0.74u2 [Manuel Abadia, Mike Coates, Nicola Salmoria]
0.63 [?]

WIP:
- 0.138u3: Brian Troha corrected DIP locations order in World Rally to match actual dips as seen by the game / service menu.
- 0.136u3: Guru added/verified DIP locations for World Rally.
- 0.128u3 Merged DS5002FP into MCS-51 [Couriersud]: Merged DS5002FP. Disassembler now uses type specific memory names. Merged DS5002FP disasm. Added 83C751 memory names to disassembler. Delete DS5002FP specific files. Removed unnecessary cpu callback in World Rally. DATA_MAP ==> IO_MAP in World Rally.
- 0.126u1: Macareno added World Rally support to tiny.mak/.c.
- 0.125u2: R. Belmont fixed World Rally MCU communications on big-endian. Mirko Mattioli added World Rally wheel support. When optical wheel is selected (via dipswitch), then gear shift (low/high) is enabled. On the real PCB the optical wheel encoder is connected to 74LS169 ICs (@A16 and @A17) via a flip-flop IC mounted in the steering wheel assembly. As a result, the output of the flip-flop generates a signal that contains the information about the steering direction; this signal is routed to pin #1 (U/D) at ICs A16 and A17 (high when turn left and low when turn right). The second signal of the optical encoder goes directly to pin #2 (CLK) at ICs A16 and A17 and it is a clock for the 74LS169 ICs; this clock frequency is proportional to the movements of the steering wheel: fast movements produces a high clock frequency, slow movements a low freq.
- 0.125u1: GAELCO SA and Manuel Abadia fixed World Rally - Game now playable. Added DS5002FP (12MHz) CPU2 and cpu2 rom ($0 - DS5002FP code). Changed visible area to 368x232. Changed description of clone '(set 3 - 930217)' to 'World Rally (US, 930217)'.
- 14th May 2008: GAELCO.COM - Gaelco games at home! World Rally: The aim of Gaelco, S.A. behind liberating the World Rally code has been that all players who took part in the success of the game, can since today live those moments again from one's home couch. From here and on behalf of all we want to thank all those who made World Rally I running on our PC such a reality. Without the selfless endeavor and effort of Manuel Abadia and Elsemi, among others, this would not have been possible. We also want to disapprove and isolate those opportunists who are already thinking the way to take advantage of Gaelco's, S.A. generosity and turn it into a lucrative business, using the free-liberated code of Gaelco, S.A. for commercial means. These persons will turn this generosity into mistrust, that can affect future collaborations. We sincerely wish you enjoy this game. Platform: MAME. Download at http://www.gaelco.com/english/pages/hablando/frhablan.htm
- 12th May 2008: Manuel Abadia - World Rally emulation is complete. I implemented priorities (that were trickier than I thought), shadows/highlights and a few missing bits in the video hardware. The game is fully playable from beginning to end without any problem as far as I can tell. I thought there was a bug in the video hardware emulation somewhere... So I plugged my PCB and compared it to the driver. The problem is also in the original arcade game. Because of the way an arcade monitor works, the problem is nearly unnoticeable in the original game. I also checked if the original PCB had the same "shadow effect" for the tiles, yes the hardware works that way. Something curious about the protection... Javier told ElSemi that the protection of this game took 8 months of work, so imagine how complicated it was... even the dallas has some code that performs some pseudorandom dummy accesses to the shared RAM to make black box attacks even more difficult. To clarify a question about the other protected games, having the World Rally dallas code does not help to emulate the protection of them. As MAME now has a DS5002FP core and the other games are almost fully emulated, if we get the dallas code for a game, it will be playable quickly. Finally, I want to thank to all the people that made this possible. It was cool to be part of this. It has brought me some good memories and healed my wounds with Gaelco.
- 10th May 2008: Manuel Abadia - Playable status reached: Javier sent us (via ElSemi) detailed information about how the encryption process worked. However, he told us that the sheets of paper that contained the encryption info were a bit difficult to read in some places (remember that this protection was designed 15 years ago) so probably there was some mistakes in the excel file he sent us. ElSemi and I tried to add it with the information he gave us but we didn't have success. Nicola Salmoria did an excellent work (as always) consolidating the information and obtaining the missing information. He generated a working decryption function that not only works for World Rally, but also for Squash and Thunder Hoop. Mike Coates also completed the interface to get the data from a World Rally PCB, so he was able to supply the encrypted/decrypted data that was needed to get the specific details to decrypt World Rally properly. Special mention to Andreas Naive too. The high level information Javier told us a few days ago was already discovered by Andreas and posted in his page a couple of months ago. Before Javier sent us detailed information about how the encryption worked I contacted Andreas Naive about the encryption and he told me that he didn't have free time at the moment to look at it. However he told me an intuition he had about the algorithm: "I remember that my last feeling was that to decipher each 16 bits block, it was done in 3 chunks: a first 6 bits chunk and then two 5 bits chunks, each of them based in a/some bits of the first chunk. I don't remember exactly which ones, but the first chunk was the one with a simple structure (based on the tables I published), while the other two were the ones that shown a more complex structure (and carry effects)". He was completely right as that was how it worked the encryption that Javier sent us. It is good to have geniouses around. After adding the decryption to the driver the game looks fine. It has a few graphic glitches that will be fixed soon but it seems to be PLAYABLE.
- 7th May 2008: Manuel Abadia - The Dallas DS5002FP core is complete. The additions to the 8051 core are: Extra Special Function Registers, Byte-wide Bus Support, Memory Partition and Memory Range, Bootstrap Configuration, Power Fail Interrupt, Timed Access, Stop Mode and Idle Mode. I didn't bother to add support for Peripherals, the Reprogrammable Peripheral Controller or CRC-16 support because it isn't used by the game. The communication between the Dallas and the main CPU seems to be working, however, the game writes some bytes to the encrypted Video RAM, it reads them back and then makes some calls based on the decrypted data. As the current decryption is wrong, the game doesn't work yet and never uses the dallas for anything interesting right now. The decryption of the Video RAM is in the same state as it was. However, ElSemi asked Javier for information about the decryption and he is trying to help us. He didn't remember how it was performed but we send him the information we got about it in 2002 (when Mike connected the PCB to the fluke) to refresh a bit his memory. Thanks to that, he gave us another point of view about how the encryption may work. Even if he is right, we still need to get data from the original PCB. Hopefully, somewhere in the process we end up with a clean decrypt function that uses no tables. Understanding some code I was able to guess some decrypted values and get this (see snapshot). It looks really ugly as the colors for the tiles aren't decrypted properly but this finally confirms that World Rally uses the same Video Hardware as Target Hits. The only change seems to be the additional palette entries for the night races. I have seen how the palette was configured in a night race and I have an idea of how the palette works for the night races (not very different from World Rally 2), but we'll have to wait until the game works to implement it. So, the current status is that if the Video RAM is decrypted properly and we are lucky, the game should work without the light effects (and maybe some priority problems) and be playable. If we are not that lucky, hopefully the problems are not difficult to find and fix.
- 5th May 2008: Manuel Abadia - If you have tried to execute World Rally since it was added to MAME you have seen the precarious state of the driver. The protection of World Rally is double: 1. Encrypted Video RAM: The encrypted Video RAM transforms a 32 bits value written to it to another value that is really complex to derive from the original value. This protection was also used in Thunder Hoop and Squash. Mike Coates connected a fluke to his PCBs and got a 4 GB file will all possible combinations (2^32) for Thunder Hoop and Squash. Using that file, the encryption process was replicated. However, it was not very practical to require a 16 GB file to run the game. Nicola Salmoria studied the file and generated some code (about 400 lines) that replicated the original encryption. That's why you can play Thunder Hoop and Squash. Why World Rally encryption is incomplete? All of us wanted to see World Rally running before any other game, so we started studying World Rally before Squash and Thunder Hoop. In that time, we thought that the encryption was only performed in 16 bits, not 32. Unfortunately, when Mike got all decrypted values (2^16), the code was clearly showing that the decrypted values were not correct in most cases (for example, one of the methods that draws the tiles uses a decrypted value for the number of tiles to draw. That's why the power on self test results and other screens look horrible right now). After we find that out, the decryption efforts were centered in the other games. As World Rally was not going to be playable unless the dallas code was dumped (something that seemed unlikely), it has remained that way. 2. Dallas DS5002FP secure MCU: The Dallas MCU in the Gaelco games has some critical code that handles inputs, objects manipulation and other complex calculations that prevent the game from working properly (Take a look at World Rally 2 if you don't know what I mean). The DS5002FP MCU has been one of the best chips for protecting information on its era making emulation of these games impossible for now. There are some specialized labs that claim to be able to get the code from a DS5002FP but it is an incredibly expensive process we can't afford. I have to admit that I thought that I'd never see World Rally emulated, as I approached some people at Gaelco and Zigurat for the Dallas code without luck. However, the other day I received an email that changed my mind. Miguel Angel Horna (ElSemi) did a talk at Lleida Lan Party about emulation. At the party he met one of the Gaelco founders (Javier Valero) that was there to speak about the arcade game industry. ElSemi and Javier talked about the protection in some Gaelco games and Javier was kind enough to provide the dallas code for World Rally. With the internal code of the DS5002FP it is just a matter of time to finally have a working driver in MAME. I have been completely inactive from MAME development for a while but as I worked on the drivers of all the Gaelco 2D games (except Master Boy) and I spent a lot of time and money on them, I thought it was a good time to resume my work on MAME. Mike Coates is trying to get all the possible values from World Rally Video RAM so we can advance in that area too. Currently I am writing a DS5002FP core to run the dallas code. The DS5002FP is just a 8051 MCU with some additions and as MAME already has a 8051 core things are going fast. For example, the initial coprocessor test works (although it is a trivial test to pass without the dallas code). Also, adding the Power Fail Interrupt of the dallas I managed to see this screen that is supposed to be seen when the dallas is dying. After the both protections are emulated the driver will need more work as probably the video hardware emulation isn't complete and needs some tweaks here and there but I'm confident that World Rally will be playable in a not so distant future. I don't know if Javier will give us more dallas code or not, but hats off to him for this one. Also, thanks a lot to ElSemi for being able to get the dallas code from him.
- 0.123u4: Corrado Tomaselli changed/verified OKI6295 pin 7 in World Rally. Changed OKI6295 clock speed to 1MHz.
- 0.110u3: Kevin Eshbach added clone World Rally (set 3 - 930217). Added plds (pal16r4-e2.bin and pal16r8-b15.bin).
- 10th October 2005: Guru - A working Gaelco World Rally to be sent off for analysis/trojaning arrived. Thanks to Tingoes.
- 0.74u2: Added World Rally (set 1) (Gaelco 1993) and clone (set 2).
- 0.63: Added (Testdrivers) World Rally (set 1) and (set 2). Current decryption is incomplete. The DS5002FP has 32KB undumped gameplay code making the game unplayable.
- 6th December 2002: Manuel Abadia sent in a preliminary driver for World Rally that works somewhat, but won't be playable because of an undumped DS5002FP MCU.
- 1st December 2002: Nicola Salmoria partially decrypted World Rally, although no driver for it exists yet.

Romset: 4129 kb / 11 files / 2.01 zip