February 29, 2020, 07:15:57 am

News:

The Wiki is fixed!  Again!Go, log in, add stuff!


DREAMCAST BIOS FLASHING STORY

Started by mych, October 28, 2010, 08:28:01 pm

Previous topic - Next topic

mych

October 28, 2010, 08:28:01 pm Last Edit: October 29, 2010, 11:00:16 am by mych
     I have modified the  DC bios IC  , to  added a FLASH ic (MX29LV160 /SOP44) apon the bios ROM IC,two month ago.   Base on the Russian DC-web :    http://www.dc-swat.ru/blog/hardware/16.html#comment15      :-*
      It works well,use the DREAMSHELL 4.0, I could play SDISO games and flash the bios file easy,it  could test just after flash.   I have try all ver. bios (jap, usa,eur, dev_dc). DC  could all work well :D .
      So i start to hack the original bios file. when i translate jap text to chinese, the bios could work well in any DC EMU(nulldc,Chankast ,demul <need to path crc>). The Chinese text show beautiful. I am so exciting about that.
      Then i copy the Chinese_bios to a SD card loader (http://www.dc-swat.ru/blog/hardware/14.html )and Flash into  DC. DC freezed in the swirl logo :-[.
     So i recognized, the bios booting up must have a self-check. If it failed,be freeze. I found,the check could passed when i only make slight modify to bios, more ...be failed.
      As i dont know SH4 ASM, so  i couldnot modify Assembly instructions  to skip the self-check.
     ANYBODY,do you help me to skip it? or somebody you know,be expert in SH4 ASM ?
      IF skip it, we could do anything to original bios. and could  show in a real dc.  
      It is wellknow, Naomi have 32M Ram . It is larger then DC,so it could run faster.After bios translate,I have consider to modify bios ram map,make dc could recognize more RAM (replace the origin 16M ram IC to  be needed) .
      But I am be stuck by the self-check,now.  Please help me ~ :)
      Good Luck everday~
                                                                                                    DC Fans    mych  from China

l_oliveira

SEGA CHECKSUM....   ::)

(Mega Drive uses that too)

mych

October 29, 2010, 02:03:52 pm #2 Last Edit: October 29, 2010, 06:54:43 pm by mych
How the sega checksum work?
do you know how to jump the check order ?
I could modify "pvr" and "text"  as the picture below, till now.
link83 have hack a dev_bios ,and get rid of   the  HASH CHECKSUM, anybody could send it to me??
email:  my_shuijing@sina.com

mych

i found the dc bios some block  have been compressed. when i touch the TEXT AREA with  SH4 CODES,my dc  be freezen in swire. 
who have some software to Release  OR Extract the  compressed part ?
maybe you couldnt understand my meaning,To see my picture below:
when i modify the JAP words that nulldc debug show: unknown opcode 0x???? , my dc work well. (debug1,2)
but i touch the JAP words that nulldc debug show some sh4 code, my dc freezen on swire(debug3,4)
who have some ideal to decompress it? or some ideal to solve the  problem,please tell me ,thanks!

l_oliveira

I had a look on the binary for the Dreamcast ROM and there is no sign of the old SEGA checksum. Perhaps you might want to check if the emulator changes anything on the BIOS before booting. It still seems like a checksum mismatch. I think the emulator is fixing the checksum for the ROM.

mych

November 02, 2010, 11:55:12 am #5 Last Edit: November 02, 2010, 01:50:33 pm by mych
dear l_oliveira ,thanks for your effor.
I run nulldc ,and in the debug windows to watch SH4 CODE.  I found that some "message text"  show disasm code as: unknown opcode 0x??
but some in disasm code be  sh4 program code.   when i modify the "unknown opcode" parts,dc could run well . then i modify "program code" parts,dc  direct show the swire loge and freeze.
So i guess ,the part of bios have be compressed.  
do you have some software tool to watch bios Structure, or Release or Extract is more helpful for me.

BTW: I have send a email to  drkIIRaziel,the father of NULLDC. Wish he could take some advise for BIOS HACK.