About a month ago Caius dumped a bootleg version of Varth. A had a quick look at the time but never got it going. I've had another look over the last couple of days and the game is now working.
Initially I didn't get very far, the game was halting when reading from the 68K address 0x100280. Initially I thought there was some simple protection, but didn't find anything that worked. I mapped some of the 68K program ROM into the space, and the game did do a little more, but never started.
At this point, I realised there were two more ROMs in the dump. These two ROMs matched data from the end of main 68K ROMs in the original set, but were much smaller. Mapping this data into the space at 0x100000 to 0x1fffff and the game boots and works fine. It looks like the bootleggers used a subset of the 68K ROM as protection data, or maybe they needed to be able to return the original data in the area where they added their code.
The game doesn't appear to write the scroll 3 RAM offset anywhere (the usual address is now the sound command), so I have hard-coded it on boot. However, the game does write the value at boot to 0x800188 (which is normally the PSound fade command). The game promptly overwrites this again though. Is it feasible that the first write to this address sets up the scroll 3 RAM offset, and subsequent writes are used as the fade command as usual?
This bootleg is taken from the 920612 etc version. I can't see any differences in-game but the following hardware differences are observed (as well as the previously mentioned 68K data, and scroll 3 RAM offset handling);
- Different layout of graphics data
- PCM data combined into one ROM
- The scroll registers have moved to the 0x980000 range
- The game uses Playmark style sprites mapped at 0x990000 to 0x993fff
- Sound command moved to port 6
This is another CPS-1 bootleg emulated and documented. Look out for it in an FB Alpha release soon.