/
toaplan1.cpp
3243 lines (2769 loc) · 183 KB
/
toaplan1.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// license:BSD-3-Clause
// copyright-holders:Darren Olafson, Quench,Stephane Humbert
/***************************************************************************
ToaPlan game hardware from 1988-1991
------------------------------------
MAME Driver by: Darren Olafson
Technical info: Carl-Henrik Skarstedt & Magnus Danielsson
Driver updates: Quench
Video updates : SUZ
Supported games:
ROM set Toaplan
name board No Game name
--------------------------------------------------
rallybik TP-O12 Rally Bike/Dash Yarou
truxton TP-O13B Truxton/Tatsujin
hellfire B90 HellFire (2 Player version) Uses Taito rom ID number
hellfire1 B90 HellFire (1 Player version) Uses Taito rom ID number
hellfire2a B90 HellFire (2 Player older version) Uses Taito rom ID number
hellfire1a B90 HellFire (1 Player older version) Uses Taito rom ID number
zerowing TP-O15 Zero Wing (2 player simultaneous version)
zerowing1 TP-O15 Zero Wing (1 Player version)
zerowingw TP-O15 Zero Wing (2 player simultaneous version, Williams Electronics Games, Inc)
demonwld TP-O16 Demon's World/Horror Story [1990]
demonwl1 TP-O16 Demon's World/Horror Story [1989] (Taito license)
demonwl2 TP-O16 Demon's World/Horror Story [1989] (early edition)
demonwl3 TP-O16 Demon's World/Horror Story [1989] (first edition)
fireshrk TP-O17 Fire Shark (World) [1990]
fireshrka TP-O17 Fire Shark (World) [1989]
samesame TP-O17 Same! Same! Same! (Japan) [1989] (1 Player version)
samesam2 TP-O17 Same! Same! Same! (Japan) [1989] (2 Player version)
outzone TP-O18 Out Zone
outzoneh TP-018 Out Zone (harder version)
outzonea TP-018 Out Zone (old version)
outzoneb TP-018 Out Zone (older version)
outzonec TP-O18 Out Zone (oldest version, from board serial number 2122)
vimana TP-O19 Vimana (From board serial number 1547.04 [July '94])
vimanaj TP-O19 Vimana (Japan version)
vimanan TP-O19 Vimana (Nova Apparate GMBH & Co license)
Notes:
Fire Shark and Same! Same! Same! have a hidden function for the
service input. When invulnerability is enabled, pressing the
service input makes the screen scroll faster.
Demonwld (Toaplan copyright) is a newer version, and has a different game
level sequence compared to the Taito licensed version.
Stephh's and AWJ's notes (based on the games M68000 and Z80 code and some tests) :
1) 'rallybik'
- Region read from DSWB (port 0x50 in CPU1) then stored at 0x8004 (CPU1 shared RAM) =
0x180008.w (CPU0 shared RAM) then stored at 0x0804f4.w .
- Coinage relies on bits 4 and 5 of the region (code at 0x0bda in CPU1) :
* ..10.... : TOAPLAN_COINAGE_WORLD (tables at 0x0c35 (COIN1) and 0x0c3d (COIN2) in CPU1)
* else : TOAPLAN_COINAGE_JAPAN (table at 0x0c25 (COIN1 AND COIN2) in CPU1)
- Title screen relies on bits 4 and 5 of the region (code at 0x00220e) :
* ..00.... : "Dash Yarou"
* else : "Rally Bike"
- Notice screen relies on bits 4 and 5 of the region (code at 0x001ac0) :
* ..00.... : "FOR USE IN JAPAN ONLY"
* else : no notice screen
- Copyright relies on bits 4 and 5 of the region (code at 0x001e68) :
* ..00.... : "TAITO CORPORATION" / "ALL RIGHTS RESERVED"
* ..01.... : "TAITO AMERICA CORP." / "ALL RIGHTS RESERVED"
* ..10.... : "TAITO CORP. JAPAN" / "ALL RIGHTS RESERVED"
* ..11.... : "TAITO AMERICA CORP." / "LICENCED TO ROMSTAR"
- Number of letters for initials relies on bits 4 and 5 of the region
(code at 0x0008fe = init - code at 0x0022e8 = enter) :
* ..00.... : 6 letters
* else : 3 letters
- To enter the "test mode", press START1 when the grid is displayed.
- When "TEST" Switch is ON, you can do the following with the STARTn buttons :
* press START2 to pause game
* press START1 to unpause game
* when START1 and START2 are pressed, the game enters in "slow motion" mode
- When "TEST" Switch is ON, collision and fuel consuption routines are not called.
Don't forget to turn the "TEST" Switch OFF when time is over on bonus stage,
or the level will never end !
- When cabinet is set to "Upright", you can use joystick and buttons from both players
(code at 0x001c44).
2) 'truxton'
- Region read from Territory Jumper (port 0x70 in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x18000a.w (CPU0 shared RAM) then stored at 0x081b7c.w .
- Coinage relies on bits 0 and 1 of the region (code at 0x0ccc in CPU1) :
* ......00 : TOAPLAN_COINAGE_JAPAN (table at 0x0d21 (COIN1 AND COIN2) in CPU1)
* ......01 : TOAPLAN_COINAGE_JAPAN (table at 0x0d29 (COIN1 AND COIN2) in CPU1)
* ......10 : TOAPLAN_COINAGE_WORLD (tables at 0x0d31 (COIN1) and 0x0d39 (COIN2) in CPU1)
* ......11 : TOAPLAN_COINAGE_JAPAN (table at 0x0d21 (COIN1 AND COIN2) in CPU1)
- Title screen relies on bits 0 to 2 of the region (code at 0x002c58) :
* .....000 : "Tatsujin"
* else : "Truxton"
- Notice screen relies on bits 0 to 2 of the region (code at 0x004eb0) :
* ......1. : no notice screen
* .....000 : "FOR USE IN JAPAN ONLY"
* else : "FOR USE IN U.S.A. ONLY"
- Copyright relies on bits 0 to 2 of the region (code at 0x003050) :
* .....000 : "TAITO CORPORATION" / "ALL RIGHTS RESERVED"
* .....001 : "TAITO AMERICA CORP." / "LICENCED TO ROMSTAR FOR U.S.A."
* .....01. : "TAITO CORPORATION" / "ALL RIGHTS RESERVED"
* .....1.. : "TAITO AMERICA CORP."
- Number of letters for initials relies on bits 0 to 2 of the region
(code at 0x000976 = init - code at 0x0004a6 = enter) :
* .....000 : 6 letters
* else : 3 letters
- Jumper displayed in the Dip Switches screen relies on bits 0 and 1 of the region
(code at 0x004546) :
* ......00 : "FOR JAPAN"
* ......01 : "FOR U.S.A."
* ......1. : "FOR EUROPE"
Jumpers 3 and 4 status is updated but they are always listed as unused.
- To enter the "test mode", press START1 when the grid is displayed.
- To enter the sound test, press START2 when the grid is displayed.
- Set the "Service Mode" Dip Switch to ON while playing for invulnerability.
- Set the "Dip Switch Display" Dip Switch to ON while playing to pause the game.
- The "TEST" switch has the same effect as the "Service Mode" Dip Switch (DSWA bit 2).
- When cabinet is set to "Upright", you can use joystick and buttons from both players
(code at 0x002856).
3) 'hellfire' and "clones"
- The "TEST" switch has the same effect as the "Service Mode" Dip Switch (DSWA bit 2).
3a) 'hellfire'
- Region read from Territory Jumper (port 0x20 in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x0c000a.w (CPU0 shared RAM) then stored at 0x042414.w .
- Coinage relies on bits 0 and 1 of the region (code at 0x0bc9 in CPU1) :
* ......00 : TOAPLAN_COINAGE_JAPAN (table at 0x0c1e (COIN1 AND COIN2) in CPU1)
* ......01 : TOAPLAN_COINAGE_JAPAN (table at 0x0c26 (COIN1 AND COIN2) in CPU1)
* ......1. : TOAPLAN_COINAGE_WORLD (tables at 0x0c2e (COIN1) and 0x0c36 (COIN2) in CPU1)
- Notice screen relies on bit 0 of the region (code at 0x000600) :
* .......0 : "FOR USE IN JAPAN ONLY"
* .......1 : "FOR USE IN U.S.A. ONLY"
But this routine is only called if both bits 0 and 1 of the region are set to 0
(code at 0x0005bc), so there is a notice screen only when the region is set to "Japan".
- Copyright always displays "@ TOAPLAN CO. LTD. 1989" but the second line relies on
bits 0 and 1 of the region (code at 0x0075dc) :
* ......01 : "LICENSED TO TAITO AMERICA CORPORATION"
* ....else : "LICENSED TO TAITO CORPORATION"
- Number of letters for initials is hard-coded to 3 letters (display ". . .").
- Jumper displayed in the Dip Switches screen relies on bits 0 and 1 of the region
(code at 0x0009d8) :
* ......00 : "FOR JAPAN"
* ......01 : "FOR U.S.A."
* ......1. : "FOR EUROPE"
- When "Invulnerability" Dip Switch is ON, you can do the following with the STARTn buttons :
* press START2 to pause game
* press START1 to unpause game
* when START1 and START2 are pressed, the game enters in "slow motion" mode
- DSWA bit 0 ("Cabinet" in the 1P sets) and DSWB bit 7 ("Allow Continue" in the 1P sets)
are both unused (they are not even tested).
3b) 'hellfire1'
- Region read from Territory Jumper (port 0x20 in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x0c000a.w (CPU0 shared RAM) then stored at 0x04222e.w .
- Same sound CPU as in 'hellfire', so same coinage infos.
- Notice screen relies on bits 0 and 1 of the region (code at 0x0005b0) :
* ......1. : no notice screen
* ......00 : "FOR USE IN JAPAN ONLY"
* ......01 : "FOR USE IN U.S.A. ONLY"
- Copyright does NOT rely on the region, it is hard-coded in the M68000 ROMS.
- Number of letters for initials relies on bit 0 of the region (code at 0x002aec) :
* .......0 : 6 letters
* .......1 : 3 letters
- Jumper displayed in the Dip Switches screen relies on bits 0 and 1 of the region
(code at 0x0009c4), but some data has been altered not to display "FOR U.S.A."
So you get the following :
* ......0. : "FOR JAPAN"
* ......1. : "FOR EUROPE"
- When "Invulnerability" Dip Switch is ON, you can do the following with the STARTn buttons :
* press START2 to pause game
* press START1 to unpause game
* when START1 and START2 are pressed, the game enters in "slow motion" mode
- When cabinet is set to "Upright", you can use joystick and buttons from both players
(code at 0x0066ba).
3c) 'hellfire2a'
- Region read from Territory Jumper (port 0x20 in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x0c000a.w (CPU0 shared RAM) then stored at 0x042414.w .
- Same sound CPU as in 'hellfire', so same coinage infos.
- Notice screen relies on bits 0 and 1 of the region (code at 0x0005c0) :
* ......1. : no notice screen
* ......00 : "FOR USE IN JAPAN ONLY"
* ......01 : "FOR USE IN U.S.A. ONLY"
However, because of the 'bra' instruction at 0x00059c, there is never a notice screen !
- Copyright does NOT rely on the region, it is hard-coded in the M68000 ROMS.
- Number of letters for initials relies on bit 1 of the region in the init routine (code at 0x000fce) :
* ......0. : 6 letters
* ......1. : 3 letters
But there are no more tests on the region and only 3 letters can be entered (display ". . .") .
- Jumper displayed in the Dip Switches screen relies on bits 0 and 1 of the region
(code at 0x0009d0) :
* ......00 : "FOR JAPAN"
* ......01 : "FOR U.S.A."
* ......1. : "FOR EUROPE"
- There is no "Invulnerability" Dip Switch, but when bit 2 of RAM address 0x042685.b is set
you can't die, and when bit 0 of the same address is set you can pause and enter slow motion.
However, I can't find any condition that causes either of these bits to be set :(
- Like older games (from Flying Shark to Truxton) "service mode" shows only a grid with colors,
and there is a separate "Dip Switch Display" (DSWB bit 6).
- To enter the "test mode", press START1 when the grid is displayed.
- To enter the sound test, press START2 when the grid is displayed.
- DSWA bit 0 ("Cabinet" in the 1P sets) and DSWB bit 7 ("Allow Continue" in the 1P sets)
are both unused. However, in the Dip Switches screen they are both listed as used !
- The other sets have checksums near the end of the M68000 program ROMs starting at 0x03fff0,
but in 'hellfire2a' the "checksums" are 0xffffffff ! However, because of the 'ori #$4, SR'
instruction at 0x000782, the ROM checksum test always "passes".
- Based on the incorrect Dip Switch Display, the absent ROM checksums and patched-out ROM test,
I wonder if this is some kind of prototype or test version.
3d) 'hellfire1a'
- Region read from Territory Jumper (port 0x20 in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x0c000a.w (CPU0 shared RAM) then stored at 0x04222e.w .
- Coinage relies on bits 0 and 1 of the region (code at 0x0bb7 in CPU1) :
* ......00 : TOAPLAN_COINAGE_JAPAN (table at 0x0c0c (COIN1 AND COIN2) in CPU1)
* ......01 : TOAPLAN_COINAGE_JAPAN (table at 0x0c14 (COIN1 AND COIN2) in CPU1)
* ......10 : TOAPLAN_COINAGE_WORLD (tables at 0x0c1c (COIN1) and 0x0c24 (COIN2) in CPU1)
* ......11 : TOAPLAN_COINAGE_JAPAN (table at 0x0c0c (COIN1 AND COIN2) in CPU1)
- Notice screen relies on bits 0 and 1 of the region (code at 0x0005b0) :
* ......1. : no notice screen
* ......00 : "FOR USE IN JAPAN ONLY"
* ......01 : "FOR USE IN U.S.A. ONLY"
- Copyright does NOT rely on the region, it is hard-coded in the M68000 ROMS.
- Number of letters for initials relies on bits 0 and 1 of the region, but it is buggy :
in the init routine (code at 0x001386), bit 1 is tested (0 = 6 letters - 1 = 3 letters),
but in the enter routine (code at 0x002c98), bit 0 is tested ! So you get the following :
* ......00 : 6 letters with default high-scores initials filled with "......"
* ......01 : 3 letters with default high-scores initials filled with " ..."
* ......10 : 6 letters with default high-scores initials filled with "...000"
* ......11 : 3 letters with default high-scores initials filled with " ..."
- Jumper displayed in the Dip Switches screen relies on bits 0 and 1 of the region
(code at 0x0009ba) :
* ......00 : "FOR JAPAN"
* ......01 : "FOR U.S.A."
* ......1. : "FOR EUROPE"
- There is no "Invulnerability" Dip Switch, but when bit 2 of RAM address 0x0424b1.b is set
you can't die, and when bit 0 of the same address is set you can pause and enter slow motion.
However, I can't find any condition that causes either of these bits to be set :(
- Like older games (from Flying Shark to Truxton) "service mode" shows only a grid with colors,
and there is a separate "Dip Switch Display" (DSWB bit 6).
- To enter the "test mode", press START1 when the grid is displayed.
- To enter the sound test, press START2 when the grid is displayed.
- When cabinet is set to "Upright", you can use joystick and buttons from both players
(code at 0x0068ec).
- The other sets have 29 sounds you can play in the sound test, but 'hellfire1a' has only 28.
In the other sets "sound number 14" is a sound effect and "sound number 15" is the first BGM,
but 'hellfire1a' is missing that sound effect and instead "sound number 14" is the first BGM !
- The slightly different coinage and the "missing" sound effect account for the differences in
the Z80 code between 'hellfire1a' and the other sets.
4) 'zerowing' and "clones"
- When "Invulnerability" Dip Switch is ON, you can do the following with the STARTn buttons :
* press START2 to pause game
* press START1 to unpause game
* when START1 and START2 are pressed, the game enters in "slow motion" mode
- When "Invulnerability" Dip Switch is ON, you can't die (of course), but you also can't move
nor shoot while "captured" by an enemy or the background ! So you have to wait until enemy
gives up or background scrolls enough to "free" you.
- The "TEST" switch has the same effect as the "Service Mode" Dip Switch (DSWA bit 2).
4a) 'zerowing'
- Region read from Territory Jumper (port 0x70 in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x44000a.w (CPU0 shared RAM) then stored at 0x081810.w .
- Coinage relies on bits 0 and 1 of the region (code at 0x0c59 in CPU1) :
* ......00 : TOAPLAN_COINAGE_JAPAN (table at 0x0cae (COIN1 AND COIN2) in CPU1)
* ......01 : TOAPLAN_COINAGE_JAPAN (table at 0x0cb6 (COIN1 AND COIN2) in CPU1)
* ......1. : TOAPLAN_COINAGE_WORLD (tables at 0x0cbe (COIN1) and 0x0cc6 (COIN2) in CPU1)
- Notice screen relies on bit 0 of the region (code at 0x000564) :
* .......0 : "FOR USE IN JAPAN ONLY"
* .......1 : "FOR USE IN U.S.A. ONLY"
But this routine is only called if both bits 0 and 1 of the region are set to 0
(code at 0x000530), so there is a notice screen only when the region is set to "Japan".
- Copyright does NOT rely on the region, it is hard-coded in the M68000 ROMS.
- Number of letters for initials relies on bits 0 and 1 of the region, but it is buggy :
in the init routine (code at 0x000de0), bit 1 is tested (0 = 6 letters - 1 = 3 letters),
but in the enter routine (code at 0x001bf4), bit 0 is tested ! So you get the following :
* ......00 : 6 letters with default high-scores initials filled with "......"
* ......01 : 3 letters with default high-scores initials filled with " ..."
* ......10 : 6 letters with default high-scores initials filled with "...000"
* ......11 : 3 letters with default high-scores initials filled with " ..."
- Jumper displayed in the Dip Switches screen relies on bits 0 and 1 of the region
(code at 0x000922) :
* ......00 : "FOR JAPAN"
* ......01 : "FOR U.S.A."
* ......1. : "FOR EUROPE"
- When cabinet is set to "Upright", you can use joystick and buttons from both players
(code at 0x00541a).
4b) 'zerowing2'
- Region read from Territory Jumper (port 0x70 in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x44000a.w (CPU0 shared RAM) then stored at 0x081ae2.w .
- Same sound CPU as in 'zerowing', so same coinage infos.
- Notice screen relies on bits 0 and 1 of the region (code at 0x0005c2) :
* ......1. : no notice screen
* ......00 : "FOR USE IN JAPAN ONLY"
* ......01 : "FOR USE IN U.S.A. ONLY"
However, because of the 'bra' instruction at 0x00059e, there is never a notice screen !
- Copyright does NOT rely on the region, it is hard-coded in the M68000 ROMS.
It is different from the one in 'zerowing' though.
- Number of letters for initials relies on bit 1 of the region in the init routine (code at 0x000e64) :
* ......0. : 6 letters
* ......1. : 3 letters
But there are no more tests on the region and only 3 letters can be entered (display ". . .") .
- Jumper displayed in the Dip Switches screen relies on bits 0 and 1 of the region
(code at 0x0009b2), but some data has been altered not to display "FOR JAPAN"
So you get the following :
* ......0. : "FOR U.S.A."
* ......1. : "FOR EUROPE"
- DSWA bit 0 ("Cabinet" in the 1P set) and DSWB bit 7 ("Allow Continue" in the 1P set)
are both unused (they are not even tested).
- Here are some differences I noticed with 'zerowing' :
* you get the twin ships when starting a new life
* speed range is 0x14-0x2c instead of 0x10-0x30 (but still +0x08)
There might be some other differences, but as the M68000 code is heavily modified and as
many addresses in RAM are different, it isn't very easy to spot which ones :( Any help is welcome !
5) 'demonwld' and "clones"
TO DO !
6) 'fireshrk' and "clones"
TO DO !
7) 'outzone' and "clones"
- The "TEST" switch has the same effect as the "Invulnerability" Dip Switch (DSWB bit 6).
7a) 'outzone'
- Region read from Territory Jumper (port 0x1c in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x14000a.w (CPU0 shared RAM) then 0x2401ca.w is set based on bits 0 to 3 of the region
(code at 0x013b68):
* ....0000 : 0x2401ca.w = 0000 (display Japanese story demo, etc.)
* ....0001 : 0x2401ca.w = 0001 (display FBI logo)
* ....0010 : 0x2401ca.w = 0002
* ....0011 : 0x2401ca.w = 0003
* ....0100 : 0x2401ca.w = 0004
* ....0101 : 0x2401ca.w = 0005
* ....0110 : 0x2401ca.w = 0006
* ....0111 : 0x2401ca.w = 0007 (display FBI logo)
* ....1000 : 0x2401ca.w = 0008
* else : 0x2401ca.w = 0000 (display Japanese story demo, etc.)
This RAM address is also checked in many other places in the M68000 code.
- Coinage relies on bits 0 to 3 of the region (code at 0x0e77 in CPU1) :
* ....0001 : TOAPLAN_COINAGE_JAPAN (table at 0x0f04 (COIN1 AND COIN2) in CPU1)
* ....0010 : TOAPLAN_COINAGE_WORLD (tables at 0x0f0c (COIN1) and 0x0f14 (COIN2) in CPU1)
* else : TOAPLAN_COINAGE_JAPAN (table at 0x0efc (COIN1 AND COIN2) in CPU1)
- Notice screen relies on region stored at 0x2401ca.w (code at 0x013bbc) :
* 0000 : "JAPAN ONLY"
* 0001 : "U.S.A. ONLY"
* 0002 : "EUROPE ONLY"
* 0003 : "HONG KONG ONLY"
* 0004 : "KOREA ONLY"
* 0005 : "TAIWAN ONLY"
* 0006 : "TAIWAN ONLY"
* 0007 : "U.S.A. ONLY"
* 0008 : "HONG KONG & CHINA"
- Copyright relies on region stored at 0x2401ca.w (code at 0x0050b4 - table at 0x0050e8) :
* 0000 : "@ TOAPLAN CO.,LTD. 1990" / "ALL RIGHTS RESERVED" / "" / ""
* 0001 : "@1990 TOAPLAN CO.,LTD." / "ALL RIGHTS RESERVED" / "" / ""
* 0002 : "@1990 TOAPLAN CO.,LTD." / "ALL RIGHTS RESERVED" / "" / ""
* 0003 : "@1990 TOAPLAN CO.,LTD." / "ALL RIGHTS RESERVED" / "" / ""
* 0004 : "@1990 TOAPLAN CO.,LTD." / "ALL RIGHTS RESERVED" / "" / ""
* 0005 : "@1990 TOAPLAN CO.,LTD." / "ALL RIGHTS RESERVED" / "" / ""
* 0006 : "@1990 TOAPLAN CO.,LTD." / "LICENSED TO" / "SPACY CO.,LTD." / "FOR TAIWAN"
* 0007 : "@1990 TOAPLAN CO.,LTD." / "LICENSED TO" / "ROMSTAR, INC." / "FOR U.S.A."
* 0008 : "@1990 TOAPLAN CO.,LTD." / "LICENSED TO" / "HONEST TRADING CO." / "FOR HONG KONG & CHINA"
If 0x2401ca.w >= 0006, the Toaplan logo is moved up to make room for the additional lines of text.
7b) 'outzoneh'
- Same sound CPU as in 'outzone', so same coinage infos.
- Same notice screen and copyright infos as 'outzone'.
- This set is very similar to 'outzone'. I have found the following differences:
- Table at 0x000f70 contains data related to the "Difficulty" Dip Switches:
DSWB & 0x3 'outzoneh' 'outzone' and others
---------- ---------- --------------------
* ......00 04 02
* ......01 00 00
* ......10 08 04
* ......11 0C 08
So "Normal" difficulty in 'outzoneh' is equivalent to "Hard" in the other sets,
"Hard" is equivalent to "Very Hard" in the other sets, and "Very Hard" is even
more difficult!
- Code in these routines is different from 'outzone' and the other sets:
'outzoneh' 'outzone' When executed?
---------- --------- --------------
* 0x005570 0x005570 once per spawn of first enemy type in game (brown with red 'gun' and blue 'eyes')
* 0x005800 0x005810 once per spawn of another enemy type (near end of stage 1, not sure which one)
* 0x00c140 0x00c160 once per spawn of many enemy types
* 0x00c1e0 0x00c214 once per frame while fighting stage bosses
- In the first three routines, the code in 'outzoneh' is shorter than the code in 'outzone'
and the other sets. It looks like the other sets check some conditions (stage number,
play time, etc.) to decide whether to spawn a weaker or stronger version of the enemy,
while 'outzoneh' skips some of those checks and spawns the stronger version more often.
- For the fourth routine, all sets except 'outzoneh' have 'rts' as the first instruction,
so 'outzoneh' is the only set where this routine actually does anything.
However, other than somehow relating to bosses, I don't yet know what it does :(
- Because the player input data for the demonstrations isn't changed to compensate
for the higher difficulty, the player dies almost immediately in the second demo.
- Due to the shorter code in 'outzoneh', all code and data between 0x005578 and 0x0142a0
is shifted, so there may be other differences I have overlooked. In particular, the
special item the player picks up in the first demo is different, and I haven't found
exactly why. Special items seem to be affected by a pseudorandom number generator,
so the different item could merely be due to different execution timing between sets.
7c) 'outzonea'
- Same sound CPU as in 'outzone', so same coinage infos.
- This set is almost identical to 'outzone', with only two differences :
- The 'jmp' instruction at 0x0003e6 goes to an invalid instruction, causing a crash
if you set the "Service Mode" Dip Switch to ON while the game is running.
'outzonea' is the only set with this bug, the other four sets all correctly
go to service mode.
- Notice and copyright for region 0008 say "HONG KONG" instead of "HONG KONG & CHINA".
Because of the shorter text, data between 0x015dd1 and 0x016f73 is shifted.
7d) 'outzoneb'
- Different sound CPU program from 'outzone', but same coinage infos.
- Sound data in the sound CPU ROM is different. Because the data in 'outzoneb' is shorter,
all data and code after 0x1ac3 is shifted. It looks like the actual changes are in data
used by sounds 2, 8, and 19. However, I can't hear any obvious differences :(
- This set's sound CPU ROM lacks a checksum. However, because of the 'xor a' instruction
at 0x50e6, the ROM checksum test always "passes".
- Same notice screen and copyright infos as 'outzonea'.
- This set has many M68000 code and data differences from the other sets, too many
to list one by one as with 'outzoneh'. Many RAM addresses used are also different.
- Spelling error on the Sound Check screen: "BUTTAN" instead of "BUTTON".
- This set and 'outzonec' have a hidden use for the two "Unused" Dip Switches.
If DSWA bit 0 ("Unused") and DSWB bit 7 (also "Unused") are both set to ON and
P2 joystick is held DOWN during startup, the CRTC registers are programmed for a
smaller VTOTAL than usual, giving a higher frame rate but cutting off the edges
of the screen (the effect of this isn't correctly emulated yet)
- Likewise, if DSWA bit 0 is ON and DSWB bit 7 is OFF, the game never starts up
(it seems to infinitely repeat one of the RAM tests)
7e) 'outzonec'
- Region read from Territory Jumper (port 0x1c in CPU1) then stored at 0x8005 (CPU1 shared RAM) =
0x14000a.w (CPU0 shared RAM), then 0x2401ca.w is set based on bits 0 to 2 of the region
(code at 0x012742) :
* .....000 : 0x2401ca.w = 0000 (display Japanese story demo, etc.)
* .....001 : 0x2401ca.w = 0001 (display FBI logo)
* .....002 : 0x2401ca.w = 0002
* else : 0x2401ca.w = 0003
This RAM address is also checked in many other places in the M68000 code.
- Same coinage infos as 'outzone', but see below about the sound CPU.
- Notice screen relies directly on bits 0 to 2 of the region stored at 0x14000a.w,
NOT on 0x2401ca.w (code at 0x01277a):
* .....000 : "JAPAN ONLY"
* .....001 : "U.S.A. ONLY"
* .....010 : "EUROPE ONLY"
* .....011 : "HONG KONG ONLY"
* .....100 : "KOREA ONLY"
* .....101 : "TAIWAN ONLY"
* else : no notice screen
- Copyright does NOT rely on the region, it is hard-coded in the M68000 ROMS.
- This set has by far the most code and data differences from any of the other sets.
However, it is slightly more similar to 'outzoneb' than to the other three.
- Same "BUTTAN" spelling error on the Sound Check screen as 'outzoneb'.
- Same use for the "unused" Dip Switches as 'outzoneb'.
- Many of the sound commands the M68000 sends to the Z80 are shifted by 2
compared to the other sets, e.g.:
Sound effect 'outzonec' 'outzone' and others
------------ ---------- --------------------
* Japanese story text no sound 0x26
* player 8-way shot 0x26 0x28
* player 3-way shot 0x27 0x29
* title logo letters 0x2a 0x2c
For this reason this set plays many different (and strange/inappropriate)
sound effects from the other sets. This is probably not intentional, but rather
this set probably should have a different sound CPU ROM, like 'hellfire1a' does.
The M68000 code in this set is definitely older than 'outzoneb', but the Z80 code
is newer than 'outzoneb', which seems very unlikely to be correct.
Most likely the board it came from was either bootlegged or repaired by someone
who used the wrong Z80 ROM and didn't notice or care that the sounds were wrong.
Because of this I've tagged the Z80 ROM as a BAD_DUMP and tagged this set with
MACHINE_IMPERFECT_SOUND until the correct Z80 ROM is found and dumped.
8) 'vimana' and "clones"
8a) 'vimana'
- Region read from Territory Jumper (0x440011.b).
- Coinage relies on bits 0 to 3 of the region :
* ....0010 : TOAPLAN_COINAGE_WORLD
* else : TOAPLAN_COINAGE_JAPAN
This a guess based on the "test mode" (code at 0x01a804) because of the missing Z180 CPU.
- Notice screen relies on bits 0 to 3 of the region (code at 0x018bf2 - table at 0x019736) :
* ....0000 : "JAPAN ONLY"
* ....0001 : "U.S.A. ONLY"
* ....0010 : "EUROPE ONLY"
* ....0011 : "HONG KONG ONLY"
* ....0100 : "KOREA ONLY"
* ....0101 : "TAIWAN ONLY"
* ....0110 : "TAIWAN ONLY"
* ....0111 : "U.S.A. ONLY"
* ....1000 : "HONG KONG ONLY"
* ....1001 : ""
* ....1010 : ""
* ....1011 : ""
* ....1100 : ""
* ....1101 : ""
* ....1110 : ""
* ....1111 : "JAPAN ONLY"
- Copyright always displays "@ TOAPLAN CO. LTD. 1991" but the other lines rely on
bits 0 to 3 of the region (code at 0x016512 - tables at 0x01948e and 0x019496) :
* ....0000 : "DISTRIBUTED BY" / ""
* ....0001 : "ALL RIGHTS RESERVED" / ""
* ....0010 : "ALL RIGHTS RESERVED" / ""
* ....0011 : "ALL RIGHTS RESERVED" / ""
* ....0100 : "ALL RIGHTS RESERVED" / ""
* ....0101 : "ALL RIGHTS RESERVED" / ""
* ....0110 : "LICENCED TO SPACY CO., LTD" / "FOR TAIWAN"
* ....0111 : "LICENCED TO ROMSTAR, INC." / "FOR U.S.A."
* ....1000 : "LICENCED TO HONEST TRADING CO." / "FOR HONG KONG AND CHINA."
* ....1001 : "" / ""
* ....1010 : "" / ""
* ....1011 : "" / ""
* ....1100 : "" / ""
* ....1101 : "" / ""
* ....1110 : "" / ""
* ....1111 : "DISTRIBUTED BY" / ""
An additional Tecmo logo also relies on bits 0 to 3 of the region :
* ....0000 : display
* ....1111 : display
* else : no display
So the Tecmo logo is only displayed when the region is set to "Japan" (right to the
"DISTRIBUTED BY" text).
- FBI logo (after displaying the hi-scores) relies on bits 0 to 3 of the region
(code at 0x0163f4) :
* ....0001 : display
* ....0111 : display
* else : no display
So the FBI logo is only displayed when the region is set to "USA" or "USA (Romstar)".
- Number of letters for initials is hard-coded to 3 letters.
- Jumper displayed in the Dip Switches screen relies on bits 0 to 3 of the region
(code at 0x01a89c - tables at 0x019d1e) :
* ....0000 : "FOR JAPAN. "
* ....0001 : "FOR U.S.A. "
* ....0010 : "FOR EUROPE "
* ....0011 : "FOR HONG KONG"
* ....0100 : "FOR KOREA "
* ....0101 : "FOR TAIWAN "
* ....0110 : "FOR TAIWAN "
* ....0111 : "FOR U.S.A. "
* ....1000 : "FOR HONG KONG"
* ....1001 : " "
* ....1010 : " "
* ....1011 : " "
* ....1100 : " "
* ....1101 : " "
* ....1110 : " "
* ....1111 : "FOR JAPAN. "
- When "Invulnerability" Dip Switch is ON, you can do the following with the STARTn buttons :
* press START2 to pause game
* press START1 to unpause game
* when START1 and START2 are pressed, the game enters in "slow motion" mode
- When "Invulnerability" Dip Switch is ON, you can press F1 ("Fast Scrolling", in fact
the unused 3rd button of player 1) to advance quickly to your desired area.
- When "Invulnerability" Dip Switch is ON, you can press the unused 3rd button of player 2,
but as its effect is completely unknown (code at 0x0010aa), I've decided not to map it for now.
- It's hard to tell which regions can be used for this set and which one is the default one.
However, as the text at the "end" (after the "CONGRATULATIONS" message) is in English,
I've decided to disable the ones related to Japan (0x00 and 0x0f).
- Routine at 0x017c18 is sound related and is seems to share memory with the Z180.
Unfortunately I haven't been able to understand yet how to produce a sound :(
Routine at 0x017ca6 stops producing a sound by reseting values in shared memory with the Z180.
8b) 'vimanan'
- The only difference with 'vimana' is the different copyright when region is set to Europe :
* ....0010 : "NOVA APPARATE GMBH & CO" / ""
Because of this additional text, other texts, code and data are shifted after 0x019e9c.
8c) 'vimanaj'
- The only difference I've noticed with 'vimana' is the text at the "end" is in Japanese.
This is why I've disabled all regions which aren't related to Japan.
- Sound routines at 0x01792c and 0x0179ba.
***************************************************************************/
#include "emu.h"
#include "toaplan1.h"
#include "toaplipt.h"
#include "cpu/z80/z80.h"
#include "cpu/z180/hd647180x.h"
#include "machine/74259.h"
#include "speaker.h"
/***************************** 68000 Memory Map *****************************/
void toaplan1_rallybik_state::rallybik_main_map(address_map &map)
{
map(0x000000, 0x00ffff).rom();
map(0x040000, 0x07ffff).rom();
map(0x080000, 0x083fff).ram();
map(0x0c0000, 0x0c0fff).ram().share("spriteram");
map(0x100001, 0x100001).w(FUNC(toaplan1_rallybik_state::bcu_flipscreen_w));
map(0x100002, 0x100003).rw(FUNC(toaplan1_rallybik_state::tileram_offs_r), FUNC(toaplan1_rallybik_state::tileram_offs_w));
map(0x100004, 0x100007).rw(FUNC(toaplan1_rallybik_state::tileram_r), FUNC(toaplan1_rallybik_state::tileram_w));
map(0x100010, 0x10001f).rw(FUNC(toaplan1_rallybik_state::scroll_regs_r), FUNC(toaplan1_rallybik_state::scroll_regs_w));
map(0x140000, 0x140001).portr("VBLANK");
// map(0x140000, 0x140001).w(?? video frame related ??)
map(0x140003, 0x140003).w(FUNC(toaplan1_rallybik_state::intenable_w));
map(0x140008, 0x14000f).w(FUNC(toaplan1_rallybik_state::bcu_control_w));
map(0x144000, 0x1447ff).ram().w(FUNC(toaplan1_rallybik_state::bgpalette_w)).share("bgpalette");
map(0x146000, 0x1467ff).ram().w(FUNC(toaplan1_rallybik_state::fgpalette_w)).share("fgpalette");
map(0x180000, 0x180fff).rw(FUNC(toaplan1_rallybik_state::shared_r), FUNC(toaplan1_rallybik_state::shared_w)).umask16(0x00ff);
map(0x1c0000, 0x1c0003).w(FUNC(toaplan1_rallybik_state::tile_offsets_w));
map(0x1c8001, 0x1c8001).w(FUNC(toaplan1_rallybik_state::reset_sound_w));
}
void toaplan1_state::truxton_main_map(address_map &map)
{
map(0x000000, 0x03ffff).rom();
map(0x080000, 0x083fff).ram();
map(0x0c0000, 0x0c0001).r(FUNC(toaplan1_state::frame_done_r));
map(0x0c0002, 0x0c0003).rw(FUNC(toaplan1_state::spriteram_offs_r), FUNC(toaplan1_state::spriteram_offs_w));
map(0x0c0004, 0x0c0005).rw(FUNC(toaplan1_state::spriteram_r), FUNC(toaplan1_state::spriteram_w));
map(0x0c0006, 0x0c0007).rw(FUNC(toaplan1_state::spritesizeram_r), FUNC(toaplan1_state::spritesizeram_w));
map(0x100001, 0x100001).w(FUNC(toaplan1_state::bcu_flipscreen_w));
map(0x100002, 0x100003).rw(FUNC(toaplan1_state::tileram_offs_r), FUNC(toaplan1_state::tileram_offs_w));
map(0x100004, 0x100007).rw(FUNC(toaplan1_state::tileram_r), FUNC(toaplan1_state::tileram_w));
map(0x100010, 0x10001f).rw(FUNC(toaplan1_state::scroll_regs_r), FUNC(toaplan1_state::scroll_regs_w));
map(0x140000, 0x140001).portr("VBLANK");
// map(0x140000, 0x140001).w(?? video frame related ??)
map(0x140003, 0x140003).w(FUNC(toaplan1_state::intenable_w));
map(0x140008, 0x14000f).w(FUNC(toaplan1_state::bcu_control_w));
map(0x144000, 0x1447ff).ram().w(FUNC(toaplan1_state::bgpalette_w)).share("bgpalette");
map(0x146000, 0x1467ff).ram().w(FUNC(toaplan1_state::fgpalette_w)).share("fgpalette");
map(0x180000, 0x180fff).rw(FUNC(toaplan1_state::shared_r), FUNC(toaplan1_state::shared_w)).umask16(0x00ff);
map(0x1c0000, 0x1c0003).w(FUNC(toaplan1_state::tile_offsets_w));
map(0x1c0006, 0x1c0006).w(FUNC(toaplan1_state::fcu_flipscreen_w));
map(0x1d0001, 0x1d0001).w(FUNC(toaplan1_state::reset_sound_w));
}
void toaplan1_state::hellfire_main_map(address_map &map)
{
map(0x000000, 0x03ffff).rom();
map(0x040000, 0x047fff).ram();
map(0x080000, 0x080001).portr("VBLANK");
// map(0x080000, 0x080001).w(?? video frame related ??)
map(0x080003, 0x080003).w(FUNC(toaplan1_state::intenable_w));
map(0x080008, 0x08000f).w(FUNC(toaplan1_state::bcu_control_w));
map(0x084000, 0x0847ff).ram().w(FUNC(toaplan1_state::bgpalette_w)).share("bgpalette");
map(0x086000, 0x0867ff).ram().w(FUNC(toaplan1_state::fgpalette_w)).share("fgpalette");
map(0x0c0000, 0x0c0fff).rw(FUNC(toaplan1_state::shared_r), FUNC(toaplan1_state::shared_w)).umask16(0x00ff);
map(0x100001, 0x100001).w(FUNC(toaplan1_state::bcu_flipscreen_w));
map(0x100002, 0x100003).rw(FUNC(toaplan1_state::tileram_offs_r), FUNC(toaplan1_state::tileram_offs_w));
map(0x100004, 0x100007).rw(FUNC(toaplan1_state::tileram_r), FUNC(toaplan1_state::tileram_w));
map(0x100010, 0x10001f).rw(FUNC(toaplan1_state::scroll_regs_r), FUNC(toaplan1_state::scroll_regs_w));
map(0x140000, 0x140001).r(FUNC(toaplan1_state::frame_done_r));
map(0x140002, 0x140003).rw(FUNC(toaplan1_state::spriteram_offs_r), FUNC(toaplan1_state::spriteram_offs_w));
map(0x140004, 0x140005).rw(FUNC(toaplan1_state::spriteram_r), FUNC(toaplan1_state::spriteram_w));
map(0x140006, 0x140007).rw(FUNC(toaplan1_state::spritesizeram_r), FUNC(toaplan1_state::spritesizeram_w));
map(0x180000, 0x180003).w(FUNC(toaplan1_state::tile_offsets_w));
map(0x180006, 0x180006).w(FUNC(toaplan1_state::fcu_flipscreen_w));
map(0x180009, 0x180009).w(FUNC(toaplan1_state::reset_sound_w));
}
void toaplan1_state::zerowing_main_map(address_map &map)
{
map(0x000000, 0x00ffff).rom();
map(0x040000, 0x07ffff).rom();
map(0x080000, 0x087fff).ram();
map(0x0c0000, 0x0c0003).w(FUNC(toaplan1_state::tile_offsets_w));
map(0x0c0006, 0x0c0006).w(FUNC(toaplan1_state::fcu_flipscreen_w));
map(0x400000, 0x400001).portr("VBLANK");
// map(0x400000, 0x400001).w(?? video frame related ??)
map(0x400003, 0x400003).w(FUNC(toaplan1_state::intenable_w));
map(0x400008, 0x40000f).w(FUNC(toaplan1_state::bcu_control_w));
map(0x404000, 0x4047ff).ram().w(FUNC(toaplan1_state::bgpalette_w)).share("bgpalette");
map(0x406000, 0x4067ff).ram().w(FUNC(toaplan1_state::fgpalette_w)).share("fgpalette");
map(0x440000, 0x440fff).rw(FUNC(toaplan1_state::shared_r), FUNC(toaplan1_state::shared_w)).umask16(0x00ff);
map(0x480001, 0x480001).w(FUNC(toaplan1_state::bcu_flipscreen_w));
map(0x480002, 0x480003).rw(FUNC(toaplan1_state::tileram_offs_r), FUNC(toaplan1_state::tileram_offs_w));
map(0x480004, 0x480007).rw(FUNC(toaplan1_state::tileram_r), FUNC(toaplan1_state::tileram_w));
map(0x480010, 0x48001f).rw(FUNC(toaplan1_state::scroll_regs_r), FUNC(toaplan1_state::scroll_regs_w));
map(0x4c0000, 0x4c0001).r(FUNC(toaplan1_state::frame_done_r));
map(0x4c0002, 0x4c0003).rw(FUNC(toaplan1_state::spriteram_offs_r), FUNC(toaplan1_state::spriteram_offs_w));
map(0x4c0004, 0x4c0005).rw(FUNC(toaplan1_state::spriteram_r), FUNC(toaplan1_state::spriteram_w));
map(0x4c0006, 0x4c0007).rw(FUNC(toaplan1_state::spritesizeram_r), FUNC(toaplan1_state::spritesizeram_w));
}
void toaplan1_demonwld_state::main_map(address_map &map)
{
map(0x000000, 0x03ffff).rom();
map(0x400000, 0x400001).portr("VBLANK");
// map(0x400000, 0x400001).w(?? video frame related ??)
map(0x400003, 0x400003).w(FUNC(toaplan1_demonwld_state::intenable_w));
map(0x400008, 0x40000f).w(FUNC(toaplan1_demonwld_state::bcu_control_w));
map(0x404000, 0x4047ff).ram().w(FUNC(toaplan1_demonwld_state::bgpalette_w)).share("bgpalette");
map(0x406000, 0x4067ff).ram().w(FUNC(toaplan1_demonwld_state::fgpalette_w)).share("fgpalette");
map(0x600000, 0x600fff).rw(FUNC(toaplan1_demonwld_state::shared_r), FUNC(toaplan1_demonwld_state::shared_w)).umask16(0x00ff);
map(0x800001, 0x800001).w(FUNC(toaplan1_demonwld_state::bcu_flipscreen_w));
map(0x800002, 0x800003).rw(FUNC(toaplan1_demonwld_state::tileram_offs_r), FUNC(toaplan1_demonwld_state::tileram_offs_w));
map(0x800004, 0x800007).rw(FUNC(toaplan1_demonwld_state::tileram_r), FUNC(toaplan1_demonwld_state::tileram_w));
map(0x800010, 0x80001f).rw(FUNC(toaplan1_demonwld_state::scroll_regs_r), FUNC(toaplan1_demonwld_state::scroll_regs_w));
map(0xa00000, 0xa00001).r(FUNC(toaplan1_demonwld_state::frame_done_r));
map(0xa00002, 0xa00003).rw(FUNC(toaplan1_demonwld_state::spriteram_offs_r), FUNC(toaplan1_demonwld_state::spriteram_offs_w));
map(0xa00004, 0xa00005).rw(FUNC(toaplan1_demonwld_state::spriteram_r), FUNC(toaplan1_demonwld_state::spriteram_w));
map(0xa00006, 0xa00007).rw(FUNC(toaplan1_demonwld_state::spritesizeram_r), FUNC(toaplan1_demonwld_state::spritesizeram_w));
map(0xc00000, 0xc03fff).ram();
map(0xe00000, 0xe00003).w(FUNC(toaplan1_demonwld_state::tile_offsets_w));
map(0xe00006, 0xe00006).w(FUNC(toaplan1_demonwld_state::fcu_flipscreen_w));
map(0xe00009, 0xe00009).w(FUNC(toaplan1_demonwld_state::reset_sound_w));
map(0xe0000b, 0xe0000b).w(FUNC(toaplan1_demonwld_state::dsp_ctrl_w)); /* DSP Comms control */
}
void toaplan1_samesame_state::main_map(address_map &map)
{
map(0x000000, 0x00ffff).rom();
map(0x040000, 0x07ffff).rom();
map(0x080000, 0x080003).w(FUNC(toaplan1_samesame_state::tile_offsets_w));
map(0x080006, 0x080006).w(FUNC(toaplan1_samesame_state::fcu_flipscreen_w));
map(0x0c0000, 0x0c3fff).ram(); /* Frame done at $c1ada */
map(0x100000, 0x100001).portr("VBLANK");
// map(0x100000, 0x100001).w(?? video frame related ??)
map(0x100003, 0x100003).w(FUNC(toaplan1_samesame_state::intenable_w));
map(0x100008, 0x10000f).w(FUNC(toaplan1_samesame_state::bcu_control_w));
map(0x104000, 0x1047ff).ram().w(FUNC(toaplan1_samesame_state::bgpalette_w)).share("bgpalette");
map(0x106000, 0x1067ff).ram().w(FUNC(toaplan1_samesame_state::fgpalette_w)).share("fgpalette");
map(0x140000, 0x140001).portr("P1");
map(0x140002, 0x140003).portr("P2");
map(0x140004, 0x140005).portr("DSWA");
map(0x140006, 0x140007).portr("DSWB");
map(0x140008, 0x140009).portr("SYSTEM");
map(0x14000b, 0x14000b).r(FUNC(toaplan1_samesame_state::port_6_word_r)); /* Territory, and MCU ready */
map(0x14000d, 0x14000d).w(FUNC(toaplan1_samesame_state::coin_w)); /* Coin counter/lockout */
// map(0x14000e, 0x14000f).nopr(); // irq ack?
map(0x14000f, 0x14000f).w(m_soundlatch, FUNC(generic_latch_8_device::write)); /* Commands sent to HD647180 */
map(0x180001, 0x180001).w(FUNC(toaplan1_samesame_state::bcu_flipscreen_w));
map(0x180002, 0x180003).rw(FUNC(toaplan1_samesame_state::tileram_offs_r), FUNC(toaplan1_samesame_state::tileram_offs_w));
map(0x180004, 0x180007).rw(FUNC(toaplan1_samesame_state::tileram_r), FUNC(toaplan1_samesame_state::tileram_w));
map(0x180010, 0x18001f).rw(FUNC(toaplan1_samesame_state::scroll_regs_r), FUNC(toaplan1_samesame_state::scroll_regs_w));
map(0x1c0000, 0x1c0001).r(FUNC(toaplan1_samesame_state::frame_done_r));
// map(0x1c0000, 0x1c0001).w(?? disable sprite refresh ??)
map(0x1c0002, 0x1c0003).rw(FUNC(toaplan1_samesame_state::spriteram_offs_r), FUNC(toaplan1_samesame_state::spriteram_offs_w));
map(0x1c0004, 0x1c0005).rw(FUNC(toaplan1_samesame_state::spriteram_r), FUNC(toaplan1_samesame_state::spriteram_w));
map(0x1c0006, 0x1c0007).rw(FUNC(toaplan1_samesame_state::spritesizeram_r), FUNC(toaplan1_samesame_state::spritesizeram_w));
}
void toaplan1_state::outzone_main_map(address_map &map)
{
map(0x000000, 0x03ffff).rom();
map(0x100000, 0x100001).r(FUNC(toaplan1_state::frame_done_r));
map(0x100002, 0x100003).rw(FUNC(toaplan1_state::spriteram_offs_r), FUNC(toaplan1_state::spriteram_offs_w));
map(0x100004, 0x100005).rw(FUNC(toaplan1_state::spriteram_r), FUNC(toaplan1_state::spriteram_w));
map(0x100006, 0x100007).rw(FUNC(toaplan1_state::spritesizeram_r), FUNC(toaplan1_state::spritesizeram_w));
map(0x140000, 0x140fff).rw(FUNC(toaplan1_state::shared_r), FUNC(toaplan1_state::shared_w)).umask16(0x00ff);
map(0x200001, 0x200001).w(FUNC(toaplan1_state::bcu_flipscreen_w));
map(0x200002, 0x200003).rw(FUNC(toaplan1_state::tileram_offs_r), FUNC(toaplan1_state::tileram_offs_w));
map(0x200004, 0x200007).rw(FUNC(toaplan1_state::tileram_r), FUNC(toaplan1_state::tileram_w));
map(0x200010, 0x20001f).rw(FUNC(toaplan1_state::scroll_regs_r), FUNC(toaplan1_state::scroll_regs_w));
map(0x240000, 0x243fff).ram();
map(0x300000, 0x300001).portr("VBLANK");
// map(0x300000, 0x300001).w(?? video frame related ??)
map(0x300003, 0x300003).w(FUNC(toaplan1_state::intenable_w));
map(0x300008, 0x30000f).w(FUNC(toaplan1_state::bcu_control_w));
map(0x304000, 0x3047ff).ram().w(FUNC(toaplan1_state::bgpalette_w)).share("bgpalette");
map(0x306000, 0x3067ff).ram().w(FUNC(toaplan1_state::fgpalette_w)).share("fgpalette");
map(0x340000, 0x340003).w(FUNC(toaplan1_state::tile_offsets_w));
map(0x340006, 0x340006).w(FUNC(toaplan1_state::fcu_flipscreen_w));
}
void toaplan1_state::outzonecv_main_map(address_map &map)
{
map(0x000000, 0x03ffff).rom();
// map(0x040000, 0x07ffff).rom();
map(0x080000, 0x087fff).ram();
map(0x0c0000, 0x0c0003).w(FUNC(toaplan1_state::tile_offsets_w));
map(0x0c0006, 0x0c0006).w(FUNC(toaplan1_state::fcu_flipscreen_w));
map(0x400000, 0x400001).portr("VBLANK");
// map(0x400000, 0x400001).w(?? video frame related ??)
map(0x400003, 0x400003).w(FUNC(toaplan1_state::intenable_w));
map(0x400008, 0x40000f).w(FUNC(toaplan1_state::bcu_control_w));
map(0x404000, 0x4047ff).ram().w(FUNC(toaplan1_state::bgpalette_w)).share("bgpalette");
map(0x406000, 0x4067ff).ram().w(FUNC(toaplan1_state::fgpalette_w)).share("fgpalette");
map(0x440000, 0x440fff).rw(FUNC(toaplan1_state::shared_r), FUNC(toaplan1_state::shared_w)).umask16(0x00ff);
map(0x480001, 0x480001).w(FUNC(toaplan1_state::bcu_flipscreen_w));
map(0x480002, 0x480003).rw(FUNC(toaplan1_state::tileram_offs_r), FUNC(toaplan1_state::tileram_offs_w));
map(0x480004, 0x480007).rw(FUNC(toaplan1_state::tileram_r), FUNC(toaplan1_state::tileram_w));
map(0x480010, 0x48001f).rw(FUNC(toaplan1_state::scroll_regs_r), FUNC(toaplan1_state::scroll_regs_w));
map(0x4c0000, 0x4c0001).r(FUNC(toaplan1_state::frame_done_r));
map(0x4c0002, 0x4c0003).rw(FUNC(toaplan1_state::spriteram_offs_r), FUNC(toaplan1_state::spriteram_offs_w));
map(0x4c0004, 0x4c0005).rw(FUNC(toaplan1_state::spriteram_r), FUNC(toaplan1_state::spriteram_w));
map(0x4c0006, 0x4c0007).rw(FUNC(toaplan1_state::spritesizeram_r), FUNC(toaplan1_state::spritesizeram_w));
}
void toaplan1_state::vimana_main_map(address_map &map)
{
map(0x000000, 0x03ffff).rom();
map(0x080000, 0x080003).w(FUNC(toaplan1_state::tile_offsets_w));
map(0x080006, 0x080006).w(FUNC(toaplan1_state::fcu_flipscreen_w));
map(0x0c0000, 0x0c0001).r(FUNC(toaplan1_state::frame_done_r));
map(0x0c0002, 0x0c0003).rw(FUNC(toaplan1_state::spriteram_offs_r), FUNC(toaplan1_state::spriteram_offs_w));
map(0x0c0004, 0x0c0005).rw(FUNC(toaplan1_state::spriteram_r), FUNC(toaplan1_state::spriteram_w));
map(0x0c0006, 0x0c0007).rw(FUNC(toaplan1_state::spritesizeram_r), FUNC(toaplan1_state::spritesizeram_w));
map(0x400000, 0x400001).portr("VBLANK");
// map(0x400000, 0x400001).w(?? video frame related ??)
map(0x400003, 0x400003).w(FUNC(toaplan1_state::intenable_w));
map(0x400008, 0x40000f).w(FUNC(toaplan1_state::bcu_control_w));
map(0x404000, 0x4047ff).ram().w(FUNC(toaplan1_state::bgpalette_w)).share("bgpalette");
map(0x406000, 0x4067ff).ram().w(FUNC(toaplan1_state::fgpalette_w)).share("fgpalette");
map(0x440000, 0x4407ff).rw(FUNC(toaplan1_state::shared_r), FUNC(toaplan1_state::shared_w)).umask16(0x00ff); /* inputs, coins and sound handled by 647180 MCU via this space */
map(0x480000, 0x487fff).ram();
map(0x4c0001, 0x4c0001).w(FUNC(toaplan1_state::bcu_flipscreen_w));
map(0x4c0002, 0x4c0003).rw(FUNC(toaplan1_state::tileram_offs_r), FUNC(toaplan1_state::tileram_offs_w));
map(0x4c0004, 0x4c0007).rw(FUNC(toaplan1_state::tileram_r), FUNC(toaplan1_state::tileram_w));
map(0x4c0010, 0x4c001f).rw(FUNC(toaplan1_state::scroll_regs_r), FUNC(toaplan1_state::scroll_regs_w));
}
/***************************** Z80 Memory Map *******************************/
void toaplan1_state::sound_map(address_map &map)
{
map(0x0000, 0x7fff).rom();
map(0x8000, 0x87ff).ram().share("sharedram");
}
void toaplan1_rallybik_state::rallybik_sound_io_map(address_map &map)
{
map.global_mask(0xff);
map(0x00, 0x00).portr("P1");
map(0x10, 0x10).portr("P2");
map(0x20, 0x20).portr("SYSTEM");
map(0x30, 0x30).w("coinlatch", FUNC(ls259_device::write_nibble_d0)); /* Coin counter/lockout */
map(0x40, 0x40).portr("DSWA");
map(0x50, 0x50).portr("DSWB");
map(0x60, 0x61).rw("ymsnd", FUNC(ym3812_device::read), FUNC(ym3812_device::write));
}
void toaplan1_state::truxton_sound_io_map(address_map &map)
{
map.global_mask(0xff);
map(0x00, 0x00).portr("P1");
map(0x10, 0x10).portr("P2");
map(0x20, 0x20).portr("SYSTEM");
map(0x30, 0x30).w(FUNC(toaplan1_state::coin_w)); /* Coin counter/lockout */
map(0x40, 0x40).portr("DSWA");
map(0x50, 0x50).portr("DSWB");
map(0x60, 0x61).rw("ymsnd", FUNC(ym3812_device::read), FUNC(ym3812_device::write));
map(0x70, 0x70).portr("TJUMP");
}
void toaplan1_state::hellfire_sound_io_map(address_map &map)
{
map.global_mask(0xff);
map(0x00, 0x00).portr("DSWA");
map(0x10, 0x10).portr("DSWB");
map(0x20, 0x20).portr("TJUMP");
map(0x30, 0x30).w(FUNC(toaplan1_state::coin_w)); /* Coin counter/lockout */
map(0x40, 0x40).portr("P1");
map(0x50, 0x50).portr("P2");
map(0x60, 0x60).portr("SYSTEM");
map(0x70, 0x71).rw("ymsnd", FUNC(ym3812_device::read), FUNC(ym3812_device::write));
}
void toaplan1_state::zerowing_sound_io_map(address_map &map)
{
map.global_mask(0xff);
map(0x00, 0x00).portr("P1");
map(0x08, 0x08).portr("P2");
map(0x20, 0x20).portr("DSWA");
map(0x28, 0x28).portr("DSWB");
map(0x80, 0x80).portr("SYSTEM");
map(0x88, 0x88).portr("TJUMP");
map(0xa0, 0xa0).w(FUNC(toaplan1_state::coin_w)); /* Coin counter/lockout */
map(0xa8, 0xa9).rw("ymsnd", FUNC(ym3812_device::read), FUNC(ym3812_device::write));
}
void toaplan1_demonwld_state::sound_io_map(address_map &map)
{
map.global_mask(0xff);
map(0x00, 0x01).rw("ymsnd", FUNC(ym3812_device::read), FUNC(ym3812_device::write));
map(0x20, 0x20).portr("TJUMP");
map(0x40, 0x40).w(FUNC(toaplan1_demonwld_state::coin_w)); /* Coin counter/lockout */
map(0x60, 0x60).portr("SYSTEM");
map(0x80, 0x80).portr("P1");
map(0xa0, 0xa0).portr("DSWB");
map(0xc0, 0xc0).portr("P2");
map(0xe0, 0xe0).portr("DSWA");
}
void toaplan1_state::outzone_sound_io_map(address_map &map)
{
map.global_mask(0xff);
map(0x00, 0x01).rw("ymsnd", FUNC(ym3812_device::read), FUNC(ym3812_device::write));
map(0x04, 0x04).w(FUNC(toaplan1_state::coin_w)); /* Coin counter/lockout */
map(0x08, 0x08).portr("DSWA");
map(0x0c, 0x0c).portr("DSWB");
map(0x10, 0x10).portr("SYSTEM");
map(0x14, 0x14).portr("P1");
map(0x18, 0x18).portr("P2");
map(0x1c, 0x1c).portr("TJUMP");
}
/***************************** TMS32010 Memory Map **************************/
void toaplan1_demonwld_state::dsp_program_map(address_map &map)
{
map(0x000, 0x7ff).rom();
}
/* $000 - 08F TMS32010 Internal Data RAM in Data Address Space */
void toaplan1_demonwld_state::dsp_io_map(address_map &map)
{
map(0x0, 0x0).w(FUNC(toaplan1_demonwld_state::dsp_addrsel_w));
map(0x1, 0x1).rw(FUNC(toaplan1_demonwld_state::dsp_r), FUNC(toaplan1_demonwld_state::dsp_w));
map(0x3, 0x3).w(FUNC(toaplan1_demonwld_state::dsp_bio_w));
}
/***************************** HD647180 Memory Map **************************/
void toaplan1_state::vimana_hd647180_mem_map(address_map &map)
{
map(0x08000, 0x087ff).ram().share("sharedram"); /* 2048 bytes of shared ram w/maincpu */
}
void toaplan1_state::vimana_hd647180_io_map(address_map &map)
{
map.global_mask(0xff);
map(0x32, 0x32).nopw(); // DMA WAIT/Control register
map(0x33, 0x33).nopw(); // IL (int vector low) register
map(0x36, 0x36).nopw(); // refresh control register for RFSH pin
// 53: disable reg for port A
map(0x60, 0x60).nopr(); // read/write port A
// 61: read/write port B
// 62: read/write port C
// 63: read/write port D
// 64: read/write port E
// 65: read/write port F
map(0x66, 0x66).nopr(); // read port G
// 70: ddr for port A
map(0x71, 0x71).nopw(); // ddr for port B
map(0x72, 0x72).nopw(); // ddr for port C
map(0x73, 0x73).nopw(); // ddr for port D
map(0x74, 0x74).nopw(); // ddr for port E
map(0x75, 0x75).nopw(); // ddr for port F
map(0x80, 0x80).portr("P1");
map(0x81, 0x81).portr("P2");
map(0x82, 0x82).portr("DSWA");
map(0x83, 0x83).portr("SYSTEM");
map(0x84, 0x84).w(FUNC(toaplan1_state::coin_w)); // Coin counter/lockout // needs verify
map(0x87, 0x87).rw("ymsnd", FUNC(ym3812_device::status_r), FUNC(ym3812_device::address_w));
map(0x8f, 0x8f).w("ymsnd", FUNC(ym3812_device::data_w));
}
u8 toaplan1_state::vimana_dswb_invert_r()
{
return m_dswb_io->read() ^ 0xff;
}
u8 toaplan1_state::vimana_tjump_invert_r()
{
return (m_tjump_io->read() ^ 0xff) | 0xc0; // high 2 bits of port G always read as 1
}
u8 toaplan1_samesame_state::cmdavailable_r()
{
return m_soundlatch->pending_r() ? 1 : 0;
}
void toaplan1_samesame_state::hd647180_io_map(address_map &map)
{
map.unmap_value_high();
map.global_mask(0xff);