by the refresh command. The code builds the
+ path as feeds\ against a directory the installer creates as Feeds. A
+ snapshot ships with the release, so the panel has something to show
+ before any fetch.
# -- Outside the program directory --
@@ -384,10 +397,11 @@ files:
system: fpinball
required: false
description: "NaturalPoint TrackIR client library, head tracking"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x0045f1b8-0x0045f1f8"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_0045eff0 0x45f01a-0x45f08e (RegOpenKeyExA HKCU Software\\NaturalPoint\\NATURALPOINT\\NPClient Location, RegQueryValueExA Path), FUN_0045f100 0x45f16b-0x45f1cf (separator then NPClient.dll appended), 0x45f1d9 (LoadLibraryA, a null handle jumps to 0x45f35a), 0x45f1f2-0x45f1f8 (GetProcAddress NP_GetSignature)"
note: >-
- The directory is read from HKCU\Software\NaturalPoint\NATURALPOINT\NPClient
- Location, this name appended and the result given to LoadLibraryA,
+ The directory is read from the Path value of
+ HKCU\Software\NaturalPoint\NATURALPOINT\NPClient Location, this name
+ appended and the result given to LoadLibraryA,
then NP_GetSignature and the rest are bound with GetProcAddress. A null
handle jumps past all tracking setup. It comes from a TrackIR install, not
from any Future Pinball distribution, which is why no path is given here.
@@ -399,7 +413,7 @@ analysis:
than by a literal in the code, so there is no fixed filename to record.
entries:
- what: "Tables\\, four demonstration tables"
- source_ref: "FuturePinballSetup_v1.9.1.20101231.exe app/Tables"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_0043ee20 0x43f1d1-0x43f223 (install directory, Tables\\, then the table name, into the table path buffer at +0x18b88)"
note: >-
DmdDisplayDemo.fpt, LightSequencerDemo.fpt, Ramp-VUK-Demo.fpt and
SegmentDisplayDemo.fpt. The directory itself is the default table path
@@ -419,12 +433,12 @@ analysis:
LoadExternalScript takes whatever name the table's script passes. The
bare attempt resolves against the working directory, which is the
table's own folder. No Scripts directory ships.
- - what: "fpRAM\\.fpRAM, per table persistent state"
- source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x0043aa80, 0x00475602, 0x00475892"
+ - what: "fpRam\\.fpRAM, per table persistent state"
+ source_ref: "Future Pinball.exe 1.9.1.20101231 FUN_004755a0 0x4755da-0x47562f (install directory, fpRam\\, table name, .fpRAM), 0x475752 (StgOpenStorage, a failure skips the restore), FUN_00475830 0x475892-0x475927 (StgCreateDocfile on the same path), FUN_00439f60 0x43aab7 (DeleteFileA)"
note: >-
- Built as the prefix, the table name and the .fpRAM extension. Written
- from play, so it is save data rather than something to obtain. The
- installer creates the directory empty.
+ Built as the prefix, the table name and the .fpRAM extension, and
+ created by StgCreateDocfile from play, so it is save data rather than
+ something to obtain. A missing file only skips the restore.
- what: "DmdFonts\\ and Models\\, editor working directories"
source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x00443595, 0x00443efc, 0x00516ba8, 0x00516d31, 0x00441fc8, 0x004429bb, 0x004317fa"
note: >-
@@ -442,8 +456,7 @@ analysis:
note: >-
Passed to the toolbar builder, which calls CreateToolbarEx with
hBMInst zero and a bitmap handle held in a global as wBMID. The module
- has no resource under that name and neither syscall trace shows an open
- for it, although both traces reach the main window.
+ has no resource under that name.
- what: "tables\\ in lower case"
source_ref: "Future Pinball.exe 1.9.1.20101231 .text:0x00439e40-0x00439e79"
note: >-
diff --git a/emulators/lexaloffle.yml b/emulators/lexaloffle.yml
index 1b28f72d4..9b76f151e 100644
--- a/emulators/lexaloffle.yml
+++ b/emulators/lexaloffle.yml
@@ -50,6 +50,13 @@ notes: |
archive: which binary runs, and from which folder, is the launcher's choice.
The amd64 and raspi archives carry pico8.dat 10b39730, byte for byte.
+ Refs to binary code cite these files by sha256 prefix: amd64 pico8
+ b07e76cd6a033650, amd64 pico8_dyn ca4e55eda8933a83, raspi pico8
+ cee03b8ffd89bd38, raspi pico8_dyn 443e9553a6aa81dd, raspi pico8_gpio
+ f9df817ffa37257e, raspi pico8_64 ad56e8ed1ad812ca, windows pico8.exe
+ 9d0b31219e536304. The Linux binaries keep their symbol tables, so the
+ function names are those of the binary.
+
Launchers by platform, each read at the revision the platform file pins:
- Batocera lexaloffleGenerator.py runs bios/pico-8/pico8 and raises when it
is missing or not executable, with LD_LIBRARY_PATH set to bios/pico-8.
@@ -109,7 +116,7 @@ files:
sha1: 946db0633966afecf81d2b33957c7db8fb3a2356
description: "PICO-8 0.2.7 armhf executable, SDL2 linked in"
note: "The pico8 of pico-8_0.2.7_raspi.zip, a 32-bit ARM ELF that needs libbcm_host.so, so it runs on Raspberry Pi firmware only. Batocera's fixed path is the one a 32-bit Raspberry Pi board (bcm2835, bcm2836) can run."
- source_ref: "batocera lexaloffleGenerator.py:17, 48-52"
+ source_ref: "pico-8 0.2.7 raspi pico8, DT_NEEDED libbcm_host.so at 0x27647c (loader-resolved), RPI_VideoInit 0x1741ac bl bcm_host_init at 0x1741b8, batocera lexaloffleGenerator.py:17, 48-52"
- name: pico8
path: pico-8/pico8
@@ -132,8 +139,8 @@ files:
md5: 70ab37eab4e7d162d36d9b2d91b84867
sha1: 4ed23b6578a2d93d67aa856791dc70e95d68a3f4
description: "PICO-8 0.2.7 aarch64 executable, system libSDL2"
- note: "pico8_64 is only in pico-8_0.2.7_raspi.zip, the build for 64-bit Raspberry Pi OS, linked against the system SDL2. AmberELEC and ROCKNIX run it from roms/pico-8/, not from bios/. AmberELEC stops with a message when it is missing. ROCKNIX picks it when HW_ARCH is aarch64. Recalbox renames bios/pico-8/pico8_64 to pico8 before the first run, and a missing file fails the rename."
- source_ref: "pico-8 0.2.7 raspi readme_raspi.txt:3-11, amberelec packages/amberelec/sources/pico-8.sh:51-54, amberelec packages/amberelec/sources/scripts/runemu.py:123, rocknix projects/ROCKNIX/packages/emulators/standalone/pico-8/scripts/start_pico8.sh:8-17, 35-40, 46-47, recalbox projects/configgen/configgen/generators/pico8/pico8Generator.py:14-19, dArkOS pico8/pico8.sh:47-60, 128-135"
+ note: "pico8_64 is only in pico-8_0.2.7_raspi.zip, an aarch64 ELF linked against the system SDL2. AmberELEC and ROCKNIX run it from roms/pico-8/, not from bios/. AmberELEC stops with a message when it is missing. ROCKNIX picks it when HW_ARCH is aarch64. Recalbox renames bios/pico-8/pico8_64 to pico8 before the first run, and a missing file fails the rename."
+ source_ref: "pico-8 0.2.7 raspi pico8_64, DT_NEEDED libSDL2-2.0.so.0 at 0x17cb08 (loader-resolved), codo_system_init 0xefd20 bl SDL_Init at 0xefd7c, amberelec packages/amberelec/sources/pico-8.sh:51-54, amberelec packages/amberelec/sources/scripts/runemu.py:123, rocknix projects/ROCKNIX/packages/emulators/standalone/pico-8/scripts/start_pico8.sh:8-17, 35-40, 46-47, recalbox projects/configgen/configgen/generators/pico8/pico8Generator.py:14-19, dArkOS pico8/pico8.sh:47-60, 128-135"
- name: pico8_dyn
path: pico-8/pico8_dyn
@@ -145,7 +152,7 @@ files:
sha1: 9b2e573250c70382b4071709a85c8d56c0371d59
description: "PICO-8 0.2.7 x86_64 executable, system libSDL2"
note: "The pico8_dyn of pico-8_0.2.7_amd64.zip, the same program linked against the system SDL2. RetroDECK lists it as required in its manifest, but its launcher executes pico8 only. Batocera never runs it. ROCKNIX runs it from roms/pico-8/ on x86_64, its HW_ARCH other than aarch64."
- source_ref: "pico-8 0.2.7 amd64 pico8_dyn, NEEDED libSDL2-2.0.so.0, RetroDECK pico-8/component_manifest.json:26-32, RetroDECK pico-8/component_launcher.sh:3, rocknix projects/ROCKNIX/packages/emulators/standalone/pico-8/scripts/start_pico8.sh:10-17, 48"
+ source_ref: "pico-8 0.2.7 amd64 pico8_dyn, DT_NEEDED libSDL2-2.0.so.0 at 0x796da0 (loader-resolved), codo_system_init 0x519b50 call SDL_Init@plt at 0x519bb3, RetroDECK pico-8/component_manifest.json:26-32, RetroDECK pico-8/component_launcher.sh:3, rocknix projects/ROCKNIX/packages/emulators/standalone/pico-8/scripts/start_pico8.sh:10-17, 48"
- name: pico8_dyn
path: pico-8/pico8_dyn
@@ -157,7 +164,7 @@ files:
sha1: 87ef68e70c53ba209e697bb51de45826e982d92d
description: "PICO-8 0.2.7 armhf executable, system libSDL2"
note: "The pico8_dyn of pico-8_0.2.7_raspi.zip, 32-bit, linked against the system SDL2. EmuELEC copies bios/pico-8 to /emuelec/bin/pico-8 and runs pico8_dyn with no existence check. KNULLI's installer stops when the archive lacks it and moves it to bios/pico-8, and the RG35XX simplermenu launcher runs it. ROCKNIX runs a pico8_dyn from roms/pico-8/ on a HW_ARCH other than aarch64, and ArkOS falls back to it when pico8_64 is absent."
- source_ref: "pico-8 0.2.7 raspi readme_raspi.txt:3-11, emuelec packages/sx05re/emuelec/bin/pico8.sh:9-14, 39-43, knulli board/fsoverlay/usr/bin/knulli-install-pico8:9, 38-41, 67, knulli board/actions/atm7039/rg35xx/fsoverlay/usr/share/knulli/datainit/system/configs/simplermenu_plus/launchers/pico8_sa:3, rocknix projects/ROCKNIX/packages/emulators/standalone/pico-8/scripts/start_pico8.sh:14-16, dArkOS pico8/pico8.sh:49-50"
+ source_ref: "pico-8 0.2.7 raspi pico8_dyn, DT_NEEDED libSDL2-2.0.so.0 at 0x15b00c (loader-resolved), codo_system_init 0xf2660 bl SDL_Init at 0xf26a8, emuelec packages/sx05re/emuelec/bin/pico8.sh:9-14, 39-43, knulli board/fsoverlay/usr/bin/knulli-install-pico8:9, 38-41, 67, knulli board/actions/atm7039/rg35xx/fsoverlay/usr/share/knulli/datainit/system/configs/simplermenu_plus/launchers/pico8_sa:3, rocknix projects/ROCKNIX/packages/emulators/standalone/pico-8/scripts/start_pico8.sh:14-16, dArkOS pico8/pico8.sh:49-50"
- name: pico8_gpio
path: pico-8/pico8_gpio
@@ -168,8 +175,8 @@ files:
md5: 286ab30756dfc40749ecd72221f0d063
sha1: df77c64c95695710d23b451277325e0c37e7416e
description: "PICO-8 0.2.7 armhf executable with GPIO access (wiringPi)"
- note: "Only in pico-8_0.2.7_raspi.zip. The 32-bit build that maps the GPIO pins to 0x5f80..0x5fff, linked against libbcm_host.so and libwiringPi.so. KNULLI's installer stops when the archive lacks it and moves it to bios/pico-8, but no launcher runs it."
- source_ref: "pico-8 0.2.7 raspi readme_raspi.txt:3-11, knulli board/fsoverlay/usr/bin/knulli-install-pico8:10, 43-46, 68"
+ note: "Only in pico-8_0.2.7_raspi.zip. The 32-bit build linked against libbcm_host.so and libwiringPi.so: a peek of 0x5f80+n reads GPIO pin n through wiringPi, pins 0 to 31. KNULLI's installer stops when the archive lacks it and moves it to bios/pico-8, but no launcher runs it."
+ source_ref: "pico-8 0.2.7 raspi pico8_gpio, DT_NEEDED libbcm_host.so at 0x27702c and libwiringPi.so at 0x277034 (loader-resolved), pico8_peek_1 0x860ac 0x863ac-0x863b4 (address minus 0x5f80 passed to gpio_read), gpio_read 0xae6c0 0xae70c (wiringPiSetup), 0xae730 (pin above 31 reads 0), 0xae750 (pinMode), 0xae75c (digitalRead), knulli board/fsoverlay/usr/bin/knulli-install-pico8:10, 43-46, 68"
- name: pico8.dat
path: pico-8/pico8.dat
@@ -179,8 +186,8 @@ files:
md5: 10b397305093c80109096319a538ba56
sha1: 0f92093752bddb12210c7db6d93af3ba2413cfce
description: "PICO-8 0.2.7 data file (boot sequence, themes, demo carts)"
- note: "PICO-8 opens it from its own folder and quits with \"couldn't load /pico8.dat\" when it is absent (the amd64 pico8, run without it). Paired with the binary's own version, identical in pico-8_0.2.7_amd64.zip, pico-8_0.2.7_raspi.zip and pico-8_0.2.7_windows.zip. AmberELEC and ArkOS check for it before starting PICO-8, and KNULLI's installer stops when the archive lacks it."
- source_ref: "pico-8 0.2.7 amd64 pico8, string pico8.dat at 0x231bc0, pico-8 0.2.7 raspi pico8_64, string pico8.dat at 0x110138, amberelec packages/amberelec/sources/pico-8.sh:51-52, dArkOS pico8/pico8.sh:136-142, knulli board/fsoverlay/usr/bin/knulli-install-pico8:11, 48-51, 69"
+ note: "PICO-8 opens it from its own folder and quits with \"couldn't load /pico8.dat\" and exit status 0 when it is absent. Paired with the binary's own version, identical in pico-8_0.2.7_amd64.zip, pico-8_0.2.7_raspi.zip and pico-8_0.2.7_windows.zip. AmberELEC and ArkOS check for it before starting PICO-8, and KNULLI's installer stops when the archive lacks it."
+ source_ref: "pico-8 0.2.7 amd64 pico8 codo_main_init 0x407a90 0x407df8-0x407e09 (pico8.dat prefixed with the program folder), 0x407e1f (codo_load_pod, fopen rb at 0x4d1d90), 0x4084f2-0x408508 (printf couldn't load %s, exit when it returns null), pico-8 0.2.7 raspi pico8_64 codo_main_init 0xf724 0xfa34-0xfa50, 0xfa5c, 0x100c4-0x100d8 (same sequence), pico-8 0.2.7 windows pico8.exe _codo_main_init 0x403aa0 0x403e25-0x403e47, amberelec packages/amberelec/sources/pico-8.sh:51-52, dArkOS pico8/pico8.sh:136-142, knulli board/fsoverlay/usr/bin/knulli-install-pico8:11, 48-51, 69"
- name: pico8.exe
path: pico-8/pico8.exe
@@ -204,22 +211,22 @@ files:
sha1: 9174251921d675c204e683cdea65a8c906fcba28
description: "SDL2 library of the PICO-8 0.2.7 Windows build"
note: "pico8.exe imports SDL2.dll, which Windows loads from the executable's folder. Shipped beside it in pico-8_0.2.7_windows.zip."
- source_ref: "pico-8 0.2.7 windows pico8.exe, import table"
+ source_ref: "pico-8 0.2.7 windows pico8.exe import descriptor 0x912064 for SDL2.dll (93 functions from IAT 0x91277c, loader-resolved), _codo_system_init 0x4f9840 call _SDL_Init at 0x4f988e, thunk 0x521890 jmp [0x91285c] (SDL2.dll IAT slot)"
- name: config.txt
unsourceable: "written by the emulator on exit, no canonical file"
system: pico8
required: false
description: "PICO-8 settings"
- source_ref: "pico-8 0.2.7 amd64 pico8, string config.txt at 0x244739, pico-8 0.2.7 pico-8_manual.txt:250-259, 284"
- note: "Read beside the binary, then from the -home folder (~/.lexaloffle/pico-8 on Linux), and written there on exit when absent."
+ source_ref: "pico-8 0.2.7 amd64 pico8 codo_config_load 0x4d2900 0x4d2965-0x4d297d (config.txt in the -home folder), 0x4d2bbd (fopen r), 0x4d3411 (vdisk), 0x4d2a7b-0x4d2a85 and 0x4d348c (config.txt beside the binary), 0x4d34bb (neither: return with defaults), codo_config_save 0x4d37f0 0x4d37f4-0x4d3824 (written to the -home folder, called from codo_exit.part.1 at 0x4bf640), codo_prefix_with_appdata_path 0x518940 0x51894c (-home folder, else $HOME/.lexaloffle/)"
+ note: "Read from the -home folder (~/.lexaloffle/pico-8 on Linux), else from beside the binary, and written to the -home folder on exit."
- name: sdl_controllers.txt
unsourceable: "user supplied, no canonical file"
system: pico8
required: false
description: "Custom SDL controller mappings, one per line"
- source_ref: "pico-8 0.2.7 amd64 pico8, string sdl_controllers.txt at 0x24c896, pico-8 0.2.7 pico-8_manual.txt:301-302, 4053"
+ source_ref: "pico-8 0.2.7 amd64 pico8 add_sdl_controllers 0x518c00 0x518c04-0x518c46 (beside the binary, fopen r), 0x518c54-0x518c73 (the -home folder), 0x518c8a-0x518cab (created there with a comment line when absent), 0x518d5c-0x518d7a (fgets, SDL_GameControllerAddMapping per line), called from codo_joystick_init at 0x518e74"
note: "Processed first when present beside the binary, then read from the -home folder, where PICO-8 writes it when absent."
- name: favourites.txt
@@ -227,5 +234,5 @@ files:
system: pico8
required: false
description: "SPLORE favourites list"
- source_ref: "pico-8 0.2.7 amd64 pico8, string favourites.txt at 0x242346"
- note: "Read from the -home folder. The bbs/.pip.png images beside it are downloaded from the BBS."
+ source_ref: "pico-8 0.2.7 amd64 pico8 reload_favourites 0x4b0800 0x4b0801-0x4b0837, splore_init.part.19 0x4b2980 0x4b2bd5-0x4b2bed (populate_splore_list_from_text_file 0x4b0350, codo_fopen r at 0x4b038b), save_splore_favourites 0x4ab2d0 0x4ab2d4-0x4ab30c (fopen w)"
+ note: "Read from the -home folder and written there by SPLORE. The bbs/.pip.png images beside it are downloaded from the BBS."
diff --git a/emulators/mastergear.yml b/emulators/mastergear.yml
index 824418703..e46170f66 100644
--- a/emulators/mastergear.yml
+++ b/emulators/mastergear.yml
@@ -42,12 +42,11 @@ notes: |
and open the same files. The native libraries keep their symbol tables, so
the Android readings below cite libmain.so offsets in the x86_64 slice, and the
arm64-v8a, armeabi-v7a, armeabi and x86 slices carry the same filename set.
- No source has ever been published: the site states the code is not available
- to the general public and the documentation repeats it, while ColEm and fMSX
- on the same site ship source archives.
+ No source has been published: every MG download on the site is a binary
+ package, while ColEm and fMSX on the same site ship source archives.
ref: MG-Android-4900.apk META-INF/CERT.RSA, https://fms.komkon.org/MG/,
- MG.html "There is no version of MG for my Unix!",
- MG49-Windows-bin.zip, MG49-Ubuntu-x86-bin.tgz
+ MG49-Windows-bin.zip, MG49-Ubuntu-x86-bin.tgz (sha256
+ 25c8a0de74ed6eda, mg sha256 2d6b714cdbd4e6bd)
SF7000.ROM is the only system ROM either binary names, and it is read through
the cartridge loader. ResetSMS loads it whenever the requested hardware
@@ -66,14 +65,14 @@ notes: |
size 0x43dfa-0x43f1a, read 0x43f4f), LoadDSK 0x46db0-0x46ecb,
MG49-Ubuntu-x86-bin mg 0x3d0fd-0x3d124, 0x3c330 (0x3ca58)
- The other machines need no file. SEGA consoles boot from a small ROM that
- switches itself off and hands the hardware to the cartridge, which MG does
- not emulate, so MasterSystem, GameGear, SG1000 and SC3000 start straight into
- the cartridge. SC3000 mode adds the keyboard and 32kB of RAM, and its BASIC
- arrives as a cartridge like any other program: the packaged title database
- keys Basic 2.10 and Basic 3.10 by cartridge CRC32 under the SC3000 heading.
- ref: MG.html "What are MasterSystem and GameGear?", "How do I use SC3000
- keyboard?", assets/names.dat
+ The other machines open no system file. SF7000.ROM is the only system ROM
+ name in either binary, and the desktop build references it once, from the
+ SF7000 branch of the reset routine, so MasterSystem, GameGear, SG1000 and
+ SC3000 start straight into the cartridge. The SC3000 BASIC arrives as a
+ cartridge like any other program: the packaged title database keys Basic 2.10
+ and Basic 3.10 by cartridge CRC32 under the SC3000 heading.
+ ref: MG49-Ubuntu-x86-bin mg 0x3d0fd (sole reference to SF7000.ROM at
+ 0x5231a), libmain.so ResetSMS 0x43604, assets/names.dat
On Android one directory holds everything. MainActivity hands EMULib.k() to
jniStart, which copies it into the buffer GetHomeDir returns and passes that
@@ -82,19 +81,17 @@ notes: |
/, keeping the larger of the two when both open. That
directory is external storage joined with the application label up to its
first space, so /sdcard/MasterGear, falling back to getExternalFilesDirs(null)
- when it is not a writable directory, and the author's own cheat file writes the
- same path out in full. The desktop builds have no such directory and open
- every name where they stand, which the documentation states as the current
- directory. Every one of these opens ends in zlib, mopen handing the
+ when it is not a writable directory, and the cheat archive the author
+ publishes writes the same path out in full. The desktop builds have no such
+ directory and open every name where they stand. Every one of these opens ends in zlib, mopen handing the
descriptor OpenRealFile returned to gzdopen while the disk loader and the
desktop builds call gzopen straight, so each file also opens gzipped, and on
Android a content:// name is routed to the Android storage framework instead.
ref: MainActivity.java:2265-2276, EMULib.java:456, 494-553, 688-698,
libmain.so jniStart 0x18bb0-0x193e1 (0x1921c, 0x1926c),
SetPrivateDir 0x38f80, OpenRealFile 0x39190-0x393c3,
- mopen 0x393d0-0x3959d, LoadFDI 0x558f7,
- MG.html "How do I use SF7000 disk images?",
- EmuAndroid "System ROMs", MasterGear-Cheats.zip ROOT.chts
+ mopen 0x393d0-0x3959d, LoadFDI 0x558f7, MasterGear-Cheats.zip
+ ROOT.chts
files:
- name: SF7000.ROM
@@ -102,8 +99,8 @@ files:
required: true
size: 8192
description: "SF7000 IPL, read into the cartridge window before the machine starts"
- note: "Loaded whenever the hardware becomes SF7000, and the only fixed ROM name in the binary. A failed open drops the emulator back to the previous hardware, which makes every disk image refuse to mount. The loader checks neither length nor contents, so the documented 8kB image is padded to 16kB with FFh and no hash is compared. Opened by bare name, so it resolves against the working directory and, on Android, against the home directory as well, and a gzipped copy answers too."
- source_ref: "libmain.so ResetSMS 0x435a0-0x43b0d (LoadROM 0x43604), LoadROM 0x43c80-0x4451a, LoadDSK 0x46db0-0x46ecb, MG49-Ubuntu-x86-bin mg 0x3d0fd-0x3d124, MG.html \"How do I use SF7000 disk images?\""
+ note: "Loaded whenever the hardware becomes SF7000, and the only fixed ROM name in the binary. A failed open drops the emulator back to the previous hardware, which makes every disk image refuse to mount. The loader checks neither length nor contents, so an 8kB image is padded to 16kB with FFh and no hash is compared. Opened by bare name, so it resolves against the working directory and, on Android, against the home directory as well, and a gzipped copy answers too."
+ source_ref: "libmain.so ResetSMS 0x435a0-0x43b0d (LoadROM 0x43604), LoadROM 0x43c80-0x4451a, LoadDSK 0x46db0-0x46ecb, MG49-Ubuntu-x86-bin mg 0x3d0fd-0x3d124"
- name: MasterGear-Cheats.zip
required: false
@@ -115,10 +112,10 @@ files:
- name: custom.chts
required: false
category: game_data
- unsourceable: "cheat codes the user writes, in the format the documentation prints"
+ unsourceable: "cheat codes the user writes"
description: "user cheat sets added to the Cheatopedia menu"
note: "Pulled in by the File= directive that ROOT.chts carries, written out as /sdcard/MasterGear/custom.chts, and reached through the same lookup as any other set: package assets, then an absolute path, then the cheat directory."
- source_ref: "Cheatopedia.java:504-508, 565-584, MasterGear-Cheats.zip ROOT.chts, EmuAndroid \"I want to add my own cheats to the Cheatopedia\""
+ source_ref: "Cheatopedia.java:504-508, 565-584, MasterGear-Cheats.zip ROOT.chts"
- name: names.dat
sha1: 15f93bd7b0e58cc1ee8c5ff06cb5a085c686ace4
@@ -145,7 +142,7 @@ files:
category: game_data
description: "virtual joystick skin"
note: "Read as /Controls.png when the joystick shape is set to Custom Skin, and by the layout editor. The author publishes a 320x276 template at fms.komkon.org/EmuAndroid/Controls.png to draw over."
- source_ref: "MainActivity.java:1809, LayoutEditor.java:99, EmuAndroid \"Can I set my own virtual joystick images?\""
+ source_ref: "MainActivity.java:1809, LayoutEditor.java:99"
- name: Backdrop.png
required: false
diff --git a/emulators/mfme.yml b/emulators/mfme.yml
index 96d373a11..6ff717311 100644
--- a/emulators/mfme.yml
+++ b/emulators/mfme.yml
@@ -3,12 +3,12 @@ type: standalone
core_classification: embedded_hle
source: "https://www.desertislandfruits.com/"
upstream: closed-source
-profiled_date: "2026-08-08"
+profiled_date: "2026-11-10"
core_version: "20.1"
version_basis:
kind: package
- url: "https://www.desertislandfruits.com/"
- artifact: "MFME v20 Windows installer, MFME.exe FileVersion 20.1.0.0"
+ url: "https://archive.org/download/mfmev-20/MFMEv20.zip"
+ artifact: "MFMEv20.exe installer (zip md5 5f5faa0a99f993c27aa118ebb1a8e6b2), MFME.exe FileVersion 20.1.0.0, ProductVersion 20.0, sha256 8b3c873078b4a9d6edfcd24d18f8f6405253f8fcd8f3266bf944988b0fd4066a"
display_name: "MFME (Fruit Machines)"
cores:
- mfme
@@ -18,68 +18,88 @@ systems:
mode: standalone
notes: |
- Closed-source Delphi emulator for fruit machine and slot machine hardware,
+ Closed-source C++Builder VCL emulator for fruit machine and slot machine hardware,
written by Chris Wren (Wizard) and distributed as a Windows installer. MFME.exe
carries FileVersion 20.1.0.0, FileDescription "Multiple Fruit Machine Emulator" and
- copyright "C.J.Wren 1997-2020", and the installer targets Windows 10, defaults to
- C:\MFME\v20 (history.txt:323) and writes HKCU\Software\CJW\MFME. The binary is
- ASPack compressed, imports dinput8, xaudio2_9, d2d1 and d3d11 for input, sound
- and the hardware accelerated scaler added in v19.0 (history.txt:8-9), and holds
- its layout engine in Delphi units around an EasyCompression Library core.
- Development ended with the author's death, and Update.exe, reached from File ->
- Check For Updates (history.txt:235), no longer finds a server. ES-DE calls
- MFME.exe with a .gam path and the working directory set to the emulator
- folder, through find rules MFME and MFME-WINDOWS, and runs
- it under Wine or Proton on Linux; .gam is in the arcade and mame extension
+ copyright "C.J.Wren 1997-2020". The installer's setup data enables Windows 10
+ only (OS.dat), sets InstallDir C:\MFME\v20 (SC.dat) and writes InstallPath and
+ Installed under HKCU\Software\CJW\MFME (Registry.dat). MFME.exe keeps its
+ settings in a TRegIniFile opened on SOFTWARE\CJW, under the current user root
+ (FUN_004e2920 0x4e2e1b-0x4e2e28, key name at 0xae0a2e), section MFME
+ (0xae0a24). The binary is ASPack compressed, imports dinput8, xaudio2_9, d2d1
+ and d3d11 for input, sound and the hardware accelerated scaler, and holds its
+ layout engine in Delphi units around an EasyCompression Library core.
+ Addresses in the source_ref fields are virtual addresses of the image the ASPack
+ stub unpacks (image base 0x400000, entry 0x402a88), read from MFME.exe sha256
+ 8b3c873078b4a9d6.
+ The File menu item Check For Updates (form resource, OnClick
+ CheckForUpdates1Click at 0x5194f4) calls FUN_00515fec, which checks FileExists
+ on Update.exe in the MFME folder (0x516006-0x516042) and starts a thread that
+ fills a SHELLEXECUTEINFO with verb runas and that path (0x5195ca-0x519657) and
+ calls ShellExecuteExW (0x519945).
+ ES-DE calls MFME.exe with a .gam path and the working directory set to the
+ emulator folder, through find rules MFME and MFME-WINDOWS, and runs it under
+ Wine or Proton on Linux. .gam is in the arcade and mame extension
lists.
A machine is a folder holding a .gam file, the .fml layout it names and the ROM
set. The .gam is plain text: a System line naming the tech, DIP switch, reel,
stake, jackpot, percentage and meter state, a Layout line naming the .fml, a
- Game line, and one ROM line per ROM file. Layouts before v5 used .dat and are
- converted by loading them in v5 or v6 and saving, while v20 loads .fml only. The .fml
- is an AACS container whose password is derived from a four byte seed at the end
+ Game line, and one ROM line per ROM file. The .fml is an AACS container whose password is derived from a four byte seed at the end
of the file through a mixer, hashed with RIPEMD-128 into a Rijndael key, and
each chunk is zlib compressed. It holds the Delphi layout stream with every
bitmap embedded, carries no external file path, and text components name a font
- family rather than a font file. MFME.exe is started with the .gam path as its
- argument (history.txt:271).
+ family rather than a font file. FUN_00509a68 walks ParamStr 1 to ParamCount
+ (0x50a3c7-0x50aac8), takes the switches -g, -x, -y, -w, -h, -i, -mode,
+ -nohistory and -slave, and keeps any other argument that FileExists accepts,
+ expanded to a full path, as the file to open. Its extension sends a .gam to
+ FUN_004e85c0 (0x50ab40-0x50abb4) and a .fml to FUN_004f5a90 (0x50abc1-0x50ac2d).
ROM sets are per machine and self contained. Barcrest S4 and S5 sets are .LO and
.HI program files with a .BIN sound ROM, MPU5 sets are .p1 to .p4, and other
techs use .hex or .rom members named by the .gam. Fruit machine hardware has no
system BIOS, so nothing is shared between machines, and sound ROMs belong to the
- machine as well: an S4 game whose sound ROMs are absent still runs and reports
- Wrong Snd Err (history.txt:301). v20.0 added an automatic ROM download for DIF
- legacy layouts (history.txt:293). Ctrl-K resets a game with its alternate ROM
- set (tips.txt).
+ machine as well. FUN_00625c88 opens a file name starting with http through the
+ download path (0x625cc6-0x625d64), opens a local file when FileExists holds
+ (0x625d77-0x625d8a), and otherwise, unless the extension is .ram, .fml, .rtc,
+ .eep, .wsp or e2p (0x625dac-0x625f6e), prefixes it with
+ https://www.desertislandfruits.com/legacy/ (0xae531a, 0x625f7a) and fetches it
+ from there.
Effect samples are the mechanical cabinet sounds MFME plays itself, distinct
- from the game audio the sound ROM produces. Each effect has a fixed filename
- resolved in the game folder first, then DefaultSounds\Custom\\, then DefaultSounds (DefaultSounds/Readme.txt:78-84), and files are
- opened when required rather than at layout load (history.txt:210-211). A
- preference forces the defaults over the ones a layout selects
- (history.txt:219). The distribution ships Custom folders for 40 techs: ACEVIDEO,
+ from the game audio the sound ROM produces. The effect table at 0xad7ac8 holds
+ 55 entries of 12 bytes (file name, label, flags). FUN_005fad6c loads every
+ entry through FUN_005faa24, and FUN_005fb284 reloads one entry with the path
+ FUN_005158fc builds: the game folder unless the force defaults flag at 0xb915cc
+ is set (0x515b61-0x515b9c), then DefaultSounds\Custom\\\
+ with the style taken from the table at 0xa84cf4 (0x515a87-0x515afd, 0x515c38),
+ then DefaultSounds\. Each file goes through FUN_005f9584, which opens it with
+ mmio, expects a RIFF WAVE with a PCM fmt chunk and a data chunk, and returns
+ nothing otherwise, so a missing or unreadable sample leaves its effect silent.
+ The distribution ships Custom folders for 40 techs: ACEVIDEO,
ADDER5, ASTRASYSA1, BLACKBOX, COINMASTER, ELECTROCOIN, EPOCH, IGTS+, IGTS2000,
IMPACT, INDER, M1AB, M1VIDEO, MACH2000A, MACH2000E, MACH2000S, MMM, MPS2, MPU2,
MPU3, MPU4, MPU4PLASMA, MPU4VIDEO, MPU5, PCLMAXI, PHOENIX, PHOENIX2, PLUTO5,
PROCONN, SCORPION1, SCORPION2, SCORPION4, SCORPION5, SRU, SYS1, SYS5, SYS83,
SYS85, SYSTEM80 and spACE, with cabinet subfolders Eclipse for ADDER5,
SCORPION4 and SCORPION5, Elegance for EPOCH, and Genesis for MPU4 and MPU5.
- DefaultSounds/Readme.txt:35-37 lists the electronic token mech effects as
- CoinInToken, CoinInTokenSwitch and CoinInTokenRejected, but the files that ship and
- the entry that introduced them name them TokenIn, TokenInSwitch and
- TokenInRejected (history.txt:80).
+ The table names the electronic token mech effects TokenIn.wav, TokenInSwitch.wav
+ and TokenInRejected.wav (0xadb143, 0xadb158, 0xadb17a), the names the
+ distribution ships, and holds RelayOn.wav and RelayOff.wav, which the
+ distribution does not ship.
Three shipped directories are enumerated rather than looked up by name and
therefore expect no particular filename. DefaultBackdrops and DefaultTiles hold
- the images offered as a backdrop or tiled background in the full screen modes,
- picked at random when the preference is set (history.txt:48, 55-56), and ship
- one wallpaper and six tiles. DefaultSounds/MiscSounds holds alternate payout,
+ the images offered as a backdrop or tiled background in the full screen modes.
+ FUN_0051336c and FUN_005137dc walk \DefaultTiles\* and
+ \DefaultBackdrops\* with FindFirst and FindNext (0x5133ea-0x51379a,
+ 0x51385a-0x513c0a), keep .bmp, .jpg and .png names, and add each full path to
+ the lists at +0x1f78 and +0x1f7c. FUN_00513c4c and FUN_00513cf4 pick one entry
+ with System Random over the list count (0x513c90, 0x513d38). The distribution
+ ships one wallpaper and six tiles. DefaultSounds/MiscSounds holds alternate payout,
coin and note recordings that a user copies over an effect name. Fonts is
- scanned for the fonts a layout names, so its contents grow with the layouts
- installed.
+ enumerated by FUN_00511f0c, which registers up to 100 font files of any name,
+ so its contents grow with the layouts installed.
files:
# -- Output hardware library --
@@ -91,13 +111,12 @@ files:
required: true
bundled: true
description: "Ultimarc PacDrive, PacLed64 and UltimateIO output library"
- source_ref: "MFME.exe import directory, history.txt:278-279"
+ source_ref: "MFME.exe 20.1.0.0 packed PE import descriptor 0xdba03c (pacdrive32.dll, ordinal 11 into IAT 0xdba2c0, loader-resolved), ASPack stub restores IAT 0xc692ac-0xc692d4 (ordinals 11, 12, 6, 27, 20, 25, 26, 23, 2, 5, 3), FUN_0050f998 0x50fa27 (PacInitialize through thunk 0xa42234), 0x50fa55-0x50fa82 (PacGetDeviceType, PacGetDevicePath, PacGetVersionNumber, PacGetProductName, PacGetSerialNumber), 0x50fe21 (PacShutdown)"
note: >-
- Listed in the MFME.exe import descriptors, so the Windows loader resolves it
- at process start and MFME does not launch when it is absent from the
- application directory. Drives real cabinet lamps, hoppers and meters through
- Ultimarc boards. v20.0 updated the library and added PacLed64 and UltimateIO
- support.
+ A static import of the packed executable, so the Windows loader maps it before
+ any MFME code runs and the process does not start without it. Drives cabinet
+ lamps, hoppers and meters through Ultimarc PacDrive, PacLed64 and UltimateIO
+ boards.
# -- Fonts, scanned from the Fonts folder beside MFME.exe --
@@ -110,12 +129,12 @@ files:
bundled: true
category: game_data
description: "Lithograph Bold, the font layouts name for machine text"
- source_ref: "history.txt:38, 309"
+ source_ref: "MFME.exe 20.1.0.0 FUN_00511f0c 0x511f9e (exe folder + L\"Fonts\\*\"), 0x511fe0 (FindFirst), 0x512166-0x512306 (extension .ttf, .ttc, .fon, .otf, .pfb or .pfm), 0x5123d4 (L\"Fonts\\\" + name added to the list, at most 100), 0x51249f (AddFontResourceExW, FR_PRIVATE), called from 0x4e2920"
note: >-
- v19.0 moved font loading from installed system fonts to the Fonts folder
- where MFME is located. Layouts store a font family name, not a file: the
- decoded layout stream names Lithograph. A layout whose font is missing shows
- the name in red in the properties screen and renders with a substitute.
+ Fonts is enumerated, not looked up by file name: every font file found is
+ registered for the process only. The family Lithograph is the Font.Name of
+ MFME's own forms (DFM at 0xce48d9) and is set on new text at 0x5ec418.
+ Layouts store a family name, so a missing font falls back to a substitute.
- name: LITHOGRL.TTF
size: 61484
@@ -126,8 +145,8 @@ files:
bundled: true
category: game_data
description: "Lithograph Light, the font layouts name for machine text"
- source_ref: "history.txt:38, 309"
- note: "Same mechanism as LITHOGRB.TTF, the light weight of the same family."
+ source_ref: "MFME.exe 20.1.0.0 FUN_00511f0c 0x511f9e (exe folder + L\"Fonts\\*\"), 0x511fe0 (FindFirst), 0x512166-0x512306 (extension .ttf, .ttc, .fon, .otf, .pfb or .pfm), 0x5123d4 (L\"Fonts\\\" + name added to the list, at most 100), 0x51249f (AddFontResourceExW, FR_PRIVATE), called from 0x4e2920"
+ note: "Registered by the same Fonts enumeration as LITHOGRB.TTF, family LithographLight."
- name: MFME.ttf
size: 264428
@@ -137,9 +156,9 @@ files:
required: false
bundled: true
category: game_data
- description: "MFME segment and display font"
- source_ref: "history.txt:38, 168"
- note: "Shipped font used by MFME's own displays, updated in v19.5."
+ description: "MFME font, family MFME"
+ source_ref: "MFME.exe 20.1.0.0 FUN_00511f0c 0x511f9e (exe folder + L\"Fonts\\*\"), 0x511fe0 (FindFirst), 0x512166-0x512306 (extension .ttf, .ttc, .fon, .otf, .pfb or .pfm), 0x5123d4 (L\"Fonts\\\" + name added to the list, at most 100), 0x51249f (AddFontResourceExW, FR_PRIVATE), called from 0x4e2920"
+ note: "Registered by the same Fonts enumeration as LITHOGRB.TTF."
# -- Reel masks, applied when the Default option is selected --
@@ -152,10 +171,10 @@ files:
bundled: true
category: game_data
description: "Reel gradient mask applied to reel bands"
- source_ref: "DefaultMasks/Readme.txt:1"
+ source_ref: "MFME.exe 20.1.0.0 FUN_005e67c6 0x5e67e7 (exe folder + \"\\DefaultMasks\"), 0x5e6a9c (+ \"\\ReelGradientMask.bmp\"), 0x5e6ae7 (FileExists, nothing loaded when absent), 0x5e6b40 (bitmap load from the same path)"
note: >-
- Used when the Default option is chosen for the mask in the reel properties
- window. A custom mask stored in the layout replaces it.
+ Applied when the Default mask is chosen for a reel. A custom mask stored in
+ the layout replaces it.
- name: ReelLampMask.bmp
size: 108734
@@ -166,7 +185,7 @@ files:
bundled: true
category: game_data
description: "Reel lamp mask applied to reel bands"
- source_ref: "DefaultMasks/Readme.txt:1"
+ source_ref: "MFME.exe 20.1.0.0 FUN_005e67c6 0x5e67e7 (exe folder + \"\\DefaultMasks\"), 0x5e690c (+ \"\\ReelLampMask.bmp\"), 0x5e6957 (FileExists, nothing loaded when absent), 0x5e69af-0x5e69fa (bitmap created and loaded from the same path), FUN_0051bb70 0x51bb9b (exe folder + \"\\DefaultMasks\\ReelLampMask.bmp\"), 0x51bc33 (FileExists)"
note: "Same mechanism as ReelGradientMask.bmp, for the reel lamp overlay."
# -- Payout solenoid slides --
@@ -180,7 +199,7 @@ files:
bundled: true
category: game_data
description: "2p payout solenoid"
- source_ref: "DefaultSounds/Readme.txt:9, history.txt:44"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 39 at 0xad7c9c (\"2pSlide.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: 10pSlide.wav
size: 60834
@@ -191,7 +210,7 @@ files:
bundled: true
category: game_data
description: "10p payout solenoid"
- source_ref: "DefaultSounds/Readme.txt:10"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 4 at 0xad7af8 (\"10pSlide.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: 20pSlide.wav
size: 60834
@@ -202,7 +221,7 @@ files:
bundled: true
category: game_data
description: "20p payout solenoid"
- source_ref: "DefaultSounds/Readme.txt:11"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 17 at 0xad7b94 (\"20pSlide.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: 50pSlide.wav
size: 60834
@@ -213,7 +232,7 @@ files:
bundled: true
category: game_data
description: "50p payout solenoid"
- source_ref: "DefaultSounds/Readme.txt:12"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 18 at 0xad7ba0 (\"50pSlide.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: PoundSlide.wav
size: 60834
@@ -224,7 +243,7 @@ files:
bundled: true
category: game_data
description: "One pound payout solenoid"
- source_ref: "DefaultSounds/Readme.txt:13"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 31 at 0xad7c3c (\"PoundSlide.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: TokenSlide.wav
size: 84928
@@ -235,7 +254,7 @@ files:
bundled: true
category: game_data
description: "10p and 20p token payout solenoid"
- source_ref: "DefaultSounds/Readme.txt:14"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 5 at 0xad7b04 (\"TokenSlide.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: MiscSlide.wav
size: 63898
@@ -246,21 +265,39 @@ files:
bundled: true
category: game_data
description: "Five by 50p slide"
- source_ref: "DefaultSounds/Readme.txt:15"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 32 at 0xad7c48 (\"MiscSlide.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
# -- Meters and buttons --
- - name: meter.wav
+ - name: Meter.wav
size: 9260
sha1: d4c70ecc12d3be10d5a07784b6d07e9e3880e39a
system: fruitmachine
- path: "DefaultSounds/meter.wav"
+ path: "DefaultSounds/Meter.wav"
required: false
bundled: true
category: game_data
description: "Electromechanical meter step"
- source_ref: "DefaultSounds/Readme.txt:17"
- note: "Listed as Meter.wav in the readme, shipped as meter.wav."
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 12 at 0xad7b58 (\"Meter.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
+ note: "The table names Meter.wav, the distribution ships it as meter.wav on a case insensitive file system."
+
+ - name: RelayOn.wav
+ system: fruitmachine
+ path: "DefaultSounds/RelayOn.wav"
+ required: false
+ category: game_data
+ description: "Relay switched on"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 13 at 0xad7b64 (\"RelayOn.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
+ note: "Effect slot Relay On in the table, with no sample in the distribution."
+
+ - name: RelayOff.wav
+ system: fruitmachine
+ path: "DefaultSounds/RelayOff.wav"
+ required: false
+ category: game_data
+ description: "Relay switched off"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 14 at 0xad7b70 (\"RelayOff.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
+ note: "Effect slot Relay Off in the table, with no sample in the distribution."
- name: ButtonDown.wav
size: 3264
@@ -271,7 +308,7 @@ files:
bundled: true
category: game_data
description: "Layout button pressed"
- source_ref: "DefaultSounds/Readme.txt:19"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 9 at 0xad7b34 (\"ButtonDown.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
note: "PROCONN ships its own copy under DefaultSounds/Custom/PROCONN/."
- name: ButtonUp.wav
@@ -283,7 +320,7 @@ files:
bundled: true
category: game_data
description: "Layout button released"
- source_ref: "DefaultSounds/Readme.txt:20"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 10 at 0xad7b40 (\"ButtonUp.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
note: "PROCONN ships its own copy under DefaultSounds/Custom/PROCONN/."
# -- Hoppers --
@@ -297,7 +334,7 @@ files:
bundled: true
category: game_data
description: "Hopper 1 motor running"
- source_ref: "DefaultSounds/Readme.txt:22"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 20 at 0xad7bb8 (\"HopperMotor1.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
note: >-
Cabinet specific copies ship under DefaultSounds/Custom/ for ADDER5/Eclipse,
EPOCH/Elegance, MPU4/Genesis, MPU5/Genesis, SCORPION4/Eclipse and
@@ -312,7 +349,7 @@ files:
bundled: true
category: game_data
description: "Coin paid out from hopper 1"
- source_ref: "DefaultSounds/Readme.txt:23"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 21 at 0xad7bc4 (\"HopperCoin1.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
note: "Same cabinet specific copies as HopperMotor1.wav."
- name: HopperMotor2.wav
@@ -324,7 +361,7 @@ files:
bundled: true
category: game_data
description: "Hopper 2 motor running"
- source_ref: "DefaultSounds/Readme.txt:24"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 33 at 0xad7c54 (\"HopperMotor2.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
note: "Same cabinet specific copies as HopperMotor1.wav."
- name: HopperCoin2.wav
@@ -336,7 +373,7 @@ files:
bundled: true
category: game_data
description: "Coin paid out from hopper 2"
- source_ref: "DefaultSounds/Readme.txt:25"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 34 at 0xad7c60 (\"HopperCoin2.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
note: >-
Same cabinet specific copies as HopperMotor1.wav, plus an alternate in
DefaultSounds/MiscSounds/.
@@ -352,7 +389,7 @@ files:
bundled: true
category: game_data
description: "Note inserted into the note acceptor"
- source_ref: "DefaultSounds/Readme.txt:27"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 25 at 0xad7bf4 (\"NoteIn.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: NoteInReject.wav
size: 96688
@@ -363,7 +400,7 @@ files:
bundled: true
category: game_data
description: "Note rejected by the note acceptor"
- source_ref: "DefaultSounds/Readme.txt:28"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 30 at 0xad7c30 (\"NoteInReject.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: NoteInStack.wav
size: 254880
@@ -374,7 +411,7 @@ files:
bundled: true
category: game_data
description: "Note accepted and sent to the stacker"
- source_ref: "DefaultSounds/Readme.txt:29"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 26 at 0xad7c00 (\"NoteInStack.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
# -- Roll down electronic coin mech --
@@ -387,7 +424,7 @@ files:
bundled: true
category: game_data
description: "Coin inserted into a roll down electronic mech"
- source_ref: "DefaultSounds/Readme.txt:31"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 22 at 0xad7bd0 (\"CoinIn.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInSwitch.wav
size: 33008
@@ -398,7 +435,7 @@ files:
bundled: true
category: game_data
description: "Coin accepted by the mech"
- source_ref: "DefaultSounds/Readme.txt:32"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 23 at 0xad7bdc (\"CoinInSwitch.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInRejected.wav
size: 88144
@@ -409,7 +446,7 @@ files:
bundled: true
category: game_data
description: "Coin rejected by the mech into the payout tray"
- source_ref: "DefaultSounds/Readme.txt:33"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 24 at 0xad7be8 (\"CoinInRejected.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: TokenIn.wav
size: 60816
@@ -420,7 +457,7 @@ files:
bundled: true
category: game_data
description: "Token inserted into an electronic token mech"
- source_ref: "history.txt:80, DefaultSounds/Readme.txt:35"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 44 at 0xad7cd8 (\"TokenIn.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: TokenInSwitch.wav
size: 33008
@@ -431,7 +468,7 @@ files:
bundled: true
category: game_data
description: "Token accepted by an electronic token mech"
- source_ref: "history.txt:80, DefaultSounds/Readme.txt:36"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 45 at 0xad7ce4 (\"TokenInSwitch.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: TokenInRejected.wav
size: 88144
@@ -442,7 +479,7 @@ files:
bundled: true
category: game_data
description: "Token rejected by an electronic token mech"
- source_ref: "history.txt:80, DefaultSounds/Readme.txt:37"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 46 at 0xad7cf0 (\"TokenInRejected.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
# -- S1 and S10 mechs --
@@ -455,7 +492,7 @@ files:
bundled: true
category: game_data
description: "Coin inserted in an S1 type mech"
- source_ref: "history.txt:148"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 47 at 0xad7cfc (\"CoinInS1.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS1Switch.wav
size: 33008
@@ -466,7 +503,7 @@ files:
bundled: true
category: game_data
description: "Coin accepted by an S1 type mech"
- source_ref: "history.txt:148"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 49 at 0xad7d14 (\"CoinInS1Switch.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS1Token.wav
size: 60816
@@ -477,7 +514,7 @@ files:
bundled: true
category: game_data
description: "Token inserted in an S1 token type mech"
- source_ref: "history.txt:148"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 48 at 0xad7d08 (\"CoinInS1Token.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS1TokenSwitch.wav
size: 33008
@@ -488,7 +525,7 @@ files:
bundled: true
category: game_data
description: "Token accepted by an S1 token type mech"
- source_ref: "history.txt:148"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 50 at 0xad7d20 (\"CoinInS1TokenSwitch.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS10.wav
size: 60816
@@ -499,7 +536,7 @@ files:
bundled: true
category: game_data
description: "Coin inserted in an S1 or S10 type mech"
- source_ref: "DefaultSounds/Readme.txt:39"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 35 at 0xad7c6c (\"CoinInS10.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS10Rejected.wav
size: 80834
@@ -510,7 +547,7 @@ files:
bundled: true
category: game_data
description: "Coin rejected from an S10 type mech"
- source_ref: "DefaultSounds/Readme.txt:40, history.txt:47, 153"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 42 at 0xad7cc0 (\"CoinInS10Rejected.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS10Switch.wav
size: 33008
@@ -521,7 +558,7 @@ files:
bundled: true
category: game_data
description: "Coin accepted by an S1 or S10 type mech"
- source_ref: "DefaultSounds/Readme.txt:41, history.txt:47"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 40 at 0xad7ca8 (\"CoinInS10Switch.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS10Token.wav
size: 60816
@@ -532,7 +569,7 @@ files:
bundled: true
category: game_data
description: "Token inserted in an S10 token type mech"
- source_ref: "DefaultSounds/Readme.txt:43"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 36 at 0xad7c78 (\"CoinInS10Token.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS10TokenRejected.wav
size: 80834
@@ -543,7 +580,7 @@ files:
bundled: true
category: game_data
description: "Token rejected from an S10 token type mech"
- source_ref: "DefaultSounds/Readme.txt:44, history.txt:47, 153"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 43 at 0xad7ccc (\"CoinInS10TokenRejected.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinInS10TokenSwitch.wav
size: 33008
@@ -554,7 +591,7 @@ files:
bundled: true
category: game_data
description: "Token accepted by an S10 token type mech"
- source_ref: "DefaultSounds/Readme.txt:45, history.txt:47"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 41 at 0xad7cb4 (\"CoinInS10TokenSwitch.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: S1Locked.wav
size: 7596
@@ -565,7 +602,7 @@ files:
bundled: true
category: game_data
description: "Coin refused by a locked out S1 mech"
- source_ref: "DefaultSounds/Readme.txt:50"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 27 at 0xad7c0c (\"S1Locked.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
# -- Comparator mech --
@@ -578,7 +615,7 @@ files:
bundled: true
category: game_data
description: "Coin inserted in a comparator style mech"
- source_ref: "DefaultSounds/Readme.txt:47"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 28 at 0xad7c18 (\"CoinInDrop.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: CoinDropReject.wav
size: 12018
@@ -589,7 +626,7 @@ files:
bundled: true
category: game_data
description: "Coin rejected from a comparator style mech"
- source_ref: "DefaultSounds/Readme.txt:48"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 29 at 0xad7c24 (\"CoinDropReject.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
# -- Lockout solenoid --
@@ -602,7 +639,7 @@ files:
bundled: true
category: game_data
description: "Lockout solenoid activated"
- source_ref: "DefaultSounds/Readme.txt:52"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 15 at 0xad7b7c (\"LockoutOn.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: LockoutOff.wav
size: 9204
@@ -613,7 +650,7 @@ files:
bundled: true
category: game_data
description: "Lockout solenoid deactivated"
- source_ref: "DefaultSounds/Readme.txt:53"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 16 at 0xad7b88 (\"LockoutOff.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
# -- Stepper reels --
@@ -623,11 +660,11 @@ files:
required: false
category: game_data
description: "SRU, SYS80 and MPS2 200 step reel motor"
- source_ref: "DefaultSounds/Readme.txt:55, history.txt:74"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 19 at 0xad7bac (\"Stepper.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
note: >-
Shipped only as tech copies under DefaultSounds/Custom/ for ELECTROCOIN,
- MPS2, SRU and SYSTEM80, and as stepper.wav for M1AB. Reel effects were
- extended to Maygay M1a and made available to other techs in v20.0.
+ MPS2, SRU and SYSTEM80, and as stepper.wav for M1AB, which FUN_005158fc
+ finds before the DefaultSounds folder.
# -- Prize vend --
@@ -640,7 +677,7 @@ files:
bundled: true
category: game_data
description: "Prize vend motor started"
- source_ref: "DefaultSounds/Readme.txt:57"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 37 at 0xad7c84 (\"PrizeMotor.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: PrizeVend.wav
size: 62288
@@ -651,8 +688,7 @@ files:
bundled: true
category: game_data
description: "Prize dispensed"
- source_ref: "DefaultSounds/Readme.txt:58"
- note: "Listed as Prizevend.wav in the readme, shipped as PrizeVend.wav."
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 38 at 0xad7c90 (\"PrizeVend.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
# -- Pull handle --
@@ -665,7 +701,7 @@ files:
bundled: true
category: game_data
description: "Pull handle drawn slowly"
- source_ref: "DefaultSounds/Readme.txt:60, history.txt:207"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 51 at 0xad7d2c (\"PullHandleSlow.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: PullHandleNormal.wav
size: 70700
@@ -676,7 +712,7 @@ files:
bundled: true
category: game_data
description: "Pull handle drawn at normal speed"
- source_ref: "DefaultSounds/Readme.txt:61, history.txt:207"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 52 at 0xad7d38 (\"PullHandleNormal.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: PullHandleFast.wav
size: 30252
@@ -687,7 +723,7 @@ files:
bundled: true
category: game_data
description: "Pull handle drawn quickly"
- source_ref: "DefaultSounds/Readme.txt:62, history.txt:207"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 53 at 0xad7d44 (\"PullHandleFast.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: PullHandleRelease.wav
size: 43372
@@ -698,7 +734,7 @@ files:
bundled: true
category: game_data
description: "Pull handle released"
- source_ref: "DefaultSounds/Readme.txt:63, history.txt:207"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 54 at 0xad7d50 (\"PullHandleRelease.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
# -- Electromechanical cabinets --
@@ -711,7 +747,7 @@ files:
bundled: true
category: game_data
description: "Reel motor activated on an EM machine"
- source_ref: "DefaultSounds/Readme.txt:68"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 0 at 0xad7ac8 (\"MotorOn.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: Wiper.wav
size: 117804
@@ -722,7 +758,7 @@ files:
bundled: true
category: game_data
description: "Reel with studs spinning on an EM machine"
- source_ref: "DefaultSounds/Readme.txt:69"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 3 at 0xad7aec (\"Wiper.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: SolenoidOn.wav
size: 5450
@@ -733,7 +769,7 @@ files:
bundled: true
category: game_data
description: "Reel solenoid activated on an EM machine"
- source_ref: "DefaultSounds/Readme.txt:70"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 1 at 0xad7ad4 (\"SolenoidOn.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: SolenoidOff.wav
size: 17766
@@ -744,7 +780,7 @@ files:
bundled: true
category: game_data
description: "Reel solenoid deactivated on an EM machine"
- source_ref: "DefaultSounds/Readme.txt:71"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 2 at 0xad7ae0 (\"SolenoidOff.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: BellOn.wav
size: 97512
@@ -755,7 +791,7 @@ files:
bundled: true
category: game_data
description: "Bell switched on"
- source_ref: "DefaultSounds/Readme.txt:72"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 7 at 0xad7b1c (\"BellOn.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: BellOff.wav
size: 13702
@@ -766,7 +802,7 @@ files:
bundled: true
category: game_data
description: "Bell switched off"
- source_ref: "DefaultSounds/Readme.txt:73"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 8 at 0xad7b28 (\"BellOff.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: Buzzer.wav
size: 9082
@@ -777,7 +813,7 @@ files:
bundled: true
category: game_data
description: "Nudge buzzer activated"
- source_ref: "DefaultSounds/Readme.txt:74"
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 6 at 0xad7b10 (\"Buzzer.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
- name: Sounder.wav
system: fruitmachine
@@ -785,5 +821,5 @@ files:
required: false
category: game_data
description: "Feature sounder activated on an EM machine"
- source_ref: "DefaultSounds/Readme.txt:75"
- note: "Effect name documented by MFME with no sample in the distribution."
+ source_ref: "MFME.exe 20.1.0.0 effect table 0xad7ac8 entry 11 at 0xad7b4c (\"Sounder.wav\"), FUN_005fad6c 0x5fadca-0x5fae1c (loads entries 0 to 0x36), FUN_005faa24 0x5faac6-0x5fac04 (FileExists in game folder, Custom, DefaultSounds), 0x5fac35 (FUN_005f9584 mmio RIFF WAVE PCM read, null on failure), FUN_005fb284 0x5fb2c4-0x5fb487 (reload of one entry)"
+ note: "Effect slot Sounder in the table, with no sample in the distribution."
diff --git a/emulators/nethersx2-turnip-classic.yml b/emulators/nethersx2-turnip-classic.yml
index 527927143..7472d87c3 100644
--- a/emulators/nethersx2-turnip-classic.yml
+++ b/emulators/nethersx2-turnip-classic.yml
@@ -778,7 +778,7 @@ files:
note: >-
Loaded as icons/flags/.png with the region string of the entry.
Thirty are carried, seven NTSC and twenty-two PAL plus Other.
- source_ref: "nethersx2-turnip-classic v0.7 classes.dex icons/flags/%s.png"
+ source_ref: "classes.dex nethersx2-turnip-classic v0.7 xyz.aethersx2.android.e.h(e.b, int) formats icons/flags/%s.png (jadx 1.5.1 e.java line 71), classes.dex NativeLibrary.loadDrawableFromPackage(Context, String) AssetManager.open (jadx 1.5.1 NativeLibrary.java lines 559-567)"
- name: "star-.png"
path: assets/icons/star-0.png
@@ -786,7 +786,7 @@ files:
bundled: true
description: "Game list compatibility rating icon"
note: "Loaded as icons/star-.png for ratings 0 to 5."
- source_ref: "nethersx2-turnip-classic v0.7 classes.dex icons/star-%d.png"
+ source_ref: "classes.dex nethersx2-turnip-classic v0.7 xyz.aethersx2.android.e.h(e.b, int) formats icons/star-%d.png (jadx 1.5.1 e.java line 73), classes.dex NativeLibrary.loadDrawableFromPackage(Context, String) AssetManager.open (jadx 1.5.1 NativeLibrary.java lines 559-567)"
- name: faq.html
path: assets/faq.html
@@ -797,7 +797,7 @@ files:
sha1: 9163d4a3d19b87483f843e4bf3afe236a50a72d2
description: "Help page"
note: "Opened under the android_asset scheme by the setup wizard's browser view."
- source_ref: "nethersx2-turnip-classic v0.7 classes.dex android_asset faq.html"
+ source_ref: "classes.dex nethersx2-turnip-classic v0.7 xyz.aethersx2.android.SetupWizardActivity.a.onCreateView(LayoutInflater, ViewGroup, Bundle) WebView.loadUrl (jadx 1.5.1 SetupWizardActivity.java line 44)"
- name: 3rdparty.html
path: assets/3rdparty.html
@@ -808,7 +808,7 @@ files:
sha1: 7743bf1d7e6e09a02f1b2972aa63bd8a9f26050d
description: "Third party notices page"
note: "Opened under the android_asset scheme in the built-in browser view."
- source_ref: "nethersx2-turnip-classic v0.7 classes.dex android_asset 3rdparty.html"
+ source_ref: "classes.dex nethersx2-turnip-classic v0.7 xyz.aethersx2.android.MainActivity.A(MainActivity, MenuItem) action_third_party_notices then WebView.loadUrl (jadx 1.5.1 MainActivity.java lines 164-171), classes.dex NativeLibrary.readPackageFileToString(Context, String) AssetManager.open (jadx 1.5.1 NativeLibrary.java lines 652-654)"
exclusion_note: >
Left out are the libraries the package carries for the dynamic linker rather
diff --git a/emulators/nethersx2-turnip.yml b/emulators/nethersx2-turnip.yml
index a9450063b..bf4162a88 100644
--- a/emulators/nethersx2-turnip.yml
+++ b/emulators/nethersx2-turnip.yml
@@ -753,7 +753,7 @@ files:
note: >-
Loaded as icons/flags/.png with the region string of the entry.
Thirty are carried, seven NTSC and twenty-two PAL plus Other.
- source_ref: "nethersx2-turnip v0.7 classes.dex icons/flags/%s.png"
+ source_ref: "classes.dex nethersx2-turnip v0.7 xyz.aethersx2.android.e.h(e.b, int) formats icons/flags/%s.png (jadx 1.5.1 e.java line 73), classes.dex NativeLibrary.loadDrawableFromPackage(Context, String) AssetManager.open (jadx 1.5.1 NativeLibrary.java lines 576-584)"
- name: "star-.png"
path: assets/icons/star-0.png
@@ -761,7 +761,7 @@ files:
bundled: true
description: "Game list compatibility rating icon"
note: "Loaded as icons/star-.png for ratings 0 to 5."
- source_ref: "nethersx2-turnip v0.7 classes.dex icons/star-%d.png"
+ source_ref: "classes.dex nethersx2-turnip v0.7 xyz.aethersx2.android.e.h(e.b, int) formats icons/star-%d.png (jadx 1.5.1 e.java line 75), classes.dex NativeLibrary.loadDrawableFromPackage(Context, String) AssetManager.open (jadx 1.5.1 NativeLibrary.java lines 576-584)"
- name: faq.html
path: assets/faq.html
@@ -772,7 +772,7 @@ files:
sha1: 9163d4a3d19b87483f843e4bf3afe236a50a72d2
description: "Help page"
note: "Opened under the android_asset scheme in the built-in browser view."
- source_ref: "nethersx2-turnip v0.7 classes.dex android_asset faq.html"
+ source_ref: "classes.dex nethersx2-turnip v0.7 xyz.aethersx2.android.MainActivity.A(MainActivity, MenuItem) action_show_faq (jadx 1.5.1 MainActivity.java lines 154-156), classes.dex MainActivity.G(String) WebView.loadUrl (jadx 1.5.1 MainActivity.java lines 371-376), classes.dex SetupWizardActivity.a.onCreateView(LayoutInflater, ViewGroup, Bundle) WebView.loadUrl (jadx 1.5.1 SetupWizardActivity.java line 46)"
- name: 3rdparty.html
path: assets/3rdparty.html
@@ -783,7 +783,7 @@ files:
sha1: 7743bf1d7e6e09a02f1b2972aa63bd8a9f26050d
description: "Third party notices page"
note: "Opened under the android_asset scheme in the built-in browser view."
- source_ref: "nethersx2-turnip v0.7 classes.dex android_asset 3rdparty.html"
+ source_ref: "classes.dex nethersx2-turnip v0.7 xyz.aethersx2.android.MainActivity.A(MainActivity, MenuItem) action_third_party_notices (jadx 1.5.1 MainActivity.java lines 192-194), classes.dex MainActivity.G(String) WebView.loadUrl (jadx 1.5.1 MainActivity.java lines 371-376)"
exclusion_note: >
Left out are the libraries the package carries for the dynamic linker rather
diff --git a/emulators/nethersx2.yml b/emulators/nethersx2.yml
index 87f5be289..7084a1f2a 100644
--- a/emulators/nethersx2.yml
+++ b/emulators/nethersx2.yml
@@ -559,7 +559,7 @@ files:
Loaded as icons/flags/.png with the region string of the entry.
Thirty are carried, seven NTSC and twenty-two PAL plus Other, the Polish
flag being one the project adds.
- source_ref: "nethersx2 v2.2n-4248 classes.dex icons/flags/%s.png"
+ source_ref: "classes.dex nethersx2 v2.2n-4248 xyz.aethersx2.android.e.h(e.b, int) formats icons/flags/%s.png (jadx 1.5.1 e.java line 72), classes.dex NativeLibrary.loadDrawableFromPackage(Context, String) AssetManager.open (jadx 1.5.1 NativeLibrary.java lines 575-583)"
- name: "star-.png"
path: assets/icons/star-0.png
@@ -567,7 +567,7 @@ files:
bundled: true
description: "Game list compatibility rating icon"
note: "Loaded as icons/star-.png for ratings 0 to 5."
- source_ref: "nethersx2 v2.2n-4248 classes.dex icons/star-%d.png"
+ source_ref: "classes.dex nethersx2 v2.2n-4248 xyz.aethersx2.android.e.h(e.b, int) formats icons/star-%d.png (jadx 1.5.1 e.java line 74), classes.dex NativeLibrary.loadDrawableFromPackage(Context, String) AssetManager.open (jadx 1.5.1 NativeLibrary.java lines 575-583)"
- name: faq.html
path: assets/faq.html
@@ -578,7 +578,7 @@ files:
sha1: 9163d4a3d19b87483f843e4bf3afe236a50a72d2
description: "Help page"
note: "Opened under the android_asset scheme in the built-in browser view."
- source_ref: "nethersx2 v2.2n-4248 classes.dex android_asset faq.html"
+ source_ref: "classes.dex nethersx2 v2.2n-4248 xyz.aethersx2.android.MainActivity.A(MainActivity, MenuItem) action_show_faq (jadx 1.5.1 MainActivity.java lines 154-156), classes.dex MainActivity.G(String) WebView.loadUrl (jadx 1.5.1 MainActivity.java lines 371-376), classes.dex SetupWizardActivity.a.onCreateView(LayoutInflater, ViewGroup, Bundle) WebView.loadUrl (jadx 1.5.1 SetupWizardActivity.java line 45)"
- name: 3rdparty.html
path: assets/3rdparty.html
@@ -589,7 +589,7 @@ files:
sha1: 7743bf1d7e6e09a02f1b2972aa63bd8a9f26050d
description: "Third party notices page"
note: "Opened under the android_asset scheme in the built-in browser view."
- source_ref: "nethersx2 v2.2n-4248 classes.dex android_asset 3rdparty.html"
+ source_ref: "classes.dex nethersx2 v2.2n-4248 xyz.aethersx2.android.MainActivity.A(MainActivity, MenuItem) action_third_party_notices (jadx 1.5.1 MainActivity.java lines 192-194), classes.dex MainActivity.G(String) WebView.loadUrl (jadx 1.5.1 MainActivity.java lines 371-376)"
exclusion_note: >
Left out are the assets the package carries that no code path on this platform
diff --git a/emulators/phoenix.yml b/emulators/phoenix.yml
index 9944c2b96..0f33b4f0f 100644
--- a/emulators/phoenix.yml
+++ b/emulators/phoenix.yml
@@ -21,8 +21,9 @@ systems:
notes: |
Closed-source 3DO and Atari Jaguar emulator by Altmer (Arts-Union), the
author of FreeDO. This profile reads the build RetroBat installs,
- PhoenixEmuProject.exe 2.8.JAG (x86-64, dated 2023-01-05), with objdump and
- the strings it carries.
+ PhoenixEmuProject.exe 2.8.JAG (x86-64, dated 2023-01-05, sha256
+ 82298a9db3e0e53ad5ca2c659adecc86c0715d2864012bb84c50e02aecf5db67 inside
+ phoenix.7z sha256 8290e1463f94c456...afc7b6), disassembled.
Phoenix names no BIOS file. Every dump is registered in phoenix.config.xml
under a platform and a dump type: BIOS, CD-ROM, FMV-ROM, FONT-ROM and NVRAM
@@ -31,19 +32,29 @@ notes: |
3DO or "[BIOS] Atari Jaguar (World).j64" for Jaguar from the RetroBat bios
folder (emulatorLauncher Generators/Phoenix.Generator.cs:23-95).
- The 3DO machine is emulated at hardware level (MADAM, CLIO, the CEL engine
- and the ARM CPU) and starts from the BIOS dump. Its md5 is compared with
- two values, the PAL Anvil BIOS a48e6746 and the same image with RSA
- disabled cf11bbb5 (function at 0x4a10d0, strings at 0xb03a38 and
- 0xb03a60), which the 2.8.J changelog lists as PAL BIOS support. FMV-ROM is
- the video module ROM, which the 1.2 changelog describes as viewable only,
- and FONT-ROM the kanji font of Japanese consoles. Two further md5 values
- (0xb03bd0, 0xb03bf8) are compared against the CD-ROM dump and set per game
- video parameters.
+ Each machine declares its dump slots with a flag word. A slot whose flag
+ has bit 0 clear is mandatory: with no dump registered there, the launch
+ stops on "You must select %1.". 3DO declares CD-ROM 3, BIOS 0, FONT-ROM 1, FMV-ROM 1 and
+ NVRAM 1, Jaguar CARTRIDGE 2 and BIOS 1. QFrontend reads a slot by seeking
+ its dump to 0 and reading at most the size the machine asks for, and
+ returns -1 when the slot is empty.
- Jaguar cartridges run through the boot ROM, and the File menu offers to add
- a header, or a generic header, to a headerless cartridge
- dump so that the boot ROM accepts it.
+ The 3DO machine is emulated at hardware level (MADAM, CLIO, the CEL engine
+ and the ARM CPU) and starts from the BIOS dump, read into the first
+ megabyte of a 2 MB ROM area, the FONT-ROM dump into the second, the whole
+ area then byte swapped by 32-bit words. The md5 of the BIOS dump is
+ compared with two values, the PAL Anvil BIOS a48e6746 and the same image
+ with RSA disabled cf11bbb5, and a match is passed to the CLIO setup as the
+ PAL flag. The FMV-ROM slot is declared but the machine setup never reads
+ it. NVRAM starts from a built-in 0xac-byte image and is then overlaid with
+ the NVRAM slot. Two further md5 values (0xb03bd0, 0xb03bf8) are compared
+ against the CD-ROM dump and set per game video parameters.
+
+ Jaguar cartridges run through the boot ROM when one is registered. Without
+ one, or for a cartridge with a JAGR header, the machine writes the reset
+ vectors itself and starts at the entry address the cartridge holds at
+ offset 0x404 (or the JAGR load address). The File menu offers to add a
+ header, or a generic header, to a headerless cartridge dump.
files:
- name: panafz10.bin
@@ -52,26 +63,44 @@ files:
description: "3DO BIOS"
note: >-
Read from the path registered as the 3DO BIOS in phoenix.config.xml,
- under any name. The name is a label for the Panasonic FZ-10 dump.
+ under any name. The name is a label for the Panasonic FZ-10 dump. The
+ slot is mandatory and the read is capped at 1 MB.
+ source_ref: "PhoenixEmuProject.exe 2.8.JAG (sha256 82298a9db3e0e53a) FUN_004a3980 0x4a3a74-0x4a3aa9 (3DO slot BIOS declared with flag 0), FUN_004fd550 0x4ff197-0x4ff220 (empty slot with flag bit 0 clear) and 0x4ff22d-0x4ff409 (QMessageBox You must select %1, returns false at 0x4fdae6), FUN_004a7f60 0x4a8ad0-0x4a8b3b (QFrontend read of slot BIOS, at most 0x100000 bytes, into this+0x1097558), 0x4a8be2-0x4a8c02 (byte swap of the 2 MB ROM area), FUN_004b1460 0x4b1489-0x4b14c4 (slot lookup, seek 0, read, -1 when empty)"
- name: panafz10e-anvil.bin
system: 3do
required: false
md5: "a48e6746bd7edec0f40cff078f0bb19f"
description: "PAL Anvil BIOS"
- note: "Recognized by md5 for PAL operation (0xb03a38, compared at 0x4a1144)."
+ note: "A BIOS slot dump with this md5 turns on PAL timing."
+ source_ref: "PhoenixEmuProject.exe 2.8.JAG (sha256 82298a9db3e0e53a) FUN_004a10d0 0x4a1144-0x4a11e4 (md5 of the BIOS slot dump through QFrontend FUN_004b12b0, compared with a48e6746...), called from FUN_004a7f60 0x4a81c1, result passed to the CLIO setup FUN_00491a70 at 0x4a8247-0x4a827b"
- name: panafz10e-anvil-norsa.bin
system: 3do
required: false
md5: "cf11bbb5a16d7af9875cca9de9a15e09"
description: "PAL Anvil BIOS, RSA check disabled"
- note: "Recognized by md5 for PAL operation (0xb03a60, compared at 0x4a120d)."
+ note: "A BIOS slot dump with this md5 turns on PAL timing."
+ source_ref: "PhoenixEmuProject.exe 2.8.JAG (sha256 82298a9db3e0e53a) FUN_004a10d0 0x4a120d-0x4a128d (md5 of the BIOS slot dump compared with cf11bbb5... when the first value differs), called from FUN_004a7f60 0x4a81c1, result passed to the CLIO setup FUN_00491a70 at 0x4a8247-0x4a827b"
+
+ - name: panafz1j-kanji.bin
+ system: 3do
+ required: false
+ description: "3DO kanji font ROM"
+ note: >-
+ Read from the path registered as the 3DO FONT-ROM in phoenix.config.xml,
+ under any name, into the second megabyte of the ROM area. The name is a
+ label for the Panasonic FZ-1 kanji font dump. The slot is optional.
+ source_ref: "PhoenixEmuProject.exe 2.8.JAG (sha256 82298a9db3e0e53a) FUN_004a3980 0x4a3aae-0x4a3ae3 (3DO slot FONT-ROM declared with flag 1, optional), FUN_004a7f60 0x4a8b48-0x4a8bd5 (QFrontend read of slot FONT-ROM, at most 0x100000 bytes, into this+0x1197558), 0x4a8be2-0x4a8c02 (byte swap of the 2 MB ROM area)"
- name: "[BIOS] Atari Jaguar (World).j64"
system: atari-jaguar
- required: true
+ required: false
+ hle_fallback: true
description: "Jaguar boot ROM"
note: >-
Read from the path registered as the Jaguar BIOS in phoenix.config.xml,
- under any name. The name is a label for the No-Intro boot ROM dump.
+ under any name. The name is a label for the No-Intro boot ROM dump. The
+ slot is optional: without it the cartridge is started directly from
+ its entry address.
+ source_ref: "PhoenixEmuProject.exe 2.8.JAG (sha256 82298a9db3e0e53a) FUN_0089e230 0x89e40c-0x89e432 (Jaguar slot BIOS declared with flag 1, optional), FUN_008a0aa0 0x8a1498-0x8a14c4 (QFrontend read of slot 1, at most 0x100000 bytes, into this+0x5bab8), 0x8a14c6-0x8a14e8 (16-bit byte swap), 0x8a14ea-0x8a1514 (reset vectors taken from the boot ROM when the read returned data), 0x8a2279-0x8a22b8 and 0x8a2360-0x8a2371 (no boot ROM: reset vectors written directly, PC from the cartridge at offset 0x404 or the JAGR header)"
diff --git a/emulators/rpix86.yml b/emulators/rpix86.yml
index 093b50660..97738d0e8 100644
--- a/emulators/rpix86.yml
+++ b/emulators/rpix86.yml
@@ -25,11 +25,12 @@ notes: |
input and serial devices, and the log and screenshot files it writes.
C:\ is the directory given with -d, the working directory by default
- (usage text). The emulator looks for its shell as C:\4DOS.COM or
- C:\4DOS\4DOS.COM. When neither exists it stops with "Unable to find
- 4DOS.COM command interpreter (shell)" and offers to fetch it with
- "wget http://rpix86.patrickaalto.com/4DOS.COM". RetroPie runs the binary
- from its install directory and unpacks
+ (usage text). Started without a program to run, the emulator looks for
+ its shell as C:\4DOS\4DOS.COM, then C:\4DOS.COM. When neither exists it
+ asks "Unable to find 4DOS.COM command interpreter (shell)", runs
+ "wget http://rpix86.patrickaalto.com/4DOS.COM" into C:\ on yes and
+ exits on no. The binary itself is sha256 48769ffb388822b6...68c0.
+ RetroPie runs the binary from its install directory and unpacks
files.retropie.org.uk/archives/4dos.zip (sha256 801441f3f65e...5b636a,
4DOS 7.50 from JP Software) there (scriptmodules/emulators/rpix86.sh).
@@ -44,5 +45,5 @@ files:
sha1: "a44f65d6318582501d22e27831eb2b1f0df58f79"
md5: "fc3a0078a13d98e611a62c1d6724f8c5"
crc32: "8300d4cb"
- source_ref: "rpix86 0.19 binary, file offsets 0x1b2c48 (C:\\4DOS.COM), 0x1b2c34 (C:\\4DOS\\4DOS.COM), 0x1b515c (Unable to find 4DOS.COM), 0x1b504c (wget .../4DOS.COM -O%s/4DOS.COM)"
+ source_ref: "rpix86 0.19 (sha256 48769ffb388822b6) main 0xbf34: 0xc380-0xc388 (no program on the command line, start the shell), 0xc6d4-0xc6e0 (retry after a download), 0xcbbc (exit when declined); FUN_0000d72c 0xd814-0xd8c0 (tries C:\\4DOS\\4DOS.COM then C:\\4DOS.COM from the table at 0x1ca810 with tail /P through the DOS EXEC at 0x22da0, returns -1 when both fail); FUN_00015e80 0x15ea4-0x15eb0 (Unable to find 4DOS.COM prompt), 0x15eec-0x15f00 and 0x1636c-0x1637c (sprintf of wget .../4DOS.COM -O%s/4DOS.COM into the C: directory, system)"
note: "Same bytes at rpix86.patrickaalto.com/4DOS.COM, the URL the binary downloads from, and in RetroPie's 4dos.zip. Read from the emulated C: root, not a BIOS directory. The author's rpix86.zip and rpix86.tar.gz hold the binary alone, and RetroPie unpacks 4dos.zip into the install directory."
diff --git a/emulators/speccy.yml b/emulators/speccy.yml
index cfa22dd4b..4a062aa6f 100644
--- a/emulators/speccy.yml
+++ b/emulators/speccy.yml
@@ -56,7 +56,8 @@ notes: |
through 5.9, is a binary package, while ColEm and fMSX on the same site ship
source archives.
ref: com.fms.speccy.apk APK Signing Block, https://fms.komkon.org/Speccy/,
- Speccy59-Windows-bin.zip, Speccy59-Ubuntu-x86-bin.tgz
+ Speccy59-Windows-bin.zip, Speccy59-Ubuntu-x86-bin.tgz (sha256
+ 723eef7f34c50532, speccy sha256 2c335e4b7ead43f8)
One directory holds everything. MainActivity hands the home directory to
jniStart, which copies it into the buffer GetHomeDir returns and passes that
@@ -65,21 +66,23 @@ notes: |
of when it is done. That directory is external storage
joined with the application label up to its first space, so /sdcard/Speccy for
the package read here, falling back to getExternalFilesDirs(null) when it is
- not a writable directory. The author's own instructions give the same
- placement. Every open goes through mopen, which calls OpenRealFile first: the
+ not a writable directory. Every open goes through mopen, which calls OpenRealFile first: the
name is tried as given, and again as /, keeping the
larger of the two when both open. mopen then layers gzdopen over the
descriptor, so any of these files also opens gzipped, and a content:// name is
routed to the Android storage framework. The desktop builds have no home
- directory of their own and open every name where they stand, which -home
- changes for the system ROMs alone.
+ directory of their own and open every name where they stand. Option -home
+ stores its argument as the one directory LoadBIOS changes into before the
+ first ROM and back out of after the last, so it moves the system ROMs alone.
ref: MainActivity.java:1091-1104, EMULib.java:178, 315-361, 363-373,
libmain.so jniStart 0x30ad8-0x310e3 (0x30eec-0x30efc, 0x30f58),
GetHomeDir 0x2e73c, SetPrivateDir 0x509e0,
Application 0x57784-0x577a4, OpenRealFile 0x50bd8-0x50dff,
mopen 0x50e00-0x50f8f, LoadBIOS 0x5b0c4-0x5b0e8, 0x5b3d4-0x5b3e0,
- Speccy59-Ubuntu-x86-bin speccy 0x3dae5-0x3db17, Speccy.html
- "-home ", EmuAndroid "System ROMs"
+ Speccy59-Ubuntu-x86-bin speccy main 0xc000-0xc053 (option table
+ 0x593b0, entry 48 home), 0xc22f-0xc258 (argument stored at 0x6f9f0),
+ LoadBIOS 0x3dae5-0x3db17 (getcwd, chdir to 0x6f9f0), 0x3de68-0x3de6e
+ (chdir back)
LoadBIOS drives the whole set from one word of hardware flags, calling
TryLoadROM once per name in a fixed order with the length to read and the bit
@@ -108,7 +111,7 @@ notes: |
ROM.
ref: libmain.so LoadBIOS 0x5b29c-0x5b2c4, 0x5b32c-0x5b348, 0x5b2fc-0x5b3b4,
Speccy59-Ubuntu-x86-bin speccy 0x3dc79-0x3dca1, 0x3ddf0-0x3de10,
- 0x3dcd9-0x3dd64, Speccy.html "Now trying to load ZXS128TR.ROM BIOS file"
+ 0x3dcd9-0x3dd64
Thirteen of the nineteen ROMs ship inside the Android package. MainActivity
reads assets/memfs.mp3 whole and jniStart mounts it through SetMemoryFS as an
@@ -132,7 +135,9 @@ notes: |
ref: libmain.so LoadFile 0x5c100, 0x5c1e8, 0x5c210, 0x5c234,
Application 0x57874-0x578d0, StartZXS 0x5af00-0x5af10,
LoadPAL 0x5b5f4, Speccy59-Ubuntu-x86-bin speccy 0x3f4ac-0x3f4bd,
- 0x3e450-0x3e494, Speccy.html "-palette "
+ 0x3e450-0x3e494, main 0xc25d-0xc29b (option -palette, entry 47: a
+ one digit argument picks a built-in palette at 0xc809-0xc833, any
+ other is stored at 0x6a708, which defaults to Speccy.pal at 0x5aca9)
files:
- name: ZXS48.ROM
@@ -273,7 +278,7 @@ files:
crc32: "39ff160a"
description: "Sam Coupe ROM"
note: "Read as 32768 bytes for the Sam Coupe, which is a machine of its own in the same flag word, so selecting it clears every Spectrum bit and the trapdoor devices are switched off with it."
- source_ref: "libmain.so LoadBIOS 0x5b24c-0x5b25c, TryLoadROM 0x5c728-0x5c744, Speccy59-Ubuntu-x86-bin speccy 0x3dc26-0x3dc39, Speccy.html \"Now disabling all trapdoor-based devices in Sam Coupe mode\""
+ source_ref: "libmain.so LoadBIOS 0x5b24c-0x5b25c, TryLoadROM 0x5c728-0x5c744, Speccy59-Ubuntu-x86-bin speccy LoadBIOS 0x3dc26-0x3dc39, reset 0x3df04-0x3df12 (Sam Coupe bit 0x20000000 clears the TRDOS.ROM, IF1.ROM, DISCIPLE.ROM, PLUSD.ROM and Multiface bits, mask 0x7fff0fff)"
- name: TRDOS.ROM
system: sinclair-zx-spectrum
@@ -296,8 +301,8 @@ files:
sha1: 5cfb6bca4177c45fefd571734576b55e3a127c08
crc32: "bb66dd1e"
description: "Sinclair Interface I ROM"
- note: "Read as 8192 bytes when the Interface I is on, and dropped silently when it is missing. Snapshots that page it in need it to restore."
- source_ref: "libmain.so LoadBIOS 0x5b144-0x5b154, Speccy59-Ubuntu-x86-bin speccy 0x3db4c-0x3db5f, Speccy.html \"Fixed some .Z80 snapshots not loading when IF1.ROM is missing\""
+ note: "Read as 8192 bytes when the Interface I is on, and dropped silently when it is missing."
+ source_ref: "libmain.so LoadBIOS 0x5b144-0x5b154, Speccy59-Ubuntu-x86-bin speccy 0x3db4c-0x3db5f"
- name: DISCIPLE.ROM
system: sinclair-zx-spectrum
@@ -355,8 +360,8 @@ files:
sha1: 0b53d51635a2ce3d4e12c2077df9aeffeac02517
crc32: "b58e81f1"
description: "cheat database read by the Cheatopedia browser"
- note: "The package ships no cheat set. Cheatopedia looks for the file in the package assets, then in the home directory and its subdirectories, and takes it from Speccy-Cheats.zip in the Downloads directory when that is newer, unpacking it into /Cheats. The author publishes that archive at fms.komkon.org/EmuAndroid/Speccy-Cheats.zip and states it is what re-enables the cheat features Google Play made him disable in March 2019. The copy read here holds this one file."
- source_ref: "CheatHelper.java:16-49, Cheatopedia.java:181-188, 256-290, 455, EmuAndroid \"Cheats support\""
+ note: "The package ships no cheat set. Cheatopedia looks for the file in the package assets, then in the home directory and its subdirectories, and takes it from Speccy-Cheats.zip in the Downloads directory when that is newer, unpacking it into /Cheats. The author publishes that archive at fms.komkon.org/EmuAndroid/Speccy-Cheats.zip, and the copy read here holds this one file."
+ source_ref: "CheatHelper.java:16-49, Cheatopedia.java:181-188, 256-290, 455"
- name: Controls.png
required: false
@@ -430,5 +435,6 @@ exclusion_note: >
SndName 0x8b048, StartZXS 0x5aeb0-0x5aec0, Application 0x57848-0x57874,
LoadRPL 0x77b64, SaveRPL 0x777f8, SaveSCR 0x60838,
bi.java:189-218, EMULib.java:779, 809,
- Speccy59-Ubuntu-x86-bin speccy 0xbf50,
- Speccy.html "[filename] = Name of the file to load [DEFAULT.Z80]"
+ Speccy59-Ubuntu-x86-bin speccy main 0xbf50-0xbf57 (DEFAULT.Z80 as
+ the file to load), 0xbf9a-0xbfa2, 0xbfd4 (a non-option argument
+ replaces it), 0xc05c-0xc060 (passed to the startup routine)
diff --git a/emulators/ssf.yml b/emulators/ssf.yml
index 86a83c144..45f70463b 100644
--- a/emulators/ssf.yml
+++ b/emulators/ssf.yml
@@ -29,35 +29,43 @@ notes: |
emulator is the 64-bit SSF.exe and which is cited by virtual address, and the
Android build SSF_AndroidVer.zip of 2022-08-07, package
com.xrea.g2.aaaaaaaa.ssf, whose lib/arm64-v8a/libnative-lib.so keeps its 40738
- dynamic symbols and which is cited by symbol. Prose references name the
- Japanese documentation shipped in Document/.
+ dynamic symbols and which is cited by symbol.
Every path below is stored in full in SSF.ini and picked through a file dialog
filtered on "all files (*.*)". SSF fixes no filename and no directory for any
of them and looks for none, so the names used here are the dumps that fill
each slot rather than names the code searches.
- Saturn BIOS, [Peripheral] SaturnBIOS. Readme.txt describes the image as the
- console address range 00000000-0007FFFF and states that the filename is free.
- Neither a length nor a hash is compared against the file. The one routine that
- walks the 512 KiB BIOS area is CStateSaveBase::_GetBIOSHash, which folds it
- into the checksum pair that tags a save state.
+ Saturn BIOS, [Peripheral] SaturnBIOS. The boot routine at 0xae0950 opens the
+ configured path with fopen "rb" and succeeds only when fread returns 0x80000
+ bytes (0xa61f70), so a shorter file fails and a longer one is cut at 512 KiB.
+ No hash is compared against the file. The one routine that walks the 512 KiB
+ BIOS area is CStateSaveBase::_GetBIOSHash, which folds it into the checksum
+ pair that tags a save state.
- Running without it is a supported mode, [Program4] NoBIOS. SSF carries a boot
- ROM of its own, an embedded program with the SYS_* system calls and the
- interrupt vectors, and in that mode the backup library is always hooked.
- Readme.txt records lower compatibility and advises supplying a BIOS.
+ Running without it is a supported mode, [Program4] NoBIOS, inverted by holding
+ Ctrl at launch (GetAsyncKeyState(VK_CONTROL) at 0xae0cf3, applied at
+ 0xae0d9b-0xae0da7). A failed read leads to the same state: the BIOS present
+ flag is cleared (0xae0e95, published at 0xaccc46-0xaccc50) and the setup at
+ 0xa7cfa3-0xa7cfbc passes its negation to the embedded boot ROM, a program with
+ the SYS_* system calls and the interrupt vectors decompressed into the BIOS
+ area (0xa756c0), and to the ST-V system call layer (0xa77630).
- ST-V is entered by holding left Shift at launch. [Peripheral] STVBIOS names
- the motherboard EPROM, and both the option reference and the No BIOS entry of
- Readme.txt state that ST-V does not run without it.
+ ST-V is entered by holding left Shift at launch or by a command-line ROM whose
+ extension is zip (GetAsyncKeyState(VK_LSHIFT) at 0xae0c08, extension compare
+ at 0xae0c9d-0xae0ce0). [Peripheral] STVBIOS names the motherboard EPROM. In
+ that mode the EPROM is read whatever NoBIOS says (0xae0db4-0xae0e63), and an
+ image carrying SEGA ST-V(TITAN) at 0x500 is byte-swapped in 16-bit units
+ (0xae0ea6-0xae0ef6). When it is missing the boot carries on with the BIOS
+ present flag cleared, which arms STVSystemCall::Initialize (0xa77630, the 1
+ MiB clear and table reset of the Android symbol) and writes its stub into the
+ BIOS area.
ST-V cartridges are the game and are read from a ZIP: the loader takes the
extension of each member as its IC number, accepts 1 through 13, byte-swaps
every mask ROM in 16-bit units, doubles each byte of the IC13 EPROM across the
16-bit bus, then mirrors each chip over its window. IC7 and IC13 are
- exclusive. STV_ROM.html gives the same layout and notes that MAME ROM sets fit
- once the extensions are changed.
+ exclusive.
Cheat scripts live in Cheat/ under the disc product number. Six ship with the
emulator and the memory cheat dialog writes more.
@@ -82,7 +90,7 @@ files:
size: 524288
description: "Saturn BIOS"
note: "Any dump of the 512 KiB console ROM, the compatible machines included. Area code is chosen by [Peripheral] Areacode and AutoAreacode, not by the image, so no region selects this file. Each alias labels one of those dumps: mpr-17933.bin, sega_100.bin, sega_100a.bin, sega1003.bin, hisaturn.bin and vsaturn.bin."
- source_ref: "SSF.exe 0x43d770 (SaturnBIOS 0x129b1f8), SSF.exe 0x129a2f8 with the filter at 0x129a310, SSF.exe 0x43ff96 (NoBIOS 0x129b4cc), libnative-lib.so SSF::CStateSaveBase::_GetBIOSHash 0x134b8ec-0x134b924, SSF-archive Document/Readme.txt BIOSファイルについて"
+ source_ref: "SSF.exe 0x43d770 (SaturnBIOS 0x129b1f8), SSF.exe 0x129a2f8 with the filter at 0x129a310, SSF.exe 0x43ff96 (NoBIOS 0x129b4cc), SSF.exe 0xae0950 0xae0e4b-0xae0e95 (path chosen, read of 0x80000 bytes through 0xa61f70), SSF.exe 0xa61f70 0xa61fad-0xa6200e (fopen rb, fread count compared to the size), libnative-lib.so SSF::CStateSaveBase::_GetBIOSHash 0x134b8ec-0x134b924"
- name: "epr-20091.ic8"
aliases:
@@ -98,19 +106,20 @@ files:
- epr-17741a.ic8
- epr-17742a.ic8
system: sega-stv
- required: true
+ required: false
+ hle_fallback: true
size: 524288
description: "ST-V BIOS"
note: "Loose 512 KiB EPROM image, read outside the cartridge ZIP. Any of the board revisions is accepted, the code branching on none of them."
- source_ref: "SSF.exe 0x43d91f (STVBIOS 0x129b218), SSF.exe 0x129a328, SSF-archive Document/Readme.txt ST-V BIOS option, SSF-archive Document/Readme.txt No BIOS option"
+ source_ref: "SSF.exe 0x43d91f (STVBIOS 0x129b218), SSF.exe 0x129a328, SSF.exe 0xae0950 0xae0db4-0xae0e93 (ST-V mode reads this path through 0xa61f70 whatever NoBIOS says), 0xae0ea6-0xae0ef6 (SEGA ST-V(TITAN) compare, 16-bit swap), 0xa7cfa3-0xa7cfbc (BIOS absent passed to STVSystemCall::Initialize 0xa77630)"
- name: ".bin"
system: sega-saturn
required: false
category: game_data
description: "cartridge image mapped at A-Bus CS0"
- note: "[Peripheral] DataCartridge, gated by DataCartridgeEnable and off by default. SSF reads the file at the configured path into the 32 MiB A-Bus CS0 window and identifies it in no way. The dumps that belong there are the two Saturn ROM carts, mpr-18811-mx.ic1 for The King of Fighters '95 and mpr-19367-mx.ic1 for Ultraman. Readme.txt records the option as unverified."
- source_ref: "SSF.exe 0x43e26b (DataCartridge 0x1298838), SSF.exe 0x43e178 (DataCartridgeEnable 0x1298820), SSF.exe 0x129a340, SSF.exe 0x916e5e-0x916e84, SSF-archive Document/Readme.txt Data Cartridge option"
+ note: "[Peripheral] DataCartridge, gated by DataCartridgeEnable and off by default. SSF reads the file at the configured path into the 32 MiB A-Bus CS0 window and identifies it in no way. The dumps that belong there are the two Saturn ROM carts, mpr-18811-mx.ic1 for The King of Fighters '95 and mpr-19367-mx.ic1 for Ultraman."
+ source_ref: "SSF.exe 0x43e26b (DataCartridge 0x1298838), SSF.exe 0x43e178 (DataCartridgeEnable 0x1298820), SSF.exe 0x129a340, SSF.exe 0x916e5e-0x916e84"
- name: ".cht"
path: "Cheat//.cht"
diff --git a/emulators/superzsnes.yml b/emulators/superzsnes.yml
index 622381f47..49ee7dc68 100644
--- a/emulators/superzsnes.yml
+++ b/emulators/superzsnes.yml
@@ -31,7 +31,9 @@ notes: |
v0.320b. The Windows and Linux archives (SuperZSNES_v0.320.zip, sha1
c934d6b74a050ef8857595a0529ee0e0006e2d93, and SuperZSNES_v0.320.tar.gz,
sha1 7630f6bbcda789a329ee4198ec11934feaf56e32, from zsnes.com/files)
- carry the same VersionNo object in level0.
+ carry the same VersionNo object in level0. Method addresses are those the
+ Windows GameAssembly.dll (sha256 5643f3364802cea8) assigns to the metadata
+ methods (global-metadata.dat version 39, sha256 99a8e5dbfa9f6028).
One NEC uPD7725 interpreter serves every cartridge whose header declares a
DSP. RomLoader.GetROMType reads the cartridge type byte at $FFD6 and returns
@@ -74,7 +76,7 @@ files:
size: 8192
crc32: 465c4e1c
validation: [crc32]
- source_ref: "GameAssembly DSP1..ctor (name and expected CRC32 0x465C4E1C, compare, warn on mismatch), DSP1Core.LoadROM (8192-byte layout)"
+ source_ref: "GameAssembly.dll v0.320 DSP1..ctor at 0x1805587d0 (name and expected CRC32 0x465C4E1C loaded at 0x1805588e8, compare, warn on mismatch, zero-filled 0x2000 buffer at 0x180558e33), DSP1Core.LoadROM at 0x180555280 (8192-byte layout)"
note: "Default for every DSP cartridge with no table entry, so it covers DSP-1 and DSP-1A titles as well. A mismatched CRC32 warns and the data is used anyway."
- name: "dsp2.rom"
@@ -83,7 +85,7 @@ files:
description: "NEC uPD7725 DSP-2 microcode"
required: true
size: 8192
- source_ref: "GameAssembly DSP1..ctor (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 0, title CRC32 0x84690f8b)"
+ source_ref: "GameAssembly.dll v0.320 DSP1..ctor at 0x1805587d0 (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 0, title CRC32 0x84690f8b)"
note: "Selected for header title 'DUNGEON MASTER' (Dungeon Master)."
- name: "dsp3.rom"
@@ -92,7 +94,7 @@ files:
description: "NEC uPD7725 DSP-3 microcode"
required: true
size: 8192
- source_ref: "GameAssembly DSP1..ctor (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 1, title CRC32 0xfa7f8076)"
+ source_ref: "GameAssembly.dll v0.320 DSP1..ctor at 0x1805587d0 (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 1, title CRC32 0xfa7f8076)"
note: "Selected for the half-width katakana header title of SD Gundam GX, 'SD' then $B6 $DE $DD $C0 $DE $D1 then 'GX'."
- name: "dsp4.rom"
@@ -101,7 +103,7 @@ files:
description: "NEC uPD7725 DSP-4 microcode"
required: true
size: 8192
- source_ref: "GameAssembly DSP1..ctor (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 2, title CRC32 0x42578645)"
+ source_ref: "GameAssembly.dll v0.320 DSP1..ctor at 0x1805587d0 (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 2, title CRC32 0x42578645)"
note: "Selected for header title 'TOP GEAR 3000' (Top Gear 3000)."
# Seta parts. The table routes their cartridges to the same uPD7725
@@ -113,7 +115,7 @@ files:
system: nintendo-snes
description: "Seta ST010 microcode"
required: true
- source_ref: "GameAssembly DSP1..ctor (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 3, title CRC32 0x04e7aca6)"
+ source_ref: "GameAssembly.dll v0.320 DSP1..ctor at 0x1805587d0 (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 3, title CRC32 0x04e7aca6)"
note: "Selected for header title 'F1 ROC II' with $00 as the 21st byte (F1 ROC II: Race of Champions)."
- name: "st011.rom"
@@ -121,7 +123,7 @@ files:
system: nintendo-snes
description: "Seta ST011 microcode"
required: true
- source_ref: "GameAssembly DSP1..ctor (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 4, title CRC32 0xc96d71c1)"
+ source_ref: "GameAssembly.dll v0.320 DSP1..ctor at 0x1805587d0 (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 4, title CRC32 0xc96d71c1)"
note: "Selected for header title '2DAN MORITA SHOUGI' with $00 as the 21st byte (Hayazashi Nidan Morita Shougi)."
- name: "st018.rom"
@@ -129,5 +131,5 @@ files:
system: nintendo-snes
description: "Seta ST018 firmware"
required: true
- source_ref: "GameAssembly DSP1..ctor (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 5, title CRC32 0x85885c5e)"
+ source_ref: "GameAssembly.dll v0.320 DSP1..ctor at 0x1805587d0 (table lookup, no CRC32 check), SUPERZSNES_Data/level0 (VersionNo.dspDetections entry 5, title CRC32 0x85885c5e)"
note: "Selected for header title 'NIDAN MORITASHOGI2' (Hayazashi Nidan Morita Shougi 2)."
diff --git a/emulators/teknoparrot.yml b/emulators/teknoparrot.yml
index f54cfbf91..2634434c9 100644
--- a/emulators/teknoparrot.yml
+++ b/emulators/teknoparrot.yml
@@ -76,9 +76,9 @@ notes: |
Play! runs System 246/256 games from its arcadedefs (dongle, CD or HDD image)
with HLE and loads no BIOS. CrediarDolphin ships Sys/Triforce/segaboot.gcm,
which it opens for the test menus, and the free DSP ROMs in Sys/GC. The
- RPCS3 fork refuses to boot without installed PS3 firmware ("PS3 firmware is
- not installed or the installed firmware is invalid."). The cxbxr fork keeps
- the Chihiro media board files of Cxbx-Reloaded under EmuMediaBoard.
+ RPCS3 fork refuses to boot without installed PS3 firmware ("Missing Firmware
+ Detected!"). The cxbxr fork keeps the Chihiro media board files of
+ Cxbx-Reloaded under EmuMediaBoard.
Not documented: the BIOS sets of TeknoMVS, TeknoCPS, TeknoSS32 and the other
Tekno* board emulators. TeknoParrotUI names only the game ZIP for them
@@ -238,8 +238,8 @@ files:
required: true
storage: large_file
description: "PlayStation 3 system software update"
- note: "Installed into dev_flash through Install firmware from PS3UPDAT.PUP. Without installed firmware the fork stops with \"PS3 firmware is not installed or the installed firmware is invalid.\""
- source_ref: "RPCS3 rpcs3.exe, release RPCS3_1.0.0.7"
+ note: "Installed into dev_flash through Install firmware from PS3UPDAT.PUP. Without dev_flash/sys/external/liblv2.sprx the boot stops and the \"Missing Firmware Detected!\" dialog asks for PS3UPDAT.PUP."
+ source_ref: "RPCS3 1.0.0.7 rpcs3.exe (sha256 89990c08039bdb21) Emulator::Load 0x14109dac2-0x14109db62 (ppu_exec ok and fs::is_file of dev_flash sys/external/liblv2.sprx false), 0x14109dbc0-0x14109dbd2 (an LLE firmware module is configured), 0x14109dc75-0x14109dced (Kill, then on_missing_fw on the main thread, boot ends), main_window 0x140cc6b50-0x140cc6b82 (Missing Firmware Detected! dialog), HandlePupInstallation 0x140cc1456: 0x140cc15a7 (fs::file open of the selected PUP), 0x140cc15ff (could not be opened), 0x140cc1635-0x140cc16d3 (pup_object parse: empty, not a PUP, incomplete)"
# cxbxr component, Chihiro (RetroBat core chihiro)
- name: fpr21042_m29w160et.bin
@@ -247,33 +247,34 @@ files:
system: sega-chihiro
required: true
size: 2097152
+ validation: [size]
description: "Chihiro media board flash ROM"
- note: "Read to write out the two SEGABOOT halves when they are absent."
- source_ref: "cxbxr cxbxr-emu.dll, release cxbxr_1.0.0.20"
+ note: "Opened when a title is started directly (boot flags zero), the system is Chihiro and a boot.id sits beside the XBE. The emulator aborts when it is missing or not 2 MB, then writes the two SEGABOOT halves out of it when they are absent."
+ source_ref: "cxbxr 1.0.0.20 cxbxr-emu.dll (sha256 4396e61e874359c9) FUN_100c2dc0 0x100c2dc0-0x100c2dfa (static std::string fpr21042_m29w160et.bin), FUN_103deed0 0x103df12c-0x103df16c (xbeDirectory, parent_path FUN_10200420 of the XBE path), 0x103df408-0x103df4d4 (auto detect: XbeType 0, 1 or other gives system 2, 4 or 8, then filesystem::exists FUN_100cbc80 of xbeDirectory / boot.id, string 0x10652c54, sets 8 Chihiro), 0x103df572-0x103df646 (BootFlags zero, system 8 and a second exists of xbeDirectory / boot.id, otherwise jump to 0x103dfa07 past the ROM block), 0x103df6a7-0x103df72d (EmuMediaBoard path plus that name, exists check, CxbxrAbort Chihiro Media Board ROM could not be found), 0x103df744-0x103df769 (fopen, abort when it fails), 0x103df777-0x103df7b2 (fseek end, ftell, abort unless 0x200000), 0x103df83a-0x103df92e (SEGABOOT halves written when absent)"
- name: ic10_g24lc64.bin
path: "EmuMediaBoard/Chihiro/ic10_g24lc64.bin"
system: sega-chihiro
required: true
description: "Base board QC microcontroller firmware"
- note: "\"Failed to load base board qc firmware\" when it cannot be opened."
- source_ref: "cxbxr cxbxr-emu.dll, release cxbxr_1.0.0.20"
+ note: "\"Failed to load base board firmware\" and abort when it cannot be loaded."
+ source_ref: "cxbxr 1.0.0.20 cxbxr-emu.dll (sha256 4396e61e874359c9) FUN_102d0f70 0x102d10ae-0x102d10d7 (std::string ic10_g24lc64.bin), 0x102d12f7-0x102d13d6 (EmuMediaBoard\\Chihiro path, fopen and mapped-file helper FUN_102d0bf0 into 0x1070e560), 0x102d1461-0x102d1465 and 0x102d1af1-0x102d1b04 (CxbxrAbort Failed to load base board firmware)"
- name: pc20_g24lc64.bin
path: "EmuMediaBoard/Chihiro/pc20_g24lc64.bin"
system: sega-chihiro
required: true
description: "Base board SC microcontroller firmware"
- note: "\"Failed to load base board firmware\" when it cannot be opened."
- source_ref: "cxbxr cxbxr-emu.dll, release cxbxr_1.0.0.20"
+ note: "\"Failed to load base board qc firmware\" and abort when it cannot be loaded."
+ source_ref: "cxbxr 1.0.0.20 cxbxr-emu.dll (sha256 4396e61e874359c9) FUN_102d0f70 0x102d10ff-0x102d1128 (std::string pc20_g24lc64.bin), 0x102d1496-0x102d1576 (path, FUN_102d0bf0 into 0x1070e590), 0x102d15d1-0x102d15d5 and 0x102d1b0e-0x102d1b21 (CxbxrAbort Failed to load base board qc firmware)"
- name: ic11_24lc024.bin
path: "EmuMediaBoard/Chihiro/ic11_24lc024.bin"
system: sega-chihiro
required: true
description: "Base board configuration EEPROM"
- note: "\"Failed to load base board EEPROM\" when it cannot be opened."
- source_ref: "cxbxr cxbxr-emu.dll, release cxbxr_1.0.0.20"
+ note: "\"Failed to load base board EEPROM\" and abort when it cannot be loaded."
+ source_ref: "cxbxr 1.0.0.20 cxbxr-emu.dll (sha256 4396e61e874359c9) FUN_102d0f70 0x102d1150-0x102d117c (std::string ic11_24lc024.bin), 0x102d1606-0x102d1669 (path, FUN_102d0bf0 into 0x1070e578), 0x102d1688-0x102d168c and 0x102d1b2b-0x102d1b3e (CxbxrAbort Failed to load base board EEPROM)"
- name: backup_ram.bin
path: "EmuMediaBoard/Chihiro/backup_ram.bin"
@@ -282,8 +283,8 @@ files:
unsourceable: "written by the emulator, no canonical file"
has_builtin: true
description: "Base board backup memory"
- note: "Created by the emulator when absent (\"Could not create Backup File\" on failure)."
- source_ref: "cxbxr cxbxr-emu.dll, release cxbxr_1.0.0.20"
+ note: "Created by the emulator as 128 KiB of zeros when absent (\"Could not create Backup File\" on failure), then loaded."
+ source_ref: "cxbxr 1.0.0.20 cxbxr-emu.dll (sha256 4396e61e874359c9) FUN_102d0f70 0x102d1180-0x102d11c2 (std::string backup_ram.bin), 0x102d16eb-0x102d1725 (exists check), 0x102d1789-0x102d17cb (fopen, fseek 0x1ffff, fputc 0, fclose), 0x102d17ad and 0x102d1b4d-0x102d1b60 (CxbxrAbort Could not create Backup File), 0x102d1865 and 0x102d1887-0x102d188b, 0x102d1b6a-0x102d1b7d (FUN_102d0bf0 load, CxbxrAbort Failed to load base board BACKUP RAM)"
# CrediarDolphin component, Triforce (RetroBat core triforce)
- name: segaboot.gcm
@@ -294,5 +295,5 @@ files:
size: 2097152
sha1: "87918619c632ac9de270d4fdf396a57eb57fc620"
description: "Triforce boot program"
- note: "Shipped in the CrediarDolphin 1.0.0.10 release. Opened for the test menus, \"Failed to open segaboot.gcm, which is required for test menus\" otherwise."
- source_ref: "CrediarDolphin Dolphin.exe, release CrediarDolphin_1.0.0.10"
+ note: "Shipped in the CrediarDolphin 1.0.0.10 release. User/Triforce/segaboot.gcm is preferred when present. Read into the media board firmware for the test menus, \"Failed to open segaboot.gcm, which is required for test menus\" and no test menu otherwise."
+ source_ref: "CrediarDolphin Source/Core/Core/HW/DVD/AMMediaboard.cpp:498-526 at ReaverTeknoGods/CrediarDolphin 44afbabf7135303e9a29805f4b0bc12080545d3a (the revision Dolphin.exe 1.0.0.10, sha256 d7e5a7fe2989c7db, reports as its build and whose message it carries)"
diff --git a/emulators/voxatron.yml b/emulators/voxatron.yml
index bc3350742..b75a12430 100644
--- a/emulators/voxatron.yml
+++ b/emulators/voxatron.yml
@@ -26,8 +26,15 @@ notes: |
Batocera's generator runs bios/voxatron/vox with LD_LIBRARY_PATH set to
bios/voxatron. x86_64 only. vox_dyn is the variant linked against the
- system SDL2. libHoloPlayCore.so is the Looking Glass SDK the binary links
- against.
+ system SDL2.
+
+ Refs to binary code cite vox (sha256 045d95a428c10d7e) and vox_dyn
+ (sha256 3e20fa90c40abe2d), both with their symbol tables. For a Looking
+ Glass display codo_choose_display (0x16b7a0) matches the SDL display
+ name against looking and holoplay. Neither binary loads
+ libHoloPlayCore.so: no NEEDED entry, no string or immediate naming it or
+ an hpc_ symbol, and every dlopen site is SDL's own loader for system
+ libraries.
files:
- name: vox
@@ -43,7 +50,7 @@ files:
system: voxatron
required: false
description: "Voxatron dynamically linked executable"
- source_ref: "voxatron vox_dyn, NEEDED libSDL2-2.0.so.0, batocera lexaloffleGenerator.py:20, 42"
+ source_ref: "voxatron 0.3.5b vox_dyn, DT_NEEDED libSDL2-2.0.so.0 at 0x3b2780 (loader-resolved), codo_system_init 0x15f810 call SDL_Init@plt at 0x15f831, batocera lexaloffleGenerator.py:20, 42"
note: "The same program linked against the system SDL2 (its only extra NEEDED library). Batocera's generator never runs it."
- name: vox.dat
@@ -51,48 +58,48 @@ files:
system: voxatron
required: true
description: "Voxatron data file"
- source_ref: "voxatron vox, string vox.dat at 0x2a58f, voxatron vox_dyn, string vox.dat at 0x1f1af"
- note: "Opened from the folder of the binary that runs. Absent, vox stops with \"FATAL ERROR: could not load vox.dat\"."
+ source_ref: "voxatron 0.3.5b vox load_all_pods 0x2a560 0x2a58d-0x2a5ad (movabs vox.dat, prefixed with the program folder, codo_load_pod_set, fopen rb at 0x122d65), 0x2a670-0x2a67a (retry vox.dat in the working directory), 0x2a687-0x2a6b0 (codo_fatal_error, exit at 0x16abe4), vox_dyn load_all_pods 0x1f180 0x1f1ad-0x1f1cd, 0x1f29a, 0x1f2d0 (same sequence)"
+ note: "Opened from the folder of the binary that runs, then from the working directory. Absent from both, Voxatron stops with \"** FATAL ERROR: could not load vox.dat\"."
- name: libHoloPlayCore.so
path: voxatron/libHoloPlayCore.so
system: voxatron
required: false
description: "Looking Glass holographic display support library"
- source_ref: "voxatron vox, voxatron vox_dyn, batocera lexaloffleGenerator.py:41, 87-90"
- note: "Neither binary links it or names it, and neither opens it in a run (strace, with and without the file). Batocera's generator sets LD_LIBRARY_PATH to bios/voxatron, where it keeps the library."
+ source_ref: "batocera lexaloffleGenerator.py:41, 87-90"
+ note: "Put on LD_LIBRARY_PATH by Batocera's generator. Neither binary loads it."
- name: config.txt
unsourceable: "written by the emulator on exit, no canonical file"
system: voxatron
required: false
description: "Voxatron settings"
- source_ref: "voxatron vox, string config.txt at 0x27bea0"
- note: "Read beside the binary, then from ~/.lexaloffle/Voxatron, and written there when absent."
+ source_ref: "voxatron 0.3.5b vox codo_config_load 0x11a970 0x11a974-0x11a9d8 (home folder, fopen r), 0x11b156 (vdisk), 0x11b167-0x11b1a3 (beside the binary), 0x11b1d2 (neither: return with defaults), codo_config_save 0x11b480 0x11b484-0x11b4df (written to the home folder, called from codo_exit.part.2 at 0x10eb30)"
+ note: "Read from ~/.lexaloffle/Voxatron, else from beside the binary, and written to ~/.lexaloffle/Voxatron on exit."
- name: sdl_controllers.txt
unsourceable: "user supplied, no canonical file"
system: voxatron
required: false
description: "Custom SDL controller mappings"
- source_ref: "voxatron vox, string sdl_controllers.txt at 0x2847f7"
- note: "Read beside the binary, then from ~/.lexaloffle/Voxatron, where Voxatron writes it when absent."
+ source_ref: "voxatron 0.3.5b vox add_sdl_controllers 0x169cc0 0x169cc4-0x169d06 (beside the binary, fopen r), 0x169d14-0x169d33 (home folder), 0x169d40-0x169d6b (created there with a comment line when absent), 0x169e1c-0x169e3a (fgets, SDL_GameControllerAddMapping per line), called from codo_joystick_init at 0x169f23"
+ note: "Processed beside the binary when present, then from ~/.lexaloffle/Voxatron, where Voxatron writes it when absent."
- name: favourites.txt
unsourceable: "written by the emulator, no canonical file"
system: voxatron
required: false
description: "Cart browser favourites list"
- source_ref: "voxatron vox, string favourites.txt at 0x27a39e"
- note: "Read from ~/.lexaloffle/Voxatron."
+ source_ref: "voxatron 0.3.5b vox reload_favourites 0xf6bb0 0xf6bb1-0xf6be7, splore_init 0xfaeb0 0xfb15d-0xfb175 (populate_splore_list_from_text_file), save_splore_favourites 0xf4ee0 0xf4ee4"
+ note: "Read from ~/.lexaloffle/Voxatron and written there by the cart browser."
- name: internal_carts.txt
unsourceable: "written by the emulator, no canonical file"
system: voxatron
required: false
description: "Voxatron internal cart list"
- source_ref: "voxatron vox, string internal_carts.txt at 0x27a446"
- note: "Read from ~/.lexaloffle/Voxatron and written there at startup."
+ source_ref: "voxatron 0.3.5b vox splore_init 0xfaeb0 0xfaefc-0xfaf0e (codo_file_exists in the home folder), 0xfaf21-0xfaf45 (written from a built-in list when absent), 0xfaf54 (populate_splore_list_from_text_file), populate_internal_carts_list 0xfae10 0xfae12-0xfae87 (same sequence)"
+ note: "Read from ~/.lexaloffle/Voxatron, written there from a list built into the binary when absent."
- name: player_1.vpp
path: player/player_1.vpp
@@ -100,5 +107,5 @@ files:
system: voxatron
required: false
description: "Voxatron player profile"
- source_ref: "voxatron vox, string player/player_%d.vpp at 0x273f90"
+ source_ref: "voxatron 0.3.5b vox switch_to_profile 0x88220 0x8822d-0x8828e (player/player_%d.vpp in the home folder), 0x882cf (codo_fopen rb), 0x882d7 (absent: nothing read), save_current_player_profile 0x88460 0x88463-0x884be (codo_fopen wb)"
note: "Read from ~/.lexaloffle/Voxatron/player, and written there when absent."
diff --git a/emulators/xm6pro68k.yml b/emulators/xm6pro68k.yml
index a55a596a7..e23319d71 100644
--- a/emulators/xm6pro68k.yml
+++ b/emulators/xm6pro68k.yml
@@ -7,7 +7,7 @@ version_source:
url: "https://mijet.eludevisibility.org/XM6%20Pro-68k/Version.txt"
pattern: '^(\d+)'
based_on: "XM6 v2.06 by PI."
-profiled_date: "2026-10-20"
+profiled_date: "2026-11-10"
core_version: "260920"
version_basis:
kind: package
@@ -24,72 +24,63 @@ systems:
- sharp-x68000
notes: |
- Closed-source Windows fork of PI's XM6 v2.06 (README.txt:6) by M.I.J.E.T.,
- distributed only from mijet.eludevisibility.org as three 7-Zip packages: the
- program, a mandatory DLL Package and an optional Web Package that adds signed
- update downloads. Version.txt in the build analysed here reads 260920, and the
- DLL Package it pairs with is version 260101. Release 81 (261031) reads the
- same system files, its executable naming only the .IPS patch extension in
- addition. The first
- release, 120303, forked XM6 v2.05. XM6.exe is a 32-bit MFC application whose
- import directory names mfc90u.dll and MSVCR90.dll, so the Visual C++ 2008 runtime
- carried by the DLL Package, or the redistributable, must sit beside the executable
- for the process to start. A second non-Unicode build lives in MBCS/ and needs the
- same files duplicated there. ES-DE launches it through the XM6PRO68K and
- XM6PRO68K-WINDOWS find rules with the working directory set to the emulator
- folder, on Linux under Wine or Proton. RetroBat registers it as xm6pro
- (Program.cs:189, Installer.cs:151), runs XM6.exe from its own directory and
- rewrites XM6.ini before launch (Xm6pro.Generator.cs:22-79).
+ Closed-source Windows fork of PI's XM6 by M.I.J.E.T., distributed from
+ mijet.eludevisibility.org as three 7-Zip packages: the program, a mandatory DLL
+ Package and an optional Web Package. The build analysed here is the one RetroBat
+ serves as xm6pro.7z (sha256 2b44820429989fa2...), Version.txt 260920, with
+ XM6.exe sha256 df1ed921f5f00cfb54950f1672f659e3ceecc756016d0a76f3ccb5c1354a76ed
+ and MBCS/XM6.exe sha256 a4ac21e5fe15c865b931921068b03f5c8238dd992727ddc95b5f434f74a9a453.
+ Every address below is a virtual address in that Unicode XM6.exe. Release 81
+ (261031, XM6.exe sha256 4eb66f0229ca992c...) names the same system files, its only
+ new file name being the .IPS disk delta extension. XM6.exe is a 32-bit MFC
+ application whose import directory names mfc90u.dll and MSVCR90.dll, both
+ loader-resolved, so the Visual C++ 2008 runtime carried by the DLL Package, or the
+ redistributable, must sit beside the executable for the process to start. A
+ second non-Unicode build lives in MBCS/ and needs the same files duplicated there.
+ ES-DE launches it through the XM6PRO68K and XM6PRO68K-WINDOWS find rules with the
+ working directory set to the emulator folder, on Linux under Wine or Proton.
+ RetroBat registers it as xm6pro (Program.cs:189, Installer.cs:151), runs XM6.exe
+ from its own directory and rewrites XM6.ini before launch
+ (Xm6pro.Generator.cs:22-79).
- System files are resolved beside XM6.exe. XM6 v2.06 declares them in
- Filepath::SystemFile[] (vm/filepath.cpp:394-405) and Filepath::SysFile
- (vm/filepath.cpp:121-137) builds each path from SystemDir when one is set and from
- the executable's own directory otherwise. XM6 Pro-68k references all ten names,
- nine of them in one contiguous string block mirroring that table in reverse, and
- exposes no ROM directory setting, while README.txt:71-73 requires the DLL Package
- files to be extracted next to the executable rather than into a subdirectory.
- Loading goes through Fileio::Load and
- Fileio::Read (vm/fileio.cpp:35-51, 175-192), which succeed only when the file
- holds at least the requested byte count, so every size below is a floor: a longer
- file loads and its tail is ignored. The XM6 v2.06 sources cited throughout are
- readable in mixerjdp/XM6_Libretro, which preserves the vm/ layer.
+ System files sit in a ten-entry pointer table at 0x57a898 (IPLROM.DAT,
+ IPLROMXV.DAT, IPLROMCO.DAT, IPLROM30.DAT, ROM30.DAT, CGROM.DAT, CGROM.TMP,
+ SCSIINROM.DAT, SCSIEXROM.DAT, SRAM.DAT). Filepath::SysFile at 0x48b054 copies the
+ entry and calls 0x48ac18, which takes drive and directory from the executable
+ path that 0x48ab44 caches from GetModuleFileNameW (0x48aac0), so every system
+ file is read beside XM6.exe and no directory setting takes part.
+ Fileio::Load (0x489a75) opens the file and Fileio::Read (0x489d8b) succeeds only
+ when _read returns the full count, so the IPL and CG sizes below are floors. The
+ SCSI ROM loader compares _filelengthi64 (0x489e54) with the expected size and
+ rejects any other length.
- Machine selection follows ROM presence. Memory::Init (vm/memory.cpp:171-196)
- loads the base SASI machine, then probes XVI, Compact and X68030 in that order and
- keeps the first that succeeds. Memory::LoadROM (vm/memory.cpp:236-372) pairs each
- machine with its ROMs: XVI and Compact need their IPL plus SCSIINROM.DAT, X68030
- needs IPLROM30.DAT plus ROM30.DAT read at 0x20000 bytes instead of 0x2000, and the
- base machine needs no SCSI ROM. Internal SCSI is the interface built into the
- X68000 SUPER and later models, external SCSI is the CZ-6BS1 add-on board
- (Reference Manual.txt:1529-1536).
-
- Two files diverge from XM6 v2.06. The base IPL ROM is compiled into the
- executable: "The program now includes an internal copy of the basic IPL ROM. It
- will still try to load IPL ROMs externally first" (Change Log.txt:124-125), and
- README.txt:23-25 tells users to leave IPLROM.DAT out because loading it only costs
- startup time. The hard CG ROM requirement was dropped (Change Log.txt:128), so a
- missing font ROM yields garbage glyphs instead of failing initialisation
- (README.txt:278-281).
+ Memory::LoadROM (0x4903d7) takes the memory type stored by Memory::ApplyCfg
+ (0x4908af, 0x4908cb) from the saved configuration: 1 to 3 are the base X68000 with
+ no SCSI, internal SCSI or external SCSI, 4 XVI, 5 Compact and 6 X68030. It loads
+ the IPL ROM, the CG ROM (0x48e737, called at 0x490560) and the SCSI ROM (0x49016a,
+ called at 0x490570). Memory::Init loads type 1 at 0x4909f7 and fails only when that
+ load fails, which cannot happen since the base IPL is built in and neither the CG
+ ROM nor the SCSI slot is mandatory for type 1. A requested type that fails to
+ load falls back to type 1 (0x49063b, 0x490658-0x49066a).
Two menu tools synthesise replacements. Synthesize replacement CG-ROM builds
- CGROM.TMP from the installed MS Gothic and MS Mincho fonts and aborts when either
- is absent, and README.txt:295-299 warns that different machines produce different
- files. Synthesize replacement SCSI ROMs asks for a Human68k version 3.02 disk
- image, dialog default HUMAN302.XDF with filter *HUMAN*3*02*.???, extracts
- /BIN/FORMAT.X and writes SCSIINROM.DAT and SCSIEXROM.DAT.
+ CGROM.TMP from the installed MS Gothic and MS Mincho fonts, resolving CGROM.TMP at
+ 0x45f8eb-0x45f8f4 and CGROM.DAT at 0x45fa47-0x45fa50. Synthesize replacement
+ SCSI ROMs asks for a Human68k version 3.02 disk image, dialog default
+ HUMAN302.XDF (0x45fd6a) with filter *HUMAN*3*02*.??? (0x45fced), extracts
+ /BIN/FORMAT.X and writes SCSIINROM.DAT and SCSIEXROM.DAT, whose paths it resolves
+ at 0x45fc7a-0x45fc9e.
- The ROM Warning section of the Advanced options holds three checks, all enabled
- by default and individually suppressible: an IPLROM.DAT version check naming
- version 1.0 (05/07/1987) as recommended, a CGROM.DAT contents check and a
- SCSIEXROM.DAT / SCSIINROM.DAT contents check. Since release 78 the SCSI ROMs are
- read at startup only when the saved configuration needs them, and their check
- otherwise runs from the SCSI page of the options (Change Log.txt:3093-3096).
- Each check raises a dialog, but none rejects the file, so no hash below is
+ The ROM Warning options hold three checks, each suppressible. The IPL check
+ (0x48ee5c) accepts the base IPL when the IOCS date bytes at 0x1000a, 0x1000c and
+ 0x1000d spell 87/05/07, and LoadROM identifies the IPL revision from the dword at
+ 0x1000a against a table at 0x572458 (0x490519-0x490552). The CG check (0x48eea3)
+ sums and XORs 0x1000 bytes at 0x3a800 of the font and wants 0xec and 0x84. The
+ SCSI check (0x48eedc) reads 0x2000 bytes of SCSIINROM.DAT and SCSIEXROM.DAT and
+ flags a file holding "XM6 " at 0x1ff8, the stamp of synthesised replacements
+ (0x48ef82, 0x48efc6). Each check only raises a dialog, so no hash below is
enforced by the program.
- Reference Manual.txt ships with the program and Software Notes.txt is fetched by
- the Web Package through Scripts\Update Notes.bat. Both are prose documents that
- the Help menu and Help > Peruse Notes hand to a text editor, not data XM6 parses.
XM6.ini and XM6U.ini are written by the program.
files:
@@ -104,17 +95,15 @@ files:
md5: 7fd4caabac1d9169e289f0f7bbf71d8e
sha1: 0ed038ed2133b9f78c6e37256807424e0d927560
description: "X68000 boot ROM, base SASI model"
- source_ref: "Change Log.txt:124-125, README.txt:23-25, XM6 2.06 vm/memory.cpp:256-276"
+ source_ref: "XM6.exe 260920 Memory::LoadROM 0x4903d7: 0x490461-0x490478 (types 1 to 3 give table entry 0, Filepath::SysFile 0x48b054), 0x490496 (Fileio::Load 0x20000), 0x49049f-0x4904bf (types 1 to 3 on failure copy the built-in 0x20000 bytes from 0x552458 and skip the swap), 0x4904f8 (16-bit swap 0x407710), IPL check 0x48ee5c"
note: >-
XM6.exe carries this ROM internally and only reads the file when it is
- present, so the emulator boots without it. The embedded copy sits at file
- offset 1382488 in .rdata of the Unicode build and 1332664 in the MBCS build,
- stored in the 16-bit pairwise swapped form the loader produces at
- vm/memory.cpp:278-285. Unswapped it is the 131072-byte dump hashed here,
+ present, so the emulator boots without it. The embedded copy sits at
+ 0x552458, file offset 1382488, in .rdata of the Unicode build and at file
+ offset 1332664 in the MBCS build, stored in the 16-bit pairwise swapped form
+ the loader produces. Unswapped it is the 131072-byte dump hashed here,
catalogued by TOSEC as Sharp X68000 Boot ROM (1987)(Sharp), and it is the
- version 1.0 (05/07/1987) the startup warning recommends. README.txt:23-25
- advises against installing the file at all because reading and swapping it
- only lengthens startup.
+ version 1.0 (05/07/1987) the IPL check accepts.
- name: IPLROMXV.DAT
system: sharp-x68000
@@ -122,11 +111,11 @@ files:
min_size: 131072
validation: [size]
description: "X68000 XVI boot ROM"
- source_ref: "XM6 2.06 vm/memory.cpp:178-180, 261-263"
+ source_ref: "XM6.exe 260920 Memory::LoadROM 0x4903d7: 0x49041e-0x49045f (type 4 gives table entry 1), 0x490478 (Filepath::SysFile 0x48b054), 0x490496 (Fileio::Load 0x20000), 0x4904c1-0x4904eb (failure logs Missing or invalid ROM file and returns 0), 0x49063b 0x490658-0x49066a (fallback to type 1)"
note: >-
- Probed after the base machine loads. Its presence, together with
- SCSIINROM.DAT, is what makes the XVI machine available. Absent, the base
- X68000 still runs. No internal copy is compiled into XM6.exe.
+ Read when the configuration selects the XVI. Absent or short, LoadROM
+ fails and the base X68000 runs instead. No internal copy is compiled into
+ XM6.exe.
- name: IPLROMCO.DAT
system: sharp-x68000
@@ -134,10 +123,10 @@ files:
min_size: 131072
validation: [size]
description: "X68000 Compact boot ROM"
- source_ref: "XM6 2.06 vm/memory.cpp:181-185, 264-266"
+ source_ref: "XM6.exe 260920 Memory::LoadROM 0x4903d7: 0x490423-0x49045a (type 5 gives table entry 2), 0x490478 (Filepath::SysFile 0x48b054), 0x490496 (Fileio::Load 0x20000), 0x4904c1-0x4904eb (failure returns 0), 0x49063b 0x490658-0x49066a (fallback to type 1)"
note: >-
- Probed after XVI. Selects the Compact machine when found, and that machine
- also needs SCSIINROM.DAT. No internal copy is compiled into XM6.exe.
+ Read when the configuration selects the Compact, under the same rules as
+ IPLROMXV.DAT. No internal copy is compiled into XM6.exe.
- name: IPLROM30.DAT
system: sharp-x68000
@@ -145,25 +134,25 @@ files:
min_size: 131072
validation: [size]
description: "X68030 boot ROM"
- source_ref: "XM6 2.06 vm/memory.cpp:186-190, 267-269"
+ source_ref: "XM6.exe 260920 Memory::LoadROM 0x4903d7: 0x490428-0x49042b and 0x490417 (type 6 gives table entry 3), 0x490478 (Filepath::SysFile 0x48b054), 0x490496 (Fileio::Load 0x20000), 0x4904c1-0x4904eb (failure returns 0), 0x49063b 0x490658-0x49066a (fallback to type 1)"
note: >-
- Probed last. Selects the X68030 machine, which also needs ROM30.DAT. No
- internal copy is compiled into XM6.exe.
+ Read when the configuration selects the X68030, which also reads
+ ROM30.DAT. No internal copy is compiled into XM6.exe.
- # -- X68030 SCSI ROM, the one SCSI ROM read at 0x20000 bytes --
+ # -- X68030 SCSI ROM, the one SCSI-slot ROM read at 0x20000 bytes --
- name: ROM30.DAT
system: sharp-x68000
required: false
- min_size: 131072
+ size: 131072
validation: [size]
description: "X68030 SCSI ROM"
- source_ref: "README.txt:25, XM6 2.06 vm/memory.cpp:316-319, 334-337"
+ source_ref: "XM6.exe 260920 LoadSCSIROM 0x49016a: 0x4901cc-0x4901ea (type 6 gives table entry 4 and size 0x20000), 0x49025e (open, failure logs Unable to open ROM file), 0x4902a3-0x4902b9 (_filelengthi64 must equal 0x20000, else Wrong size for ROM file), 0x4902e5 (read), 0x49034f (16-bit swap), Memory::LoadROM 0x4903d7 0x4905aa-0x490613 (absent: stub slot with the SCSIIN signature)"
note: >-
- The SCSI half of the X68030 machine, and the only SCSI ROM read at 0x20000
- bytes rather than 0x2000. Without it LoadROM(X68030) fails and the X68030
- machine is not offered. README.txt:25 calls it non-critical and notes that
- installing it can cost performance.
+ The SCSI half of the X68030 machine, and the only SCSI-slot ROM read at
+ 0x20000 bytes, at exactly that length. When it is missing or of another
+ size LoadROM fills the slot with 0xff, writes a stub header carrying the
+ SCSIIN signature at offset 0x24, and the X68030 still starts.
The copy here is the X68000 Firmware set's ROM30.DAT (SCSIIN, ROM Human 2.x, ROM FLOAT and the SCSI-IOCS binary), read out of an X68030 by the XM6 2.06 utility, which stamps its name at the tail of the image.
# -- Font ROM, read at 0xc0000 bytes, CGROM.DAT first then CGROM.TMP --
@@ -177,15 +166,14 @@ files:
md5: cb0a5cfcf7247a7eab74bb2716260269
sha1: 8d72c5b4d63bb14c5dbdac495244d659aa1498b6
description: "X68000 character generator ROM"
- source_ref: "README.txt:278-281, Change Log.txt:128, XM6 2.06 vm/memory.cpp:287-295"
+ source_ref: "XM6.exe 260920 0x48e737: 0x48e783-0x48e78c (table entry 5), 0x48e7a3 (Fileio::Load 0xc0000), 0x48e7ac-0x48e7cb (CGROM.TMP tried next), 0x48e7cd-0x48e7ef (both absent: logs Unable to load CGROM.DAT or CGROM.TMP and fills the font with 0x55 at 0x42245f), 0x48e7fe (16-bit swap), CG check 0x48eea3"
note: >-
- Supplies the glyphs for text the X68000 renders. Stock XM6 v2.06 fails
- initialisation when neither font file loads, but XM6 Pro-68k dropped that
- requirement, so a missing font ROM shows garbage glyphs and the emulator
- keeps running, and what remains is the suppressible contents warning.
- The mandatory DLL Package ships this exact 786432-byte file, catalogued by
- TOSEC as Sharp X68000 CG ROM (1987)(Sharp). The hash identifies that copy and
- is not verified by the program.
+ Supplies the glyphs for text the X68000 renders. When neither font file
+ loads, the font area is filled with 0x55, text shows as garbage and the
+ emulator keeps running. The mandatory DLL Package ships this exact
+ 786432-byte file, catalogued by TOSEC as Sharp X68000 CG ROM
+ (1987)(Sharp), and it passes the CG check. The hash identifies that copy
+ and is not verified by the program.
- name: CGROM.TMP
system: sharp-x68000
@@ -194,63 +182,61 @@ files:
min_size: 786432
validation: [size]
description: "Synthesised font ROM, fallback when CGROM.DAT is absent"
- source_ref: "README.txt:295-299, XM6 2.06 vm/memory.cpp:290-294"
+ source_ref: "XM6.exe 260920 0x48e737: 0x48e7ac-0x48e7b2 (table entry 6, reached only after CGROM.DAT fails), 0x48e7c4 (Fileio::Load 0xc0000), 0x48e7fe (16-bit swap)"
note: >-
- Read only when CGROM.DAT is missing, at the same size. Tools > Synthesize
- replacement CG-ROM writes it from the installed MS Gothic and MS Mincho fonts
- and fails when either is absent. No hash is declared because the output
- depends on the fonts of the machine that generated it. XM6 refuses to use it
- while CGROM.DAT is present.
+ Read only when CGROM.DAT is missing or short, at the same size. Tools >
+ Synthesize replacement CG-ROM writes it from the installed MS Gothic and MS
+ Mincho fonts. No hash is declared because the output depends on the fonts
+ of the machine that generated it.
- # -- SCSI ROMs, read at 0x2000 bytes, required by the interface they drive --
+ # -- SCSI ROMs, exact 0x2000 bytes, required by the interface they drive --
- name: SCSIINROM.DAT
system: sharp-x68000
required: false
bundled: true
- min_size: 8192
+ size: 8192
validation: [size]
md5: aeb4607a14612606c833227437aaa16a
sha1: 15a17798839a3f7f361119205aebc301c2df5967
description: "Internal SCSI interface ROM, X68000 SUPER and later"
- source_ref: "Reference Manual.txt:1529-1536, XM6 2.06 vm/memory.cpp:309-315"
+ source_ref: "XM6.exe 260920 LoadSCSIROM 0x49016a: 0x4901b7-0x4901ea (types 2, 4 and 5 give table entry 7, size 0x2000), 0x4901fc-0x490219 (deferred while the flag read by 0x40b726 is set), 0x49025e (open), 0x4902a3-0x4902b5 (_filelengthi64 must equal 0x2000), 0x4902e5 (read), 0x49034f (swap), Memory::LoadROM 0x4903d7 0x49057d-0x4905ad (types 4 and 5 continue with the slot at 0xff, types 2 and 3 fail), SCSI check 0x48eedc 0x48ef1f-0x48ef82"
note: >-
- Needed to use internal SCSI drives, and also loaded as part of the XVI and
- Compact machines, so those two models are unavailable without it whatever
- their IPL. The mandatory DLL Package ships this exact 8192-byte file and the
- hash identifies that copy, while the startup contents check only warns.
+ Needed for the internal SCSI option on the base X68000, which otherwise
+ falls back to the plain base machine. The XVI and Compact start without it
+ with the SCSI slot left at 0xff. The mandatory DLL Package ships this exact
+ 8192-byte file and the hash identifies that copy, while the startup SCSI
+ check only warns.
- name: SCSIEXROM.DAT
system: sharp-x68000
required: false
bundled: true
- min_size: 8160
+ size: [8160, 8192]
validation: [size]
md5: 237be014374b74d327f15f250d4d62bf
sha1: 49616c09a8986ffe6a12ad600febe512f7ba8ae4
description: "External SCSI interface ROM, CZ-6BS1 board"
- source_ref: "Reference Manual.txt:1529-1536, XM6 2.06 vm/memory.cpp:320-324, 346-357"
+ source_ref: "XM6.exe 260920 LoadSCSIROM 0x49016a: 0x4901bc-0x4901ea (type 3 gives table entry 8, size 0x2000), 0x4902a3-0x4902d4 (_filelengthi64 must be 0x2000, or 0x1fe0 loaded at offset 0x20 behind 0x20 bytes of 0xff), 0x4902e5 (read), 0x490315-0x490346 (an 8192-byte image whose first dword is neither 0 nor 0xffffffff is moved up 0x20 bytes), 0x49034f (swap), SCSI check 0x48eedc 0x48ef8f-0x48efc6"
note: >-
- Needed to use the external SCSI interface, which is the only SCSI variant
- that can coexist with SASI. The loader first reads 0x2000 bytes and, on
- failure, retries with the 0x1fe0-byte WinX68k layout loaded at buffer offset
- 0x20, so 8160 is the real floor. The mandatory DLL Package ships the
- 8192-byte form hashed here.
+ Needed for the external SCSI option on the base X68000, which otherwise
+ falls back to the plain base machine. Two lengths are accepted: 8192 bytes,
+ and the 8160-byte WinX68k layout. An 8192-byte image that starts with
+ data rather than the blank register window is shifted to the same layout.
+ The mandatory DLL Package ships the 8192-byte form hashed here.
# -- Battery-backed NVRAM --
- name: SRAM.DAT
system: sharp-x68000
required: false
- size: 16384
+ size: [16384, 65536]
description: "X68000 SRAM image, boot device and memory switch settings"
- source_ref: "Reference Manual.txt:1366-1368, 2648-2651, XM6 2.06 vm/filepath.cpp:404"
+ source_ref: "XM6.exe 260920 SRAM init 0x4abb9d: 0x4abb9f (fills 0x10000 bytes with 0xff at 0x4ab4d8), 0x4abba4-0x4abbaa (table entry 9), 0x4abbc1 (Fileio::Load 0x10000, result ignored), 0x4abc15 (swap), 0x4ab50f 0x4ab517-0x4ab52c (save writes the configured size in KB, 16 by default at 0x4abb11)"
note: >-
- Read at startup and rewritten on exit when the contents changed, so XM6
- creates it on first run and a supplied image only preloads the settings. The
- Tools > SRAM menu reloads, duplicates and write-protects it, and the boot
- counter option updates it on exit. Size is the X68000 SRAM size and is not
- checked by the program.
+ Read at startup and rewritten on exit, so XM6 creates it on first run and
+ a supplied image only preloads the settings. Up to 64 KB is read with no
+ size check. The program writes 16 KB, or 64 KB with the SRAM64K option.
# -- Optional libraries loaded by name at runtime, shipped in the DLL Package --
@@ -261,12 +247,12 @@ files:
required: false
bundled: true
description: "7-Zip library for .7z, .zip and .xz support"
- source_ref: "README.txt:166-170, XM6.exe strings 7z.dll, Optional DLL Not Present"
+ source_ref: "XM6.exe 260920 0x401ce4: 0x401cfd-0x401d02 (7Z.DLL through the loader 0x40ce48: LoadLibraryW beside XM6.exe at 0x40ce90, then the system directory at 0x40cf01, then the Windows directory at 0x40cf67), 0x401d1c-0x401d22 (GetProcAddress CreateObject), 0x4505f0-0x4505fb (absent: 0x412122 index 0 shows Optional DLL Not Present at 0x412109)"
note: >-
- Absent from the import directory and looked up by name at runtime, so XM6
+ Absent from the import directory and loaded on first archive use, so XM6
starts without it and reports Optional DLL Not Present, Archive support is
- not available. Enables loading disk images and state files from archives and
- writing XZ-compressed state files.
+ not available. Enables loading disk images and state files from archives
+ and writing XZ-compressed state files.
- name: zlib1.dll
size: 59904
@@ -275,9 +261,9 @@ files:
required: false
bundled: true
description: "zlib, used for PNG output and deflate archives"
- source_ref: "XM6.exe strings 7z.dll or zlib1.dll, ZLIB1.DLL, deflateInit2_, deflate, deflateReset, deflateEnd"
+ source_ref: "XM6.exe 260920 delay-load descriptor 0x5761ec for zlib1.dll, IAT 0x585a68 (crc32, inflate, inflateEnd, inflateInit2_, deflateEnd, deflateInit2_, deflateReset, deflate), 0x40cf85 0x40cf8e-0x40cf98 (ZLIB1.DLL through the loader 0x40ce48, handle cached at 0x59e66c), callers 0x414487, 0x4280bc and 0x489151-0x48915d (absent: 0x412122 index 1 names 7z.dll or zlib1.dll in the Optional DLL Not Present dialog)"
note: >-
- Looked up by name at runtime alongside 7z.dll and named in the same Optional
- DLL Not Present dialog. XM6.exe resolves deflateInit2_, deflate,
- deflateReset and deflateEnd from it, and the display capture commands
- write PNG files.
+ Delay-loaded, so the process starts without it, and every caller first
+ loads it by name and skips its zlib path when that fails. XM6.exe resolves
+ inflate, deflate and crc32 from it for deflate archives and PNG display
+ captures.
diff --git a/emulators/xm6typeg.yml b/emulators/xm6typeg.yml
index 615e29d17..6cf3777ae 100644
--- a/emulators/xm6typeg.yml
+++ b/emulators/xm6typeg.yml
@@ -7,7 +7,7 @@ version_source:
url: "http://retropc.net/pi/xm6/index.html"
pattern: '\(version [0-9.]+ \S+ version ([0-9.]+)\)'
based_on: "XM6 v2.06 by PI."
-profiled_date: "2026-08-10"
+profiled_date: "2026-11-10"
core_version: "3.38"
version_basis:
kind: package
@@ -25,69 +25,101 @@ systems:
- sharp-x68000
notes: |
- Closed-source Windows fork of XM6 v2.06, extended by GIMONS from 2010 and
- maintained again by PI. since version 3.34 (xm6g.pdf p.1, p.3). Distributed from
- PI's XM6 page as a single archive, xm6_typeg_338_20260223.zip, holding an x64
- xm6g.exe, the Visual C++ 2015-2019 runtime it imports (mfc140u.dll,
- msvcp140.dll, vcruntime140.dll, vcruntime140_1.dll) and the 32-page manual
- xm6g.pdf. No source is published. The analysis below reads xm6g.exe, and the
- XM6 v2.06 sources cited alongside are PI's own release, xm6_206s.zip from the
- same page. ES-DE launches it through the XM6TYPEG and XM6TYPEG-WINDOWS find
- rules with the working directory set to the emulator folder, on Linux under
- Wine or Proton. The archive alone does not run: the manual opens with that
- warning (xm6g.pdf p.5).
+ Closed-source Windows fork of XM6 v2.06 by GIMONS, maintained again by PI.
+ Distributed from PI's XM6 page as one archive, xm6_typeg_338_20260223.zip
+ (sha256 71c2b3429163128f...), holding an x64 xm6g.exe (sha256
+ 3d50aab23ce6c8ae1677b1ca8adaa8b0c6c9dabb1c06b98d0f2ea10fe44ac5de), the Visual
+ C++ 2015-2019 runtime it imports (mfc140u.dll, msvcp140.dll, vcruntime140.dll,
+ vcruntime140_1.dll, loader-resolved) and xm6g.pdf. No source is published.
+ Every address below is a virtual address in that xm6g.exe, function bounds taken
+ from its .pdata. ES-DE launches it through the XM6TYPEG and XM6TYPEG-WINDOWS find
+ rules with the working directory set to the emulator folder, on Linux under Wine
+ or Proton.
- Machines emulated are X68000, XVI, Compact, X68030 and the 040turbo and
- 060turbo accelerator configurations (xm6g.pdf p.3). System files are resolved
- beside xm6g.exe. A twenty-entry name table at xm6g.exe:0x140592350 holds them,
- against ten in Filepath::SystemFile[] (XM6 2.06 vm/filepath.cpp:472-483), and
- each path is built by copying the name, splitting it, and refilling drive and
- directory from GetModuleFileNameW, the sequence XM6 2.06 spells out in
- Filepath::SysFile and Filepath::SetBaseDir (vm/filepath.cpp:88-105, 172-186).
- The path is rebuilt from the module path on every load, with no configured
- directory taking part. Loading reads a fixed byte count and compares it
- against the count returned, so every min_size below is a floor: a longer file
- loads and its tail is ignored.
+ System files sit in a twenty-entry pointer table at 0x140592350 (IPLROM.DAT
+ first, STATE.XM6 last). Filepath::SysFile at 0x1404e76d0 indexes it, copies the
+ name, splits it and jumps to 0x1404e7950, which refills drive and directory from
+ GetModuleFileNameW, so every system file is read beside xm6g.exe and no
+ configured directory takes part. LoadROM inlines the same sequence for index 0
+ (0x1404fca8d-0x1404fcb52). Fileio::Open is 0x1404e7390 (CreateFileW) and
+ Fileio::Load 0x1404e7200 (ReadFile, success only when the full count is read).
- Two files are mandatory. LoadROM (xm6g.exe:0x1404fc9a5) leaves through its
- failure exit when the IPL read fails, and the CG read falls back to CGROM.TMP
- before failing the same way, which is the string "XM6 requires two ROM files,
- IPLROM.DAT file and CGROM.DAT(or CGROM.TMP) file." Nothing in the executable
- substitutes for either. The system options page probes IPLROM.DAT,
- IPLROMXV.DAT, IPLROMCO.DAT and IPLROM30.DAT with GetFileSizeEx and accepts a
- file only at exactly 131072 bytes (xm6g.exe:0x140428f80, size test at
- 0x14042920a).
+ LoadROM (0x1404fc990) takes a memory type set by Memory::ApplyCfg
+ (0x1404fe390): types 1 to 3 are the base X68000 with no SCSI, internal SCSI or
+ external SCSI, 4 is XVI, 5 Compact, 6 X68030 and 7 X68030 with the expansion ROM
+ option on. It reads the IPL ROM, then the CG ROM, then the SCSI ROM, and a short
+ ReadFile count fails the load, so every min_size below is a floor and a longer
+ file loads with its tail ignored.
+
+ The startup path to LoadROM(1). The CRT calls wWinMain at 0x1405767ad, a thunk
+ at 0x1405776fc to AfxWinMain (mfc140u.dll 14.42.34433.0 ordinal 2370), which
+ calls InitInstance through vtable offset 0xb0 (0x1802b2ba7-0x1802b2bae in that
+ DLL). The application object at 0x14084db20 is built by the static initializer
+ 0x140425b90 (initializer table entry 0x14057e990) with vtable 0x14057ec20, whose
+ slot 22 (+0xb0) is InitInstance 0x140425e30. InitInstance allocates the frame
+ window (0x140425fb0), sets its vtable 0x1405aed50 (0x140425fd4) and creates it
+ through slot 91 (+0x2d8, 0x14042614d-0x140426186). WM_CREATE reaches OnCreate
+ 0x140470ef0 through the frame message map 0x1405acf78 (GetMessageMap slot 12,
+ 0x140470eb0, entry 0x1405acf90). OnCreate allocates the 0x208c0-byte VM
+ (0x140471135), stores it at 0x140822790 (0x14047120e) and calls VM::Init
+ 0x140565f60 at 0x140471218. VM::Init constructs the memory device at
+ 0x140566443 (constructor 0x1404fc3d0 sets vtable 0x1405c0830 at 0x1404fc3f9, and
+ the device constructor 0x1404c1270 appends it to the device list at VM+0x20040),
+ then walks that list calling vtable slot 1 (+0x8) at 0x14056762a. Slot 1 of the
+ memory vtable (0x1405c0838) is Memory::Init 0x1404fc5d0, which calls LoadROM(1)
+ at 0x1404fc669 and returns 0 on failure (0x1404fc97f). A zero clears the result
+ at 0x140567631, VM::Init returns it at 0x140567640, and OnCreate sets error state
+ 1 at 0x140471221 and posts message 0x8000 at 0x14047123b. Message map entry
+ 0x1405ad110 routes 0x8000 to 0x1404737a0, which for state 1 (0x1404737d6) loads
+ string 47002 or 42002, "XM6 requires two ROM files, IPLROM.DAT file and
+ CGROM.DAT(or CGROM.TMP) file", shows it with MB_ICONSTOP (0x14047383e) and posts
+ WM_CLOSE (0x140473853).
+
+ Memory::Reset (0x1404fd610)
+ loads any other type on demand: type 7 falls back to 6 (0x1404fd682), and any
+ failure falls back to type 1 (0x1404fd6bc), so a missing model ROM only loses
+ that machine.
+
+ SRAM::Reset picks its file from the machine index at VM+0x2002c (0x1405565f7).
+ The index is the [Basic] ModelType setting of xm6g.ini, 0 to 3 for the base
+ machine, XVI, Compact and X68030: INI table entry 0x140581240 binds that key to
+ configuration offset 0x2bfc (0x14082539c), read by the INI loader 0x1404270a0
+ (0x1404270fe), the field Memory::ApplyCfg reads at 0x1404fe3b8. The configuration apply at 0x140473630 copies it to VM+0x20028
+ (0x14047367f), and VM::Reset 0x140567660 copies VM+0x20028 to VM+0x2002c at
+ 0x14056768e. OnCreate runs the two at 0x14047148e and 0x14047149a. When
+ Memory::Reset falls back to the base machine, VM::Reset finds the loaded type at
+ Memory+0xcbc outside the model (0x1405676b2-0x1405676e8) and zeroes the index at
+ 0x1405676f3 before the devices reset, so SRAM.DAT is read. A saved state
+ restores the index (0x140567c11).
+
+ The options page (0x140428f80) offers XVI, Compact and X68030 only when
+ IPLROMXV.DAT, IPLROMCO.DAT and IPLROM30.DAT have GetFileSizeEx exactly 0x20000.
+ Three startup checks run from 0x1404738b5 through 0x140472860, each skippable by
+ its option. The IPL check (0x140472a99) reads the IOCS date bytes at 0x1000a,
+ 0x1000c and 0x1000d of the base IPL and warns unless they spell 87/05/07. The CG
+ check (0x14047296e) sums and XORs 0x1000 bytes at 0x3a800 of the font and warns
+ unless they give 0xec and 0x84. The SCSI check (0x140501290) reads 0x2000 bytes of
+ SCSIINROM.DAT (0x14050142d) and SCSIEXROM.DAT (0x140501599) and warns when
+ 0x1ff8 holds "XM6 ", the stamp of the XM6 Utility replacements (0x14050147c,
+ 0x1405015da). Each warning dialog (0x140487730) continues on OK and closes XM6 on
+ Cancel. No genuine ROM is hashed anywhere in the executable.
XM6 Utility, published separately at the same address, synthesises CGROM.TMP
from the installed Windows fonts and SCSIINROM.DAT or SCSIEXROM.DAT from the
Human68k version 3.02 disk image HUMAN302.XDF, which it requires at 0x134000
- bytes (XM6Util scsirom.cpp:86-90). It stamps the SCSI ROMs with "XM6 " at
- offset 0x1ff8 and a version at 0x1ffc (XM6Util scsirom.cpp:243-245), and
- xm6g.exe reads both files back and tests that signature
- (xm6g.exe:0x14050147c, 0x1405015e0) to raise the startup warning that names
- these files as substitutes and discourages them. Nothing rejects the file, and
- no genuine ROM is hashed anywhere in the executable.
+ bytes (XM6Util scsirom.cpp:86-90), and stamps "XM6 " at offset 0x1ff8 and a
+ version at 0x1ffc (XM6Util scsirom.cpp:243-245).
- SCSI ROM requirements follow the machine (xm6g.pdf p.17). SCSIINROM.DAT is
- needed by SUPER, XVI and Compact and by any machine set to the internal SCSI
- interface. SCSIEXROM.DAT drives the CZ-6BS1 external board, which is the only
- SCSI variant the SASI models can take. X68030 needs neither, its SCSI ROM
- being part of IPLROM30.DAT or IPLROM30S.DAT. IPLROM30S.DAT and ROM30S.DAT are
- a pair used only when Expansion ROM is enabled on the X68030 options tab, for
- ROMs patched for 060turbo (xm6g.pdf p.17).
+ The Mercury Unit OPN (YMF288) samples its rhythm section from files. The fmgen
+ and X68Sound engines read six WAV files named from a table at 0x1405c0090
+ (0x1404ed610), and the ymfm engine reads ym2608_adpcm_rom.bin instead
+ (0x140574eb0).
- The Mercury Unit carries an OPN (YMF288) whose rhythm section is sampled from
- external files. The fmgen and X68Sound engines read six WAV files named from a
- table at xm6g.exe:0x1405c0090 (0x1404ed610, CreateFileW at 0x1404ed8bf), and the
- ymfm engine reads ym2608_adpcm_rom.bin instead (0x140574fec, ReadFile at
- 0x140575095), which is why the rhythm level control is documented as inert for
- ymfm.
-
- xm6g.ini and the state file STATE.XM6, the twentieth table entry, are written
- by the program and are not listed below. RTC.DAT and the SRAM files are listed
+ xm6g.ini and the state file STATE.XM6, the twentieth table entry, are written by
+ the program and are not listed below. RTC.DAT and the SRAM files are listed
because they are battery-backed images with hardware counterparts that preload
- settings when supplied, even though XM6 TypeG creates them on exit when they
- are absent (xm6g.pdf p.18).
+ settings when supplied. XM6 TypeG writes them back on exit (SRAM 0x140556498,
+ RTC 0x1405321a9), so it creates them when they are absent.
files:
# -- IPL ROMs, one per emulated model, read at 0x20000 bytes and byte-swapped --
@@ -98,13 +130,13 @@ files:
size: 131072
validation: [size]
description: "X68000 boot ROM version 1.0, base models"
- source_ref: "xm6g.pdf p.16, xm6g.exe:0x1404fc9a5 (read at 0x1404fcbb7), xm6g.exe:0x14042920a, XM6 2.06 vm/memory.cpp:249-270"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: 0x1404fca8d-0x1404fcb52 (table entry 0 joined to the module directory), 0x1404fcb90 (Fileio::Open), 0x1404fcbb7-0x1404fcbc4 (ReadFile 0x20000, short count exits through 0x1404fd159), 0x1404fcc00 (16-bit swap), Memory::Init 0x1404fc5d0 (memory vtable 0x1405c0830 slot 1) 0x1404fc669 (LoadROM(1), failure returns 0 at 0x1404fc97f), VM::Init 0x140565f60 0x14056762a (device Init through vtable slot 1), 0x140567631 (failure kept), OnCreate 0x140470ef0 0x140471218 (VM::Init call), 0x140471221 (error state 1), 0x14047123b (posts 0x8000), handler 0x1404737a0 0x1404737d6, 0x14047383e (MB_ICONSTOP message 47002 or 42002), 0x140473853 (WM_CLOSE), options page 0x140428f80 0x14042920a (GetFileSizeEx == 0x20000)"
note: >-
- Covers the first model, ACE, EXPERT, PRO and SUPER. LoadROM reads 0x20000
- bytes and fails when fewer are returned, and the failure aborts
- initialisation. The startup warning naming version 1.00 (05/07/1987) as
- recommended only advises: it does not reject the file. The recommended
- source is the free X68BIOSE.LZH package (xm6g.pdf p.6).
+ Memory types 1 to 3, the first model, ACE, EXPERT, PRO and SUPER. Memory::Init
+ loads it first and the program closes when it fails. The IPL check at
+ 0x140472a99 warns when the IOCS date is not 87/05/07 and does not reject the
+ file. The options page requires exactly 131072 bytes, while the loader only
+ needs at least that many.
- name: IPLROMXV.DAT
system: sharp-x68000
@@ -112,10 +144,11 @@ files:
size: 131072
validation: [size]
description: "X68000 XVI boot ROM version 1.1"
- source_ref: "xm6g.pdf p.16, xm6g.exe:0x14042927c, XM6 2.06 vm/memory.cpp:256-258"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: jump table 0x1404fd4f4 case 4, 0x1404fcb5a (index 1), 0x1404fcb77 (Filepath::SysFile 0x1404e76d0), 0x1404fcbb7 (ReadFile 0x20000), options page 0x140428f80 0x140429279 (table entry 1), 0x1404293de (GetFileSizeEx == 0x20000)"
note: >-
- Selects the XVI machine, which also needs SCSIINROM.DAT. The options page
- offers the machine only when this file is exactly 131072 bytes.
+ Memory type 4. The options page offers the XVI machine only when this file
+ is exactly 131072 bytes, and Memory::Reset falls back to the base machine
+ when it fails to load.
- name: IPLROMCO.DAT
system: sharp-x68000
@@ -123,10 +156,9 @@ files:
size: 131072
validation: [size]
description: "X68000 Compact boot ROM version 1.2"
- source_ref: "xm6g.pdf p.16, xm6g.exe:0x14042946b, XM6 2.06 vm/memory.cpp:259-261"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: jump table 0x1404fd4f4 case 5, 0x1404fcb5f (index 2), 0x1404fcb77 (Filepath::SysFile 0x1404e76d0), 0x1404fcbb7 (ReadFile 0x20000), options page 0x140428f80 0x140429468 (table entry 2), 0x1404295cd (GetFileSizeEx == 0x20000)"
note: >-
- Selects the Compact machine, which also needs SCSIINROM.DAT. Same exact
- size test as the other IPL ROMs.
+ Memory type 5, offered and loaded under the same rules as IPLROMXV.DAT.
- name: IPLROM30.DAT
system: sharp-x68000
@@ -134,11 +166,11 @@ files:
size: 131072
validation: [size]
description: "X68030 boot ROM version 1.3, $FE0000-$FFFFFF half"
- source_ref: "xm6g.pdf p.16, xm6g.exe:0x14042965a, XM6 2.06 vm/memory.cpp:262-264"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: jump table 0x1404fd4f4 case 6, 0x1404fcb66 (index 3), 0x1404fcb77 (Filepath::SysFile 0x1404e76d0), 0x1404fcbb7 (ReadFile 0x20000), options page 0x140428f80 0x140429657 (table entry 3), 0x1404297bc (GetFileSizeEx == 0x20000)"
note: >-
- Upper half of the X68030 and X68030 Compact boot ROM, paired with
- ROM30.DAT. It carries the SCSI ROM for those machines, so neither
- SCSIINROM.DAT nor SCSIEXROM.DAT applies to them.
+ Memory type 6, the X68030, paired with ROM30.DAT. Its SCSI ROM is
+ ROM30.DAT, so SCSIINROM.DAT and SCSIEXROM.DAT are not read for this
+ machine.
- name: ROM30.DAT
system: sharp-x68000
@@ -146,11 +178,11 @@ files:
min_size: 131072
validation: [size]
description: "X68030 boot ROM version 1.3, $FC0000-$FDFFFF half"
- source_ref: "xm6g.pdf p.16, xm6g.exe:0x1404fd1f8, XM6 2.06 vm/memory.cpp:311-313, 328-335"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: jump table 0x1404fd510 case 6, 0x1404fd1f5 (table entry 12), 0x1404fd304 (Fileio::Open), 0x1404fd327-0x1404fd334 (ReadFile 0x20000), 0x1404fd354-0x1404fd35b (types 6 and 7 fail on a short read)"
note: >-
- Lower half of the X68030 boot ROM, loaded through the SCSI ROM slot and
- the only one of those read at 0x20000 bytes rather than 0x2000. Without it
- the X68030 machine does not load.
+ Loaded into the SCSI ROM slot and the only file of that slot that must
+ deliver the full 0x20000 bytes. Without it LoadROM(6) fails and
+ Memory::Reset falls back to the base machine.
The copy here is the X68000 Firmware set's ROM30.DAT (SCSIIN, ROM Human 2.x, ROM FLOAT and the SCSI-IOCS binary), read out of an X68030 by the XM6 2.06 utility, which stamps its name at the tail of the image.
- name: IPLROM30S.DAT
@@ -159,11 +191,11 @@ files:
min_size: 131072
validation: [size]
description: "Expansion boot ROM, $FE0000-$FEFFFF"
- source_ref: "xm6g.pdf p.16-17, xm6g.exe:0x140592350 index 4"
+ source_ref: "xm6g.exe 3.38 Memory::ApplyCfg 0x1404fe390 0x1404fe3d1-0x1404fe3ff (X68030 with the expansion ROM flag gives type 7), LoadROM 0x1404fc990: jump table 0x1404fd4f4 case 7, 0x1404fcb6d (index 4), 0x1404fcb77 (Filepath::SysFile 0x1404e76d0, table entry 4 at 0x140592370), 0x1404fcbb7 (ReadFile 0x20000), Memory::Reset 0x1404fd610 0x1404fd672-0x1404fd694 (type 7 failure retries type 6)"
note: >-
- Read in place of IPLROM30.DAT when Expansion ROM is checked on the X68030
- options tab, the setting stored as EXTROM. Paired with ROM30S.DAT and
- intended for ROMs patched for 060turbo.
+ Read in place of IPLROM30.DAT when the X68030 expansion ROM option is on,
+ the setting stored as EXTROM. Paired with ROM30S.DAT. When either fails,
+ Memory::Reset loads the plain X68030 instead.
The copy here is XEIJIPLROM30.DAT written by XEiJ 0.26.08.08 with -model=X68030 -iplrom16=on -memory=12 -cgrom=CGROM30.DAT: IPLROM 1.6 of 2025-08-03, the patched IPL its documentation names for the 060turbo, since no dump of the Mankai replacement ROM circulates.
- name: ROM30S.DAT
@@ -172,10 +204,10 @@ files:
min_size: 131072
validation: [size]
description: "Expansion boot ROM, lower half"
- source_ref: "xm6g.pdf p.16, xm6g.exe:0x1404fd201"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: jump table 0x1404fd510 case 7, 0x1404fd1fe (table entry 13), 0x1404fd304 (Fileio::Open), 0x1404fd327-0x1404fd334 (ReadFile 0x20000), 0x1404fd354-0x1404fd35b (short read fails type 7)"
note: >-
- The other half of the expansion pair, loaded through the same SCSI ROM
- slot as ROM30.DAT and read at the same size.
+ The other half of the expansion pair, loaded into the SCSI ROM slot and
+ read at the same size as ROM30.DAT.
The copy here is XEIJROM30.DAT from the same XEiJ run: SCSIINROM 16, ROM Human 2.60, ROM FLOAT 2.03 and ROM Debugger 3.60.
# -- CG ROMs, read at 0xc0000 bytes, model specific first then CGROM.DAT then CGROM.TMP --
@@ -186,11 +218,12 @@ files:
min_size: 786432
validation: [size]
description: "X68000 character generator ROM"
- source_ref: "xm6g.pdf p.17-18, xm6g.exe:0x1404fcf11 (read at 0x1404fd013), XM6 2.06 vm/memory.cpp:283-289"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: 0x1404fcf0e (table entry 5), 0x1404fcfed (Fileio::Open), 0x1404fd013-0x1404fd023 (ReadFile 0xc0000), 0x1404fd03e (falls back to CGROM.TMP), 0x1404fd1a0 (16-bit swap), Memory::Init 0x1404fc5d0 (memory vtable 0x1405c0830 slot 1) 0x1404fc669 (LoadROM(1), failure returns 0 at 0x1404fc97f), VM::Init 0x140565f60 0x14056762a (device Init through vtable slot 1), 0x140567631 (failure kept), OnCreate 0x140470ef0 0x140471218 (VM::Init call), 0x140471221 (error state 1), 0x14047123b (posts 0x8000), handler 0x1404737a0 0x1404737d6, 0x14047383e (MB_ICONSTOP message 47002 or 42002), 0x140473853 (WM_CLOSE), CG check 0x14047296e"
note: >-
Supplies the glyphs the X68000 renders, mapped at $F00000-$FBFFFF. Used by
the base models and as the fallback for every machine whose own CG ROM is
- absent. Initialisation fails when neither this file nor CGROM.TMP loads.
+ absent. LoadROM(1) fails when neither this file nor CGROM.TMP loads, and
+ the program closes. The startup CG check only warns.
- name: CGROMXV.DAT
system: sharp-x68000
@@ -200,10 +233,10 @@ files:
min_size: 786432
validation: [size]
description: "X68000 XVI character generator ROM"
- source_ref: "xm6g.pdf p.17-18, xm6g.exe:0x1404fcd99"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: 0x1404fcd90-0x1404fcd96 (type 4, table entry 6), 0x1404fce88 (Fileio::Open), 0x1404fceb8-0x1404fcec8 (ReadFile 0xc0000, a short read continues at CGROM.DAT 0x1404fcf0e)"
note: >-
Preferred when the XVI machine is selected. CGROM.DAT is used when it is
- missing.
+ missing or short.
- name: CGROMCO.DAT
system: sharp-x68000
@@ -213,7 +246,7 @@ files:
min_size: 786432
validation: [size]
description: "X68000 Compact character generator ROM"
- source_ref: "xm6g.pdf p.17-18, xm6g.exe:0x1404fcdac"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: 0x1404fcd9f-0x1404fcda9 (type 5, table entry 7), 0x1404fce88 (Fileio::Open), 0x1404fceb8-0x1404fcec8 (ReadFile 0xc0000, fallback to CGROM.DAT 0x1404fcf0e)"
note: >-
Preferred when the Compact machine is selected, with the same fallback to
CGROM.DAT.
@@ -224,9 +257,9 @@ files:
min_size: 786432
validation: [size]
description: "X68030 character generator ROM"
- source_ref: "xm6g.pdf p.17-18, xm6g.exe:0x1404fcc36 (read at 0x1404fcd42)"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: 0x1404fcc23-0x1404fcc33 (types 6 and 7, table entry 8), 0x1404fcd12 (Fileio::Open), 0x1404fcd42-0x1404fcd52 (ReadFile 0xc0000, fallback through 0x1404fcd90 to CGROM.DAT)"
note: >-
- Preferred when X68030 or X68030 Compact is selected, with the same
+ Preferred for the X68030 with or without the expansion ROM, with the same
fallback to CGROM.DAT.
- name: CGROM.TMP
@@ -236,12 +269,12 @@ files:
min_size: 786432
validation: [size]
description: "Synthesised font ROM, fallback when no CG ROM is present"
- source_ref: "xm6g.pdf p.18, p.6, xm6g.exe:0x1404fd041, XM6 2.06 vm/memory.cpp:286-289"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: 0x1404fd03e (table entry 9, reached only after CGROM.DAT fails), 0x1404fd11d (Fileio::Open, failure exits LoadROM), 0x1404fd147-0x1404fd157 (ReadFile 0xc0000, short read exits LoadROM)"
note: >-
Read at the same size, only after CGROM.DAT fails. XM6 Utility builds it
from the fonts installed on the machine that generated it, so no hash is
- declared. XM6 TypeG treats it as non-recommended and raises a suppressible
- startup warning whenever it is in use.
+ declared. A synthesised font fails the CG sum and XOR check at
+ 0x14047296e, which raises the startup warning.
# -- SCSI ROMs, tried at 0x20000 then 0x2000, external also at 0x1fe0 --
@@ -251,13 +284,14 @@ files:
min_size: 8192
validation: [size]
description: "Internal SCSI interface ROM, SUPER and later"
- source_ref: "xm6g.pdf p.17, xm6g.exe:0x1404fd1ef (reads at 0x1404fd327, 0x1404fd3dd), XM6 2.06 vm/memory.cpp:305-310, 328-345"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: jump table 0x1404fd510 cases 2, 4 and 5, 0x1404fd1ec (table entry 10), 0x1404fd327 (ReadFile 0x20000), 0x1404fd361-0x1404fd391 and 0x1404fd442-0x1404fd44f (type 2 reopens and must read 0x2000), 0x1404fd39a (types 4 and 5 continue without the file), SCSI check 0x140501290 0x14050131e, 0x14050142d, 0x14050147c"
note: >-
- Required by SUPER, XVI and Compact, and by any machine whose SCSI
- interface option is set to internal, that option defaulting to none. The
- loader tries 0x20000 bytes first and falls back to 0x2000. A copy carrying
- "XM6 " at offset 0x1ff8 was synthesised by XM6 Utility and raises the
- startup warning.
+ Read for the internal SCSI option on the base machine (memory type 2),
+ where a missing file or a read under 0x2000 bytes fails the load and
+ Memory::Reset falls back to the plain base machine. XVI and Compact read it
+ with one 0x20000-byte ReadFile whose count is not checked, so a shorter
+ file still fills the slot, and without the file those machines start with
+ the slot left at 0xff.
- name: SCSIEXROM.DAT
system: sharp-x68000
@@ -265,13 +299,12 @@ files:
min_size: 8160
validation: [size]
description: "External SCSI interface ROM, CZ-6BS1 board"
- source_ref: "xm6g.pdf p.17, xm6g.exe:0x1404fd20a (retry at 0x1404fd419), XM6 2.06 vm/memory.cpp:316-318, 341-352"
+ source_ref: "xm6g.exe 3.38 LoadROM 0x1404fc990: jump table 0x1404fd510 case 3, 0x1404fd207 (table entry 11), 0x1404fd327 (ReadFile 0x20000), 0x1404fd3a0-0x1404fd3ea (ReadFile 0x2000), 0x1404fd401-0x1404fd44f (retry 0x1fe0 bytes at buffer offset 0x20, a short read fails the load), SCSI check 0x140501290 0x14050148a, 0x140501599, 0x1405015da"
note: >-
- Drives the CZ-6BS1 board, the only SCSI variant the first model, ACE,
- EXPERT and PRO can take, and mutually exclusive with the internal
- interface everywhere else. After 0x20000 and 0x2000 the loader retries at
- 0x1fe0 bytes into buffer offset 0x20, the WinX68k high-speed layout, so
- 8160 is the real floor.
+ Read only for the external SCSI option on the base machine (memory type
+ 3). After 0x20000 and 0x2000 the loader retries at 0x1fe0 bytes into buffer
+ offset 0x20, the WinX68k layout, so 8160 is the real floor. Missing, the
+ load fails and Memory::Reset falls back to the plain base machine.
# -- Battery-backed images, read at startup, written on exit when changed --
@@ -281,12 +314,12 @@ files:
required: false
size: [16384, 65536]
description: "SRAM image for EXPERT and the other base models"
- source_ref: "xm6g.pdf p.18, xm6g.exe:0x140592350 index 14, XM6 2.06 vm/sram.cpp:70-81, 112"
+ source_ref: "xm6g.exe 3.38 SRAM::Init 0x140556320: 0x140556373-0x14055637c (Filepath::SysFile index 14), 0x140556397 (Fileio::Load 0x10000, result ignored), SRAM::Reset 0x140556510 (SRAM vtable 0x1405c2728 slot 3) 0x1405565f7 (machine index VM+0x2002c, ModelType copied at 0x14056768e), 0x14055662a (index 0), 0x140556667 (ReadFile 0x10000, count not checked), SRAM cleanup 0x140556420 0x140556498 (writes the configured size in KB)"
note: >-
- Holds the boot device and memory switch settings for the first model, ACE,
- EXPERT, PRO and SUPER. A supplied image preloads those settings. The
- standard capacity is the 16 KB X68000 SRAM, and the SRAM64K modification the
- emulator reproduces raises it to 64 KB. No size is enforced.
+ Holds the boot device and memory switch settings for the base models. The
+ buffer is filled with 0xff first and up to 64 KB is read with no size
+ check. The program writes the configured SRAM size back, 16 KB as standard
+ and 64 KB with the 62C256 SRAM option.
- name: SRAMXVI.DAT
system: sharp-x68000
@@ -294,7 +327,7 @@ files:
unsourceable: "written by the emulator on exit, no canonical file"
size: [16384, 65536]
description: "SRAM image for XVI"
- source_ref: "xm6g.pdf p.18, xm6g.exe:0x140592350 index 15"
+ source_ref: "xm6g.exe 3.38 SRAM::Reset 0x140556510: 0x1405565f3-0x140556623 (machine index VM+0x2002c, ModelType 1, gives Filepath::SysFile index 15), 0x140556632 (Filepath::SysFile 0x1404e76d0), 0x140556643 (Fileio::Open), 0x140556667 (ReadFile 0x10000)"
note: >-
Per-model SRAM introduced by XM6 TypeG, which keeps one image per machine
instead of the single SRAM.DAT of XM6 v2.06.
@@ -305,7 +338,7 @@ files:
unsourceable: "written by the emulator on exit, no canonical file"
size: [16384, 65536]
description: "SRAM image for Compact"
- source_ref: "xm6g.pdf p.18, xm6g.exe:0x140592350 index 16"
+ source_ref: "xm6g.exe 3.38 SRAM::Reset 0x140556510: 0x1405565f7 (machine index VM+0x2002c), 0x14055661c (ModelType 2 gives Filepath::SysFile index 16), 0x140556632 (Filepath::SysFile 0x1404e76d0), 0x140556643 (Fileio::Open), 0x140556667 (ReadFile 0x10000)"
note: >-
Read when the Compact machine is selected.
@@ -314,69 +347,70 @@ files:
required: false
unsourceable: "written by the emulator on exit, no canonical file"
size: [16384, 65536]
- description: "SRAM image for X68030, 040turbo and 060turbo"
- source_ref: "xm6g.pdf p.18, xm6g.exe:0x140592350 index 17"
+ description: "SRAM image for X68030"
+ source_ref: "xm6g.exe 3.38 SRAM::Reset 0x140556510: 0x1405565f7 (machine index VM+0x2002c), 0x140556615 (ModelType 3 gives Filepath::SysFile index 17), 0x140556632 (Filepath::SysFile 0x1404e76d0), 0x140556643 (Fileio::Open), 0x140556667 (ReadFile 0x10000)"
note: >-
- Shared by X68030, X68030 Compact and the 040turbo and 060turbo
- configurations.
+ Read when the X68030 machine class is selected, with or without the
+ expansion ROM.
- name: RTC.DAT
system: sharp-x68000
required: false
unsourceable: "written by the emulator on exit, no canonical file"
+ size: 120
description: "RTC alarm settings for timer start"
- source_ref: "xm6g.pdf p.18, xm6g.exe:0x140592350 index 18"
+ source_ref: "xm6g.exe 3.38 RTC::Init 0x140531ee0: 0x14053210b-0x140532117 (Filepath::SysFile index 18), 0x140532132 (Fileio::Load 0x78 bytes, result ignored), RTC cleanup 0x140532170 0x1405321a9 (writes 0x78 bytes)"
note: >-
- Alarm registers of the battery-backed clock, used by the timer start
- feature and applying to every machine. XM6 TypeG creates it on exit when
- it is absent.
+ Alarm registers of the battery-backed clock, applying to every machine.
+ The program reads and writes 120 bytes and runs with defaults when the file
+ is absent.
# -- Mercury Unit rhythm samples, read by the OPN (YMF288) section --
- name: ym2608_adpcm_rom.bin
system: sharp-x68000
required: false
+ size: 8192
description: "YM2608 ADPCM-A rhythm ROM, ymfm engine"
- source_ref: "xm6g.exe:0x140574eb0 (name at 0x140574fec, read at 0x140575095)"
+ source_ref: "xm6g.exe 3.38 0x140574eb0: 0x140574fac-0x140574fbe (clears the 0x2000-byte buffer), 0x140574fdb-0x140574fec (wcscat_s of the name onto the directory argument), 0x14057506e (Fileio::Open, failure skips the read), 0x140575095 (ReadFile 0x2000, count not checked)"
note: >-
- Rhythm source for the Mercury Unit OPN when the FM engine is set to ymfm.
- The name is appended to a directory and the file is read whole. When it is
- absent the rhythm section stays silent and the emulator runs.
+ Rhythm source for the Mercury Unit OPN when the FM engine is ymfm. When it
+ is absent the buffer stays zeroed, the rhythm section is silent and the
+ emulator runs.
- name: 2608_BD.WAV
system: sharp-x68000
required: false
description: "Mercury Unit rhythm sample, bass drum"
- source_ref: "xm6g.exe:0x1404ed610, name table 0x1405c0090, CreateFileW at 0x1404ed8bf"
+ source_ref: "xm6g.exe 3.38 0x1404ed610: 0x1404ed677 (name table 0x1405c0090 entry 0), 0x1404ed6fa-0x1404ed76d (directory + 2608_ + name + .WAV), 0x1404ed7af (CreateFileW), 0x1404ed7cf-0x1404ed7d8 (ERROR_FILE_NOT_FOUND handled), 0x1404ed950 (ReadFile)"
note: >-
One of the six rhythm samples the fmgen and X68Sound engines read for the
- Mercury Unit OPN. The name is built as 2608_ plus the table entry plus
- .WAV. A missing file is handled through ERROR_FILE_NOT_FOUND and leaves
- that instrument silent.
+ Mercury Unit OPN. A missing file is handled through ERROR_FILE_NOT_FOUND
+ and leaves that instrument silent.
- name: 2608_SD.WAV
system: sharp-x68000
required: false
description: "Mercury Unit rhythm sample, snare drum"
- source_ref: "xm6g.exe:0x1404ed610, name table 0x1405c0090"
+ source_ref: "xm6g.exe 3.38 0x1404ed610: name table 0x1405c0090 entry 1, 0x1404ed6fa-0x1404ed76d (name built), 0x1404ed7af (CreateFileW)"
- name: 2608_TOP.WAV
system: sharp-x68000
required: false
description: "Mercury Unit rhythm sample, top cymbal"
- source_ref: "xm6g.exe:0x1404ed610, name table 0x1405c0090"
+ source_ref: "xm6g.exe 3.38 0x1404ed610: name table 0x1405c0090 entry 2, 0x1404ed6fa-0x1404ed76d (name built), 0x1404ed7af (CreateFileW)"
- name: 2608_HH.WAV
system: sharp-x68000
required: false
description: "Mercury Unit rhythm sample, hi-hat"
- source_ref: "xm6g.exe:0x1404ed610, name table 0x1405c0090"
+ source_ref: "xm6g.exe 3.38 0x1404ed610: name table 0x1405c0090 entry 3, 0x1404ed6fa-0x1404ed76d (name built), 0x1404ed7af (CreateFileW)"
- name: 2608_TOM.WAV
system: sharp-x68000
required: false
description: "Mercury Unit rhythm sample, tom-tom"
- source_ref: "xm6g.exe:0x1404ed610, name table 0x1405c0090"
+ source_ref: "xm6g.exe 3.38 0x1404ed610: name table 0x1405c0090 entry 4, 0x1404ed6fa-0x1404ed76d (name built), 0x1404ed7af (CreateFileW)"
- name: 2608_RIM.WAV
system: sharp-x68000
@@ -384,10 +418,10 @@ files:
- 2608_RYM.WAV
required: false
description: "Mercury Unit rhythm sample, rim shot"
- source_ref: "xm6g.exe:0x1404ed610, name table 0x1405c0090, 0x1404ed808-0x1404ed841"
+ source_ref: "xm6g.exe 3.38 0x1404ed610: name table 0x1405c0090 entry 5, 0x1404ed7af (CreateFileW of 2608_RIM.WAV), 0x1404ed808 (entry 5 not found), 0x1404ed841-0x1404ed8bf (CreateFileW of 2608_RYM.WAV)"
note: >-
Last of the six. This entry alone has a second accepted name,
- 2608_RYM.WAV, the spelling carried by widely circulated sample sets.
+ 2608_RYM.WAV, opened when 2608_RIM.WAV is not found.
# -- Libraries looked up by name at runtime, absent from the import directory --
@@ -395,39 +429,39 @@ files:
system: sharp-x68000
required: false
description: "FM synthesis engine by m_puusan"
- source_ref: "xm6g.pdf p.29, p.31, xm6g.exe:LoadLibraryW at 0x140488dfb"
+ source_ref: "xm6g.exe 3.38 0x140488a50: 0x140488df4-0x140488dfb (LoadLibraryW), 0x140488e0d-0x140488e65 (absent: stub entry points), 0x140488e6a-0x140488e74 (GetProcAddress X68Sound_Reset and the rest)"
note: >-
- One of the three FM engines the sound options offer, alongside the
- built-in fmgen and ymfm. Not shipped in the archive, and without it that
- engine cannot be selected.
+ One of the three FM engines, alongside the built-in fmgen and ymfm. Not
+ shipped in the archive. Without it the engine object is wired to internal
+ stubs and the emulator continues.
- name: c86ctl.dll
system: sharp-x68000
required: false
description: "Control library for external OPM hardware"
- source_ref: "xm6g.exe:0x1404b2da6, version query at 0x1404b2daa"
+ source_ref: "xm6g.exe 3.38 0x1404b2d60: 0x1404b2da3-0x1404b2daa (GetFileVersionInfoSizeW, absent exits at 0x1404b3057), 0x1404b2e62-0x1404b2e69 (LoadLibraryW), 0x1404b2e89 (GetProcAddress CreateInstance)"
note: >-
Loaded by name to drive a real YM2151 through a C86BOX class device
instead of software synthesis. The executable reads its file version
- before use.
+ before loading it.
- name: pcidebug.dll
system: sharp-x68000
required: false
description: "PCI bus bridge library, used to reach a ROMEO sound board"
- source_ref: "xm6g.exe:LoadLibraryW at 0x1404fa344, FreeLibrary at 0x1404fa2f5"
+ source_ref: "xm6g.exe 3.38 0x1404fa2e0: 0x1404fa2f5 (FreeLibrary of the previous handle), 0x1404fa31a-0x1404fa344 (LoadLibraryW), 0x1404fa354 (absent skips the setup)"
note: >-
- Loaded on demand and freed again. Absent, the feature that needs it is
- unavailable and the emulator continues.
+ Loaded on demand and freed again. Absent, the ROMEO output is unavailable
+ and the emulator continues.
- name: SOUND Canvas VA.dll
system: sharp-x68000
required: false
path: "%ProgramFiles%/Roland/Sound Canvas VA/SOUND Canvas VA.dll"
description: "Roland Sound Canvas VA plugin used as MIDI output"
- source_ref: "xm6g.exe:0x14048418a, INI key VstSCVA"
+ source_ref: "xm6g.exe 3.38 0x140484170: 0x140484181-0x14048418e (empty VstSCVA setting gives the default path), 0x14048421e (ExpandEnvironmentStringsW), 0x1404823d0 0x14048249e (PathFileExistsW), 0x14048258a and 0x140482891 (VST host 0x1404aea40), 0x1404afd30 0x1404afd6c (LoadLibraryW)"
note: >-
Hosted as the MIDI output device when the VSTi option is selected. The
- path is fixed to the Roland installation directory and the setting is
+ path defaults to the Roland installation directory and the setting is
stored as VstSCVA.
The plugin does not synthesise on its own: the Roland installer places SCCore.dll and eleven data files (GM, GM2 and SC-VSC .drk, .tnf and .drf sets, parameter1.dat to parameter3.dat) beside it, and the DLL loads them from its own directory.
diff --git a/emulators/zinc.yml b/emulators/zinc.yml
index 8c45a43af..5fb22bad9 100644
--- a/emulators/zinc.yml
+++ b/emulators/zinc.yml
@@ -35,21 +35,24 @@ notes: |
(*.znc, s11player.dll) ship beside it.
ref: ZiNc.exe 0x493f60
- Games are picked by number on the command line, not by set name. Each of the
- 79 driver records holds the description, parent, set name, a pointer to its
- ROM list and the name of the BIOS set, then the list gives name, region,
- load offset and CRC32 of every ROM, the BIOS ROM first. RetroBat maps the
- set name to that number in zincGameNumber.
- ref: ZiNc.exe 0x496404 (glpracr record),
+ Games are picked by number on the command line, not by set name. The
+ driver table at 0x49fc08 holds 71 records (count returned at 0x463250).
+ Each record holds the description, parent, set name, a pointer to its ROM
+ list and the name of the BIOS set, then the list gives name, region, load
+ offset and CRC32 of every ROM, the BIOS ROM first. Records for glpracr,
+ glpracr2, btchamp, mgcldate, sfchamp, PointBlank2, sws99 and mdhorse sit in
+ the image but no table entry points at them, so they cannot be run.
+ RetroBat maps the set name to the number in zincGameNumber.
+ ref: ZiNc.exe 0x463250, 0x463590-0x4635a2,
emulatorlauncher emulatorLauncher/Generators/Zinc.Generator.cs:136-209
ROMs are read from the directory given by -roms-directory (default roms),
which RetroBat writes into zinc.cfg as the folder of the launched game. A ROM
- is looked up in .zip, then in the parent's zip, then in the BIOS set's
- zip, each also as a plain directory. A missing ROM stops the load with
- "ERROR: missing rom file", and every ROM is checked against the CRC32 of its
- record ("ERROR: BAD CRC ... expected").
- ref: ZiNc.exe 0x494134, 0x49fdfc, 0x4a018c, 0x49fe24, 0x49fe48,
+ is looked up in the parent's zip, then in the BIOS set's zip, then in the
+ game's own zip. A missing ROM stops the load with "ERROR: missing rom file",
+ and every ROM is checked against the CRC32 of its record ("ERROR: BAD CRC
+ ... expected").
+ ref: ZiNc.exe 0x46366d-0x4636f0, 0x463724-0x463833, 0x463838-0x4638ac,
emulatorlauncher emulatorLauncher/Generators/Zinc.Generator.cs:109-114
The Namco System 11 records name no BIOS set: the first ROM of each list is
@@ -63,8 +66,8 @@ files:
category: bios_zip
system: capcom-zn1
description: "Capcom ZN-1 BIOS"
- note: "BIOS set of starglad, sfex, sfexa, sfexj, sfexp, sfexpu1, sfexpj, ts2, ts2j and glpracr."
- source_ref: "ZiNc.exe 0x49926c, ZiNc.exe 0x496404"
+ note: "BIOS set of starglad, sfex, sfexa, sfexj, sfexp, sfexpu1, sfexpj, ts2 and ts2j."
+ source_ref: "ZiNc.exe 1.1 0x463590-0x4638ac (game load: record from the driver table at 0x49fc08, BIOS set name at record+0x28 formatted %s/%s.zip at 0x4636ae-0x4636d7, each ROM looked up in the parent, BIOS and own set zip at 0x463724-0x463808, missing ROM fatal at 0x46381e-0x463833, CRC32 mismatch fatal at 0x463838-0x4638ac), record 0x49926c (starglad, first ROM coh-1000c.353)"
contents:
- name: "coh-1000c.353"
crc32: "50033af6"
@@ -75,7 +78,7 @@ files:
system: capcom-zn2
description: "Capcom ZN-2 BIOS"
note: "BIOS set of tgmj, stargld2, plsmaswd, sfex2, sfex2j, sfex2p, sfex2pa, sfex2pj, shiryu2, strider2, kikaioh, techromn, rvschool, rvschola and jgakuen."
- source_ref: "ZiNc.exe 0x499054"
+ source_ref: "ZiNc.exe 1.1 0x463590-0x4638ac (game load: record from the driver table at 0x49fc08, BIOS set name at record+0x28 formatted %s/%s.zip at 0x4636ae-0x4636d7, each ROM looked up in the parent, BIOS and own set zip at 0x463724-0x463808, missing ROM fatal at 0x46381e-0x463833, CRC32 mismatch fatal at 0x463838-0x4638ac), record 0x499054 (tgmj, first ROM coh-3002c.353)"
contents:
- name: "coh-3002c.353"
crc32: "e860ea8b"
@@ -85,8 +88,8 @@ files:
category: bios_zip
system: tecmo-tps
description: "Tecmo TPS BIOS"
- note: "BIOS set of glpracr2, glpracr3, shngmtkb, mfjump, cbaj, tondemo, doapp and brvblade."
- source_ref: "ZiNc.exe 0x496dec"
+ note: "BIOS set of glpracr3, shngmtkb, mfjump, cbaj, tondemo, doapp and brvblade."
+ source_ref: "ZiNc.exe 1.1 0x463590-0x4638ac (game load: record from the driver table at 0x49fc08, BIOS set name at record+0x28 formatted %s/%s.zip at 0x4636ae-0x4636d7, each ROM looked up in the parent, BIOS and own set zip at 0x463724-0x463808, missing ROM fatal at 0x46381e-0x463833, CRC32 mismatch fatal at 0x463838-0x4638ac), record 0x496dec (cbaj, first ROM coh-1002m.353)"
contents:
- name: "coh-1002m.353"
crc32: "69ffbcb4"
@@ -96,8 +99,8 @@ files:
category: bios_zip
system: taito-fx1
description: "Taito FX-1 BIOS"
- note: "BIOS set of psyforce, psyforcj, psyfrcex, mgcldate, mgcldtex, sfchamp, gdarius, gdarius2, raystorm, raystorj and ftimpcta."
- source_ref: "ZiNc.exe 0x49cb98"
+ note: "BIOS set of psyforce, psyforcj, psyfrcex, mgcldtex, gdarius, gdarius2, raystorm, raystorj and ftimpcta."
+ source_ref: "ZiNc.exe 1.1 0x463590-0x4638ac (game load: record from the driver table at 0x49fc08, BIOS set name at record+0x28 formatted %s/%s.zip at 0x4636ae-0x4636d7, each ROM looked up in the parent, BIOS and own set zip at 0x463724-0x463808, missing ROM fatal at 0x46381e-0x463833, CRC32 mismatch fatal at 0x463838-0x4638ac), record 0x49cb98 (psyforce, first ROM coh-1000t.353)"
contents:
- name: "coh-1000t.353"
crc32: "e3f23b6e"
@@ -108,7 +111,7 @@ files:
system: eighting-zn1
description: "Raizing/Eighting PS Arcade 95 BIOS"
note: "BIOS set of beastrzr, beastrzb and bldyror2."
- source_ref: "ZiNc.exe 0x49c3ac"
+ source_ref: "ZiNc.exe 1.1 0x463590-0x4638ac (game load: record from the driver table at 0x49fc08, BIOS set name at record+0x28 formatted %s/%s.zip at 0x4636ae-0x4636d7, each ROM looked up in the parent, BIOS and own set zip at 0x463724-0x463808, missing ROM fatal at 0x46381e-0x463833, CRC32 mismatch fatal at 0x463838-0x4638ac), record 0x49c3ac (beastrzr, first ROM coh-1002e.353)"
contents:
- name: "coh-1002e.353"
crc32: "910f3a8b"
@@ -119,7 +122,7 @@ files:
system: atlus-zn1
description: "Atlus PSX BIOS"
note: "BIOS set of hvnsgate."
- source_ref: "ZiNc.exe 0x49ed34"
+ source_ref: "ZiNc.exe 1.1 0x463590-0x4638ac (game load: record from the driver table at 0x49fc08, BIOS set name at record+0x28 formatted %s/%s.zip at 0x4636ae-0x4636d7, each ROM looked up in the parent, BIOS and own set zip at 0x463724-0x463808, missing ROM fatal at 0x46381e-0x463833, CRC32 mismatch fatal at 0x463838-0x4638ac), record 0x49ed34 (hvnsgate, first ROM coh-1001l.353)"
contents:
- name: "coh-1001l.353"
crc32: "6721146b"
@@ -129,8 +132,8 @@ files:
category: bios_zip
system: konami-gv
description: "Konami GV BIOS"
- note: "BIOS set of weddingr, hyperath, btchamp, pbball96 and susume."
- source_ref: "ZiNc.exe 0x49f0e4"
+ note: "BIOS set of weddingr, hyperath, pbball96 and susume."
+ source_ref: "ZiNc.exe 1.1 0x463590-0x4638ac (game load: record from the driver table at 0x49fc08, BIOS set name at record+0x28 formatted %s/%s.zip at 0x4636ae-0x4636d7, each ROM looked up in the parent, BIOS and own set zip at 0x463724-0x463808, missing ROM fatal at 0x46381e-0x463833, CRC32 mismatch fatal at 0x463838-0x4638ac), record 0x49f0e4 (weddingr, first ROM 999a01.7e)"
contents:
- name: "999a01.7e"
crc32: "ad498d2d"
diff --git a/scripts/validate_schemas.py b/scripts/validate_schemas.py
index 97b40707a..1d1809500 100644
--- a/scripts/validate_schemas.py
+++ b/scripts/validate_schemas.py
@@ -161,34 +161,46 @@ _CODE_SUFFIXES = frozenset(
"go rs lua pas pp asm s sh bash zsh ps1 bat cmd vbs swift d zig nim qml qc rb pl php "
"scala ml hs dart vue ino z80 smali".split()
)
-_CODE_FILE = re.compile(r"[\w+.-]\.([A-Za-z0-9+]+)\b")
-_BINARY_EVIDENCE = re.compile(
- r"\b0x[0-9a-fA-F]+\b|\bFUN_[0-9a-fA-F]+\b|\.(?:so|dll|exe|dylib|dex|apk|jar|elf|nro|xex)\b",
+_CODE_FILE = re.compile(r"(?<=[\w+-])\.([A-Za-z0-9+]+)\b")
+# A compiled image: a part that names one has to say where in it the file
+# is read, an address, a decompiled function or an IL method.
+# A name under a directory is a file of the tree it sits in, and a further
+# extension (.dll.map) makes it another file.
+_BINARY_FILE = re.compile(
+ r"(? bool:
- """A source_ref part names a source file, or a binary with an address."""
+ """A source_ref cites a source file or a place in a compiled image.
+
+ A part naming a binary without an address, a decompiled function or an
+ IL method says only that the binary exists: "import directory",
+ "string table" and "readelf -d" are not the code that reads a file.
+ """
from sourceref import split_source_ref
- if _BINARY_EVIDENCE.search(ref):
- return True
+ cited = False
for part in split_source_ref(ref):
- for suffix in _CODE_FILE.findall(part.raw):
- if suffix.lower() in _CODE_SUFFIXES:
- return True
- return False
+ located = bool(_BINARY_EVIDENCE.search(part.raw)) or any(
+ suffix.lower() in _CODE_SUFFIXES for suffix in _CODE_FILE.findall(part.raw)
+ )
+ if _BINARY_FILE.search(part.raw) and not located:
+ return False
+ cited = cited or located
+ return cited
def _data_only_source_refs(path: Path, document: object) -> list[str]:
diff --git a/tests/test_data_only_refs.py b/tests/test_data_only_refs.py
index 345f7d091..63eb4bd50 100644
--- a/tests/test_data_only_refs.py
+++ b/tests/test_data_only_refs.py
@@ -53,17 +53,39 @@ class DataOnlySourceRefs(unittest.TestCase):
def test_a_binary_with_an_address_passes(self):
for ref in ("libemucore.so 0x1a2b3c", "Fusion.exe 0x00401000",
- "bigpemu FUN_006d8be0 (BootROM read)", "nethersx2 v2.2n classes.dex icons/star-%d.png"):
+ "bigpemu FUN_006d8be0 (BootROM read)",
+ "CSpect.exe 3.3.1.0 a.H::e() IL_00bd-IL_00c9",
+ "GameAssembly.dll DSP1..ctor (name and CRC32)",
+ "libpizzaboy-jni.so pizza.c:931-937 (path buffer)"):
with self.subTest(ref=ref):
self.assertEqual(self.errors(ref), [])
+ def test_a_binary_named_without_a_place_in_it_is_refused(self):
+ for ref in ("ArcadeFlashWeb v1.0.2 pepflashplayer.dll string table",
+ "Future Pinball.exe 1.9.1.20101231 import directory",
+ "Main.java:27302, libfpse.so readelf -d",
+ "nethersx2 v2.2n classes.dex icons/star-%d.png",
+ "Fusion.exe 0x00401000, PS3Eye.dll .rdata"):
+ with self.subTest(ref=ref):
+ self.assertEqual(len(self.errors(ref)), 1)
+
+ def test_a_binary_file_of_a_source_tree_is_a_path(self):
+ self.assertEqual(self.errors(
+ "src/loader/elfLoader/elfLoader.cpp:365, libs/win32/ll-deps/zlib1.dll"), [])
+ self.assertEqual(self.errors(
+ "src/emu/kernel/src/libmanager.cpp:549-566, src/patch/ecam/group/ecam.dll.map:190-193"), [])
+
def test_each_build_mode_is_judged(self):
self.assertEqual(len(self.errors({"standalone": "src/main.cpp:10", "libretro": "data/list.txt:3"})), 1)
def test_an_excepted_profile_is_not_judged(self):
- name = next(iter(validate_schemas.DATA_ONLY_REF_EXCEPTIONS))
- path = REPO_ROOT / "emulators" / f"{name}.yml"
- self.assertEqual(validate_schemas._data_only_source_refs(path, _profile("history.txt:38")), [])
+ path = REPO_ROOT / "emulators" / "synthetic.yml"
+ exceptions = validate_schemas.DATA_ONLY_REF_EXCEPTIONS
+ exceptions["synthetic"] = "binary found nowhere"
+ try:
+ self.assertEqual(validate_schemas._data_only_source_refs(path, _profile("history.txt:38")), [])
+ finally:
+ del exceptions["synthetic"]
def test_every_exception_names_a_profile_and_a_reason(self):
for name, reason in validate_schemas.DATA_ONLY_REF_EXCEPTIONS.items():