Reverse Engineering Capcom’s Crypto CPU

There are a few old Capcom arcade titles – Pang, Cadillacs and Dinosaurs, and Block Block – that are unlike anything else ever seen in the world of coin-ops. They’re old, yes, but what makes these titles exceptional is the CPU they run on. The brains in the hardware of these games is a Kabuki, a Z80 CPU that had a few extra security features. why would Capcom produce such a thing? To combat bootleggers that would copy and reproduce arcade games without royalties going to the original publisher. It’s an interesting part of arcade history, but also a problem for curators: this security has killed a number of arcade machines, leading [Eduardo] to reverse engineering and document the Kabuki in full detail.

While the normal Z80 CPU had a pin specifically dedicated to refreshing DRAM, the Kabuki repurposed this pin for the security functions on the chip. With this pin low, the Kabuki was a standard Z80. When the pin was pulled high, it served as a power supply input for the security features. The security – just a few bits saved in memory – was battery backed, and once this battery was disconnected, the chip would fail, killing the game.

Plugging Kabuki into an old Amstrad CPC 6128 without the security pin pulled high allowed [Eduardo] to test all the Z80 instructions, and with that no surprises were found; the Kabuki is fully compatible with every other Z80 on the planet. Determining how Kabuki works with that special security pin pulled high is a more difficult task, but the Mame team has it nailed down.

The security system inside Kabuki works through a series of bitswaps, circular shifts, XORs, each translation different if the byte is an opcode or data. The process of encoding and decoding the security in Kabuki is well understood, but [Eduardo] had a few unanswered questions. What happens after Kabuki lost power and the memory contents – especially the bitswap, address, and XOR keys – vanished? How was the Kabuki programmed in the factory? Is it possible to reprogram these security keys, allowing one Kabuki to play games it wasn’t manufactured for?

[Eduardo] figured being able to encrypt new, valid code was the first step to running code encrypted with different keys. To test this theory, he wrote a simple ‘Hello World’ for the Capcom hardware that worked perfectly under Mame. While the demo worked perfectly under Mame, it didn’t work when burned onto a EPROM and put into real Capcom hardware.

That’s where this story ends, at least for the time being. The new, encrypted code is valid, Mame runs the encrypted code, but until [Eduardo] or someone else can figure out any additional configuration settings inside the Kabuki, this project is dead in the track. [Eduardo] will be back some time next week tearing the Kabuki apart again, trying to unravel the mysteries of what makes this processor work.

A Z80 Computer With Switches And Blinkenlights

While most people who build their own computer from chips want the finished product to do something useful, there’s something to be said about a huge bank of switches and a bunch of blinkenlights. They’re incredibly simple – most of the time, you don’t even need RAM – and have a great classic look about them.

[Jim] wanted to build one of these computers and wound up creating a minimal system with switches and blinkenlights. It’s based on the Z80 CPU, has only 256 bytes of RAM, and not much else. Apart from a few extra chips to output data and address lines to LEDs and a few more to read switches, there are only two major chips in this computer.

With the circuit complete, [Jim] laser cut a small enclosure big enough to house his stripboard PCB, the switches and LEDs, and a few buttons to write to an address, perform a soft reset, and cycle the clock. One of the most practical additions to this switch/blinkenlight setup is a hand crank. There’s no crystal inside this computer, and all clock cycles are done manually. Instead of pushing a button hundreds of times to calculate something. [Jim] added a small hand crank that cycles the clock once per revolution. Crazy, but strangely practical.

[Jim] made a demo video of his computer in action, demonstrating how it’s able to calculate the greatest common divisor of two numbers. You can check that video out below.

Continue reading “A Z80 Computer With Switches And Blinkenlights”

Super Smash Bros on a Calculator

Move over, BlockDude! There’s a new calculator game in town. [Hayleia] and a few other programmers have been hard at work on a clone of Super Smash Bros for graphing calculators that is sure to keep you busy in your next calculus class.

The game, called Smash Bros Open, is based on the Nintendo fighting game and is written specifically for monochrome z80 calculators (the TI-83 and TI-84 being the most ubiquitous of these). The game runs in 6 MHz mode with a simple background, or it can run in 15 MHz mode with a more complicated background. The programmers intend for the game to be open source, so that anyone can add anything to the games that they want, with the hopes of making the game true to its namesake.

Anyone who is looking to download a copy of this should know that Smash Bros Open is currently a work-in-progress. Right now both players need to play on the same calculator (with different keys), and Fox is the only playable character. The programmers hope to resolve the two player issue by using a second calculator as a game pad, or by linking the two calculators using Global CalcNet. As for the other characters, those can be added by others based on the existing code which is available on the project’s forum post!

Thanks to [Chris] for the tip.

Multi-target IDE for 8-Bit CPUs

A long time ago, [Martin] played with old 8-bit computers. Recently, he’s been honing his assembly skills again, and the idea of an IDE for a boatload of old systems came to him. After a year of work, he announced a multitarget IDE for 8-bit computers that works in your browser.

The project is called ASM80, and includes a code editor, a workspace to put all your code, compilers for the 8080/8085, Z80, 6502, 6800 and 6809 CPUs, emulators for all these CPUs, and emulators for a few Czech computers, the ZX Spectrum, and a few of [Grant Searle]’s single board computers.

What makes this project interesting is the syntax for all the different CPUs is pretty much the same. It’s a real, modular code editor that supports macros and everything you would expect for a code editor for ancient computers.

You can check out an assembler description here. [Martin] also has an offline, desktop-based version of ASM80 called IDE80, with a video demo of that below.

Continue reading “Multi-target IDE for 8-Bit CPUs”

A Z80 Micro TV Clock

As an adventure in computer history, [Len] built up a clock. The Z80 Micro TV Clock brings together a homebrew computer and three Micro TVs into a rather large timepiece.

The computer powering the clock runs the CP/M operating system. This OS was eventually released as open source software, and a variety of homebrew computer projects have implemented it. This clock is based on an existing breadboard CP/M machine, which includes schematics and software.

With an OS running, [Len] got a text editor and C compiler working. Now custom software could be written for the device. Software was written to interact with a Maxim DS12885 Real Time Clock, which keeps the time, and to output the time to the display controllers.

The Micro TVs in this build are Sony Watchman displays featuring a 2″ CRT. The devices had no video input port, so [Len] ripped them open and started poking around. The NTSC signal was found by probing the board and looking for the right waveform.

To drive the TVs from CP/M, a custom video driver was built. This uses three relatively modern ATmega328P microcontrollers and the arduino-tvout library. All of these components are brought together on a stand made from wood and copper tubing, making it a functional as a desk top clock

A Graphics Card for a Homebrew Computer

One of [aepharta]’s ‘before I die’ projects is a homebrew computer. Not just any computer, mind you, but a fabulous Z80 machine, complete with video out. HDMI and DisplayPort would require far too much of this tiny, 80s-era computer, and it’s getting hard to buy a composite monitor. This meant it was time to build a VGA video card from some parts salvaged from old equipment.

When it comes to ancient computers, VGA has fairly demanding requirements; the slowest standard pixel clock is 25.175 MHz, an order of magnitude faster than the CPU clock in early 80s computers. Memory is also an issue, with a 640×480, 4-color image requiring 153600 bytes, or about a quarter of the 640k ‘that should be enough for anybody.’

To cut down on the memory requirements and make everything a nice round in base-2 numbers, [aepharta] decided on a resolution of 512×384. This means about 100k of memory would be required when using 16 colors, and only about 24 kB for monochrome.

The circuit was built from some old programmable logic ICs pulled from a Cisco router. The circuit could have been built from discrete logic chips, but this was much, much simpler. Wiring everything up, [aepharta] got the timing right and was eventually able to put an image on a screen.

After a few minutes, though, the image started wobbling. [aepharta] put his finger on one of the GALs and noticed it was exceptionally hot. A heatsink stopped the wobbling for a few minutes, and a fan stopped it completely. Yes, it’s a 1980s-era graphics card that requires a fan. The card draws about 3W, or about two percent of a modern, high-end graphics card.

A Z80 Retro Microcomputer for the Papilio Pro FPGA Board

z80

[Will] wrote a 128MHz Z80-based retro microcomputer which runs on a Papilio Pro board. For those who don’t know, the latter is built around a Spartan-6 LX9 FPGA so you may imagine that much work was required to implement all the computer features in VHDL. The T80 CPU core was taken from opencores, the SDRAM controller was imported from Mike Field’s work but [Will] implemented several additional functions on his own:

- a 4KB paged Memory Management Unit to translate the 16-bit (64KB) logical address space into a 26-bit (64MB) physical address space.

- a 16KB direct mapped cache to hide the SDRAM latency, using the FPGA internal block RAM

- a UART interface for external communications

He also ported CP/M-2.2, MP/M-II and UZI (a UNIX system) to the computer. His project is completely open-source and all the source code can be downloaded at the end of [Will]’s write up.

Thanks [hamster] for the tip.