* Hidden Functions : If the 'Invulnerability dip switch' is enabled, you are invulnerable but you may also 'Pause' the game with P2 Start and restart with P1 Start.

0.36RC1 [Quench]

WIP:
- 0.141u4: Alex Jackson corrected Knuckle Bash rom names, thanks to information from Charles MacDonald.
- 0.141u1: Alex Jackson found a lot more Knuckle Bash opcodes by matching code with Batsugun. Corrected m68k and v25 address maps for Knuckle Bash.
- 0.135u1: David Haywood cleaned up Toaplan2 V25 support. Added V25 (16 MHz) CPU2 to Knuckle Bash.
- 1st June 2008: Charles MacDonald - V25 research: There are a number of instructions which delay interrupt and exception processing, allowing one more instruction to be executed before the interrupt is taken. For the prefixes, this prevents an interrupt from being taken after the prefix byte has been fetched but before the instruction it applies to has been executed. Likewise for segment register loads, if an interrupt occurred after SS was changed, SP would be invalid. By delaying interrupts the following types of sequences become uninterruptible. It seems less important to have DS and ES register loads delay interrupts as well, I did not expect this behavior. I have been looking at the MCU code for other games and it seems that they use similar, if not identical instruction encodings, despite using differently labeled MCUs. V-Five in particular seems to match the Knuckle Bash opcodes quite closely, and when/if I can get Knuckle Bash decrypted, I'll see how much of V-Five can be decrypted.
- 12th April 2008: Charles MacDonald - I recently acquired a Toaplan "Knuckle Bash" PCB. It's a fairly impressive system, based around a custom graphics chip which displays three tiled background layers and two 512x512 12-bit framebuffers for double buffered sprites. It has a 68HC000 running at 16 MHz that handles all the game related tasks, and a V25S MCU that manages inputs, sound effects, and music playback. The music for this game is quite good and definitely a notch above the rest. A lot of other Toaplan games use the same graphics chip, so I'm intending to run tests on it and get all the timing and other details worked out. The V25S microcontroller is a 80186 clone manufactured by NEC. Unlike the V25 it has no usable internal ROM and no 8080 emulation mode, the latter of which has been modified to add a new 'secure' operating mode. In secure mode a lookup table translates opcodes fetched from memory with their V25S equivalents. This allows the opcode-to-instruction mapping to be changed as the customer (Toaplan) sees fit, making the program code unusable unless the table contents are known. Luckily operands and data are not encrypted, and examination of the operands such as the ModR/M byte can reveal what category of instructions a particular opcode might fit in to. NEC intended for the V25S to be used as a drop-in replacement for the V25, to accomplish this it uses one of the unused V25 pins as a mode select input. When tied high or floating (due to an internal pull-up resistor) the CPU runs in normal mode, where the lookup table is bypassed and opcodes are processed normally. When tied low, the CPU is in secure mode and the lookup table is utilized. This pin is sampled during a reset, interrupt, or exception, and bit 15 of the PSW can be modified through select instructions to change the operating mode regardless of the pin state as well. These features allow a V25S to start in normal mode and selectively execute encrypted programs while still interacting with a unencrypted BIOS, operating system, and device drivers, or vice-versa. I modified the Knuckle Bash board to start the V25S in normal mode, and developed a program that sets the MCU to a known state and enters secure mode with the instruction trap feature enabled. This forces just one encrypted instruction to be executed before control is passed back to my unencrypted code, at which point the potentially modified state of the MCU is saved and examined. The behavior of all encrypted opcodes (except BRKS which sets up an unrecoverable state) can therefore be examined. I can see things like what data was pushed or popped from the stack, which registers were loaded, exchanged, or modified, and which instructions triggered an I/O or floating point exception. A lot of information can be gathered about the encrypted instructions, which narrows down or completely identifies which unencrypted instructions they map to. Best of all this technique should work for any V25S based system, such as the other Toaplan games. I'm looking forward to trying it on my Golden Axe 2 security board to see how effective it is after finishing with Knuckle Bash, though right now it's too early to give any indication of progress. Toaplan did an excellent job with the protection. The program ROM is filled with valid Z80 code and garbage data to throw off statistical analysis of the ROM, such as observing the frequency of occurence for particular bytes and byte sequences. The MCU has no manufacturer marking and has ambiguous names printed on it like "NITRO" and "DASH". Furthermore, the lookup table maps many opcodes to the same instructions so certain easily identifiable instructions can simply never be executed, increasing the number of potential matches any encrypted instruction might have. If this technique is applicable to the V35S, we'll have to see what Irem did with their games.
- 0.88: Changed MSM6295 clock speed to 7575 Hz.
- 11th May 2003: Guru - Knuckle Bash (Toaplan) arrived from Randy.
- 0.37b10: Changed OKI6295 clock speed to 20454 Hz.
- 0.37b9: Changed OKI6295 clock speed to 20000 Hz.
- 0.37b6: Changed YM3812 clock speed to 3375000 Hz.
- 0.36RC1: Quench added Knuckle Bash (Toaplan 1993). Working, but no sound. MCU dump exists, but it needs investigation.
- 12th January 2000: Quench sent a driver for some later Toaplan games such as Teki Paki, Ghox, Dogyuun, Knuckle Bash, Pipi & Bibis / Whoopee!! and Snow Bros 2.

LEVELS: 10

Other Emulators:
* FB Alpha
* Raine

Romset: 8992 kb / 7 files / 3.13 zip