• Samsung Galaxy Nexus with Ice Cream Sandwich hands-on (video)

    The Galaxy Nexus (formerly referred to as the Nexus Prime) carries on the Nexus torch in spectacular fashion, and we've just spent a few quality moments with one here at the launch event. Design-wise, it's clear that the Nexus S DNA is here, though the rear reminds us most of the Galaxy S II. Those who abhor physical buttons will also be delighted, and while we'd gotten used to the whole Power + Home for a screenshot on the GSII, Power + Volume Down works just fine on this fellow.......

  • Android 4.0 Ice Cream Sandwich now official, tons of enhancements

    PSHax member - Google has taken the stage in Hong Kong to make the next version of Android OS, nicknamed Ice Cream Sandwich, a thing of reality. Better known as Android 4.0, the update offers a massive redesign to the user interface and adds a plethora of new features. Some of the highlights include an NFC-enabled feature called Android Beam, offline search in Gmail, new lock screen features and a fancy unlocking method called "Face Unlock," which uses facial recognition to ensure strangers can't use your phone without permission. Ice Cream Sandwich also includes enhancements in.....

  • Motorola RAZR to get updated to Ice Cream Sandwich in early 2012

    Mutricy mentioned that while the company's new flagship device was designed for Gingerbread, plans have been set to introduce the latest version of Android in the start of 2012, with a more precise date naturally on its way. Given past experience, however, it's probable that the unbranded version of the device will get the refresh ahead of the Droid RAZR on Verizon, so US users may need to exercise a wee bit of patience here. Regardless, it's time for the competition to step up......

  • HTC Rezound render resoundingly revealed- wait next November 10th

    Hark! The first renders of the HTC Rezound have appeared online, thanks to some of the device's cases going up for pre-order. You can see that, like the Sensation XE, the phone has red-glowing soft keys -- a bit of a departure from HTC's traditionally conservative design language. If you recall, the phone formerly called Vigor is said to have a 4.3-inch screen, a dual-core 1.5GHz processor, 1GB RAM, Beats Audio and an 8MP rear camera.....

Previous Next

ZX Spectrum emulator discovered in N64 game Goldeneye

Posted by Mohd Khairun Nasir Saadi On - - 0 comments

Little benownst to the world all this time, GoldenEye (N64) has a fully-functional ZX Spectrum 48x emulator built into it. By feeding it a proper Spectrum monitor program and calling menu 25 to load a snapshot, any Spectrum 48x program can be run.

The emulator started life as a side project to see if Spectrum emulation was possible on N64 and was hooked into GE, the current game in development. It was supposed to be removed before release but was only made inaccessible and inoperable. All the registers, dependancies, and script required to run the emulator still reside in retail GoldenEye carts.

The original list of games were previous Rare titles, then known as Ultimate Play the Game. The embedded filelist is, in order:

em/data/sabre.seg.rz  Sabre Wulf
em/data/atic.seg.rz  Atic Atac
em/data/jetpac.seg.rz Jetpac
em/data/jetman.seg.rz Lunar Jetman
em/data/alien8.seg.rz Alien 8
em/data/gunfright.seg.rz Gun Fright
em/data/under.seg.rz  Underwurlde
em/data/knightlore.seg.rz Knight Lore
em/data/pssst.seg.rz  Pssst
em/data/cookie.seg.rz Cookie
em/data/spec_rom.seg.rz Spectrum 16k monitor program
In actual fact, the emulator was supposed to run without the aid of the monitor program. Critical subroutines were copied out or hardcoded. In its current state, however, the monitor is required.

Originally, the emulator was run much the same way that stages are run. Unlike stages which run by switching to menu 11, the emulator runs by switching to menu 25. When initialized, it reads what buttons are held on controller 3. Depending on the button held is which game would be loaded. From there, the monitor program and selected snapshot file are loaded from ROM, and if necessary these files are decompressed.
Only controller 1 is detected. This is mapped as a Kempston joystick on port 31. Necessary buttons to start each game (usually keyboard '0') and any additional keys to play the game are mapped to the keyboard port 254 halfwords. These are set on a per-game basis, but general controls are A/B to start a game, Z for the 'action' button, and L to unload the emulator and return to gameplay.
Each emulation cycle lasts 69888 Spectrum cycles. Each opcode consumes a certain amount of this cycle count. At the end, the screen is drawn to the Spectrum screen buffer, and this is displayed like an image using usual N64 microcode. Emulation continues as long as menu 25 is called.


Why a Patch Is Required

In its pre-patched state the emulator has some peculiar issues, probably due to the different versions of included files used to compile the retail game.
For instance, the ten games listed above were not all selectable. The initializer only has button masks for eight games, defaulting to SabreWulf. The snapshot loader restricts this list to only the first five. The controller mapping function, however, redirects buttons for all ten titles.

Interestingly, the ROM file table leaves only ten spaces for the ten different snapshot files blank. These are completely blank, without any data or indicies until the final file placeholder. As previously mentioned, the monitor was not supposed to be included but is requested by the snapshot loader. Otherwise, the list would require eleven spaces.

The 'unloader' does not, in fact, work properly. It copies NULLs over the program manager. This, obviously, will cause any number of fatal errors to the current game and make it impossible to return to normal gameplay. Also, there is no capacity to reset the screen registers to default.


The Patch

The patch will reactivate full emulation support in GoldenEye.
The patch should be applied only to an uneditted, unbyteswapped (big-endian) North American GoldenEye ROM (NGEE). The GoldenEye Setup Editor can apply and byteswap the ROM for you, as well as recalculate the checksum. (Yes, that was a shameless plug.) It should run properly on hardware. Probably ;*)

You can download the patch via mediafire:

Don't pirate ROMs! In most countries you can legally make a backup copy of a cartridge and apply the patch to that. No direct links to ROMs of any kind, patched or otherwise. Respect the Fuzz!

Emulation can be triggered from the folder select screen after the Eye and title screens by pressing L+R on controller 3. To access each game, hold the button noted below on controller 3 as you press L+R. If no buttons are held or an invalid combination is used it will default to Cookie. For best results, hold the button for the game you want as you press L+R.
c left  Sabre Wulf
c right Atic Atac
c up  Jetpac
c down  Luna Jetman
+ left  Alien 8
+ right Gun Fright
+ up  Underwurlde
+ down  Knight Lore
A button Pssst
(default) Cookie
To end emulation at any time, simply press L on controller 1. It should return you to the folder select screen and allow you to continue to play normally. This also conveniently allows you to select another Spectrum game if you wish.

Here's a link to a video of the thing in action. Please keep in mind Nemu's running with some pretty shotty plugins to get the recording rate fairly high.


For those interested in how much code the patch affected, here's a brief summary.
  1. To hook the emulator in, eight lines were added into menu 5's interface to test for controller three. Room was allocated by condensing the usual control stick tests.
  2. A 2-byte fix was used to allow access to ROM filelist entry 0x2DF. This bug was only present in NGEE and corrected in later versions.
  3. ROM filelist entries were added for each snapshot and the program monitor. Since the monitor is necessary in this iteration of the emulator but is commandeering a snapshot entry, the unused text file LwaxJ has been overwritten with cookie.seg.rz. All other entries fill blank, unused placeholders.
  4. As previously mentioned, the file loader was limitted to the first five titles. This test was changed into a simple invalidity test. Changes were made in-place (crudely) and affect a total of five lines.
  5. Menu 25's initializer, used to determine which of the games should be loaded by testing the held buttons on controller 3, has been completely rewritten. Games are no longer had-coded to masks but use a table. A final NULL entry indicates the end of the list and simultaneously the index of the default snapshot. The masks used are identical to those used by Rare, with the exception of the default entry being overridden with the unregistered game Cookie. One line was also added to stop the main menu music.
  6. Within the controller mappings, L's assigned function no longer nullifies the program manager. It now calls the title object, returning to the previously-loaded menu 05 (folder select). This consists of four lines, replacing a loop and shortening the code generally.
  7. Although unneccessary, the Start button was mapped to mirror the A/B start game option for all titles.

Everything else is untouched, including all aspects of actual emulation. You are playing Rare's actual embedded Spectrum emulator and nothing else.


As always, disassemblies and disertations are always available. Comments, queries, and quirks can be reported either by email or at the Shooters Forever forums: http://www.shootersforever.com/forums_message_boards


Leave a Reply


GeostigmaShop Hot Items