{"id":1943,"date":"2016-05-08T23:50:16","date_gmt":"2016-05-08T23:50:16","guid":{"rendered":"http:\/\/blog.system11.org\/?p=1943"},"modified":"2021-06-02T13:54:09","modified_gmt":"2021-06-02T13:54:09","slug":"tourvision-busting-open-the-bios-data","status":"publish","type":"post","link":"https:\/\/blog.system11.org\/?p=1943","title":{"rendered":"TourVision – busting open the BIOS data"},"content":{"rendered":"

Update 19\/04\/2019 – in the button codes list I had buttons I and II mixed up<\/em>
\nUpdate 08\/05\/2019 – newer version of the bios tool uploaded & corrections<\/em><\/p>\n

This is a followup to my previous article on the TourVision system here:<\/p>\n

https:\/\/blog.system11.org\/?p=1785<\/a><\/p>\n

I was playing around with the system recently, and I noticed that Dragon Spirit wouldn’t run.\u00a0 It would boot, but just sat there on the title screen.\u00a0 Dragon Spirit is one of four V1 carts I recevied which had either a missing adapter or one with an incorrect sticker on so I’d paired it with a spare Daisenpu adapter.\u00a0 Honestly at the time I didn’t know about V1\/V4 carts and I thought the hand written stickers were just an operator convenience, but as I was looking at a couple of adapters I noticed the extra pins were actually a series of 8 jumpers, and the adapters were different.\u00a0 Dragon Spirit ran fine on a Final Blaster one.<\/p>\n

\"tv_cartadapter\"<\/a><\/p>\n

The MAME pinout for these carts is currently wrong, the 4×2 pins on the right side of the connector are actually pins 1 to 8, starting from the right hand underside – meaning those 8 small pads you can see are from right to left, pins 1 to 8.\u00a0 These are connected to a 74LS244 near each cart slot and are actually just being read as an IO port just like any other input.\u00a0 They form an 8 bit number which is the game ID, for example Override is:<\/p>\n

00110101 – 53<\/p>\n

It turns out this really matters.<\/p>\n

It’s worth taking a moment to discuss what the V4 TourVision system actually is – as mentioned in the previous article it’s a cart switching pay-for-time based system which uses an actual PC engine to run the games.\u00a0 Single cart ‘adapter’ systems for JAMMA cabinets with simple pay-for-time mechanics are fairly widespread but the later model TourVision is actually more advanced and almost akin to an automation platform.<\/p>\n

\"tv_assembled\"<\/a><\/p>\n

Due to the fact that it really IS just a PC Engine playing the games, the system is almost like an arcade operator with a room containing a PC engine – you give him money and tell him which game you want to play, and he stands there having plugged the game in and starting it for you, then stands there with a stopwatch, taking the controller from you and asking for more money.\u00a0 That’s exactly what it’s doing.<\/p>\n

And this brings us to why the game ID matters.\u00a0 If you have a cart system capable of playing 200+ different games which were produced by different companies for home consumers, they all have a different way of getting into the game, you can’t really start charging people for time spent in menus, and you don’t really want them playing around with option menus and music tests for half an hour.<\/p>\n

The solution is to start the game for them, but to do that you need to know how<\/em> to start the game.\u00a0 The TourVision knows how, the BIOS contains tables of data for various functions all of which are looked up using that game ID.<\/p>\n

The game ID also gives us an interesting insight into how many games may have existed for the platform.\u00a0 Currently there are 210 defined data blocks of a maximum 256 supported, this actually increased over time and contrary to my earlier belief on supported IDs, it seems like they were not simply added in order, support was enhanced for games and even lost at times..<\/p>\n

2.0 - No ID support, V1 carts only\r\n4.0 - 0 to 184 (186 slots)\r\n4.2 - 0 to 182 (184 slots)\r\n4.3 - 0 to 183 (184 slots)\r\n5.1 - 0 to 183 (184 slots)\r\n5.2 - 0 to 191 (256 slots)\r\n5.3 - 0 to 197 (256 slots)\r\n5.4 - 0 to 198 (256 slots)\r\n5.5 - 0 to 203 (256 slots)\r\n6.0 - 0 to 209 (256 slots)<\/pre>\n
There appear to be minor data corrections in some versions so it would be worth upgrading any V4 TourVision system to the 6.0 bios.\u00a0 Just burn it to a 27256 and you’re done.\u00a0 Given that some games share IDs (I’ve found at least 5 so far) it’s quite possible more than 256 games are supported by the system, that’s just 210 combinations of handling and option data.<\/p>\n
There are actually 8 tables of data stored in the BIOS, data is retrieved by multiplying the data block size for the table by the game ID, and adding it to the table offset.\u00a0 This offset varies in the BIOS revisions, the following information is correct for the 6.0 BIOS.<\/p>\n
 <\/p>\n
Table 1 – Players<\/strong><\/span><\/p>\n
The first table contains number of players supported.\u00a0 Where 2 players are supported the player 1 and 2 start buttons will be enabled.\u00a0 The only difference I can see in end results between the two player options is that the timer reduces twice as quickly in dual.\u00a0 I suppose the rationale was that twice as much player time was being consumed, but it seems a bit unreasonable.<\/p>\n
Offset: 0x1184\r\nBlock size: 1 byte\r\nValues:\r\n00 - single player\r\n55 - two player, alternating\r\nff - two player, simultaneous<\/pre>\n
 <\/p>\n
Table 2 – Start button reset<\/strong><\/span><\/p>\n
I’m not sure why this option exists and is set for so many games (potentially difficulty handling them), but this table controls whether or not the game will simply reset to the title screen when start is pressed.\u00a0 It’s worth mentioning here and we’ll come to it again, that the start\/run button is actually special cased.\u00a0 Strangely this option has been set incorrectly in some games, like Formation Soccer which should use the Run button to change the active footballer.<\/p>\n
Offset: 0x1284\r\nBlock size: 1 byte\r\nValues:\r\n00 - reset when start is pressed\r\nff - no reset when start is pressed<\/pre>\n
 <\/p>\n
Table 3 – Select (button 3) lockout<\/strong><\/span><\/p>\n
This table can optionally block the use of the Select button by ignoring JAMMA button 3 (although the TourVision can still send it through itself).\u00a0 This is probably again for handling interesting cases where select had undesirable functions.<\/p>\n
Offset: 0x1384\r\nBlock size: 1 byte\r\nValues:\r\n00 - block use of JAMMA button 3 for Select\r\nff - allow use of JAMMA button 3 for Select<\/pre>\n
 <\/p>\n
Table 4 – Timer expiry function<\/strong><\/span><\/p>\n
This table defines what the TourVision will do to prevent gameplay after the timer grace period has expired.\u00a0 I found several instances of games which could have had better options here.<\/p>\n
Offset: 0x1484\r\nBlock size: 1 byte\r\nValues:\r\n00 - use Select button to pause while locking inputs\r\n55 - just lock inputs\r\nff - use Run button to pause while locking inputs<\/pre>\n
 <\/p>\n
Table 5 – One player startup inputs<\/strong><\/span><\/p>\n
This is one of the most interesting tables, and it defines a simple series of codes needed to start the game – it is referenced whenever a game is started in single player mode.\u00a0 Some things to note here are that player input is completely locked out and the timer will remain paused and flashing until the input string has finished.\u00a0 This sequence only runs after game resets – these happen when you’ve selected a game to play, or when the start button has been configured to reset the game.\u00a0 Other than that if you die and go back to the title screen you’ll be free to start manually or enter menus.<\/p>\n
The automated input system appears to run on a 1\/10th of a second timer interval – the button will appear to be held for that long, tested by tricking the system into moving a player ship around in Aero Blasters.\u00a0 Delay codes are often used to avoid charging players for intro sequences – for example Daisenpu has several delay elements before turning over control to the player – but because these are not an exact science and measured in 1\/10ths of a second, player control of the ship happens slightly later than it would on a normal PC Engine.<\/p>\n
Offset: 0x1584\r\nBlock size: 32 bytes\r\nValues:\r\n10 = P1 Run\r\n11 = P1 I\r\n12 = P1 II\r\n13 = P1 Select\r\n14 = P1 Up\r\n15 = P1 Right\r\n16 = P1 Down\r\n17 = P1 Left\r\n28 - P2 Run\r\n29 - P2 I\r\n2A - P2 II\r\n2B - P2 Select\r\n2C - P2 Up\r\n2D - P2 Right\r\n2E - P2 Down\r\n2F - P2 Left\r\n76 -> FE - '0xN - 0x76' delay in 10ths of a second\r\nFF = null (releases inputs)<\/pre>\n
 <\/p>\n
Table 6 – Two player startup inputs<\/strong><\/span><\/p>\n
This works exactly like table 5, except this is the sequence followed if a 2 player game is started.\u00a0 This is required for games where 2 player mode is selected from a menu, for example Legend Of Hero Tonma.\u00a0 The data block size has been increased since the strings are longer.<\/p>\n
Offset: 0x3584\r\nBlock size: 40 bytes\r\nValues:\r\n(all as per table 5)<\/pre>\n
 <\/p>\n
Table 7 – P1 start inputs<\/strong><\/span><\/p>\n
As mentioned in the description of table 2 (start\/reset), the start button is a special case which doesn’t directly map to the Run button.\u00a0 If the game is not configured to reset when start is pressed, instead it will do whatever is defined in this table.\u00a0 Again it’s an input string table supporting all the same features as tables 5 and 6, and this is what will actually happen when the player presses start and the inputs are unlocked.\u00a0 The TourVision will temporarily take over and run through this input string.\u00a0 In the vast majority of cases it’s just a ’10’ which makes start trigger the Run button, or an empty string for the reset games.<\/p>\n
Offset: 0x5d84\r\nBlock size: 8 bytes\r\nValues:\r\n(all as per table 5)<\/pre>\n
 <\/p>\n
Table 8 – P2 start inputs<\/strong><\/span><\/p>\n
Exactly the same as table 7, where games don’t reset this is what the player 2 start button press will do.\u00a0 Far fewer entries in this table due to the number of single player games.<\/p>\n
Offset: 0x6584\r\nBlock size: 8 bytes\r\nValues:\r\n(all as per table 5)<\/pre>\n
 <\/p>\n
Got all that? \ud83d\ude09<\/p>\n
Let’s look at a small example and make life a bit easier.\u00a0 This is how all the data appears in the BIOS file in my favourite hex\/binary\/text editor, “010 Editor”.\u00a0 It’s not very expensive and worth every penny, I’ve been using it for years and you can get it here:<\/p>\n
010 Editor from Sweetscape<\/a><\/p>\n
\"tourvis_inputhex\"<\/a><\/p>\n
At 0x16c4 (16C4h) you can see the input string definition for Ninja Ryukenden and Liquid Kids, since they share ID 10.\u00a0 10 x 32 = 320, or 0x140 and 0x1584 + 0x140 =\u00a0 0x16c4.<\/p>\n
I had to reverse engineer all the data tables by using a test\/observation approach, this involved a lot of tests and a lot of burning 27256s to verify changes did as expected.\u00a0 It also meant I spent a lot of time digging through the data to find out what game ‘x’ would do.\u00a0 I got fed up enough to write a small and very basic Perl script which you can use on any Linux machine with Perl and hexdump installed.\u00a0 Here’s the zip file with the script, the current latest CSV list of IDs and game names, and the 6.0 revision of the BIOS:<\/p>\n
tourvision_decoder<\/a><\/p>\n
Let’s pick a couple of interesting games to demonstrate – Legend Of Hero Tonma and Afterburner.\u00a0 Here’s LOHT (game ID 56):<\/p>\n
[foo@bar ~]$ .\/tvdata.pl 56\r\n56,Legend Of Hero Tonma\r\nPlayers:\r\n0x11bc 55\r\nStart button reset:\r\n0x12bc ff\r\nSelect (button 3) lockout:\r\n0x13bc ff\r\nTimer expiry function:\r\n0x14bc ff\r\nOne player startup inputs:\r\n0x1c84 b2 10 8a 10 8a 10 9e ff ff ff ff ff ff ff ff ff\r\n0x1c94 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\r\nTwo player startup inputs:\r\n0x3e44 b2 10 8a 16 11 14 10 8a 10 9e ff ff ff ff ff ff\r\n0x3e54 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\r\n0x3e64 ff ff ff ff ff ff ff ff\r\nP1 start inputs:\r\n0x5f44 10 ff ff ff ff ff ff ff\r\nP2 start inputs:\r\n0x6744 28 ff ff ff ff ff ff ff<\/pre>\n
Here we can see this is a 2 player alternating game, with standard Run button behaviour and Run used to pause when the time runs out.\u00a0 After the game reset it waits 6 seconds, presses Run, waits 2 seconds, Run, 2 seconds, Run and finally waits 4 seconds before letting the player take over.<\/p>\n
However if we start a 2 player game, it waits 6 seconds, presses Run, waits 2 seconds, P1 down, P1 button I, P1 up, Run, 2 seconds, Run, 4 seconds.\u00a0 These extra inputs 16 11 14 are moving the title screen menu down, selecting 2 player mode and then back up again.<\/p>\n
Another interesting example is Afterburner – this game actually has a pause feature on the select button, but select is disabled and the timer expiry mode is set to just lock the inputs out.<\/p>\n
46,After Burner\r\nPlayers:\r\n0x11b2 00\r\nStart button reset:\r\n0x12b2 ff\r\nSelect (button 3) lockout:\r\n0x13b2 00\r\nTimer expiry function:\r\n0x14b2 55\r\nOne player startup inputs:\r\n0x1b44 8a 10 8a 10 d0 ff ff ff ff ff ff ff ff ff ff ff\r\n0x1b54 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\r\nTwo player startup inputs:\r\n0x3cb4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\r\n0x3cc4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\r\n0x3cd4 ff ff ff ff ff ff ff ff\r\nP1 start inputs:\r\n0x5ef4 10 ff ff ff ff ff ff ff\r\nP2 start inputs:\r\n0x66f4 ff ff ff ff ff ff ff ff<\/pre>\n
For fun and to prove some theory I changed the P1 start input to 13, which took away my ability to use the afterburners and made the game pause instead.<\/p>\n
Finally let’s have an example in motion.\u00a0 Gunhed has a secret music test menu available from an input sequence on the title screen.\u00a0 This is the normal startup input string for Gunhed:<\/p>\n
9E 10 94 10 9E 11 FF FF FF FF FF FF FF FF FF FF\r\nFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF<\/pre>\n
Here’s what I changed them to:<\/p>\n
9E 17 15 17 15 17 15 17 15 17 15 17 15 17 15 17\r\n15 17 15 17 15 A8 15 15 15 12 FF FF FF FF FF FF<\/pre>\n
And here’s a TourVision system playing Gunhed music test for your enjoyment:<\/p>\n