Wince+CDDA

[pitito]

As some of you may know, a long time ago I released a fix to correct certain WINCE games that caused problems when converted to CDI.
This fix only solved those games in which the first track was always played
This fix is made on the IP.BIN
Offset
0x61C0
25C7 for 0900
Games tested
Nightmare Creatures 2 (Demul and Gdemu and CD) Working
Bust and Move 4 Working
Midway Greatest Arcade Hits 2 Working
Worms Armagedón Working
Spirits of Speed 1937 Working (Although the gdi does not load tracks in the race, but it does in menus)
Rainbow Six US NTSC Working (If you substitute in the Pal version 0winceos by the one of the Us ntsc version, cdda will also work in the Pal version)
Kiss Psyco Circus Working

Later I repaired the Armada, another one that had problems with the CDDA summary when pausing the game or entering a base.
The CDDA always reset itself.
Armada.exe file
Offset
0x1A348 change to 0900
0x1A360 change to 0900
0x1A540 change to 7F70

And now it's Worms Pinball's turn
This game did not have any CDDA tracks working, so I spent weeks trying to find where the problem came from and I was finally able to solve it.
FIX in Pinball.exe file
Offset
0x6728E change 04E7 to 00E7.
Note:
When applying the FIX, you will only have to put a single dummy track before the CDDA tracks when creating the mds or cdi image, so that the cdda starts on track 2 of the cd.
In this way they will appear ordered as in the GDI.

Next Tetris Online USA
FIX CDDA
IP.BIN HACK (BINHACK)
0x61C0= 25C7 to 0900
TETRISDC.EXE
0x3EBA2= 01E7 to 00E7
0x3EBAA= 04E1 to FFE1
There is no need to place dummy tracks.

Next Tetris PAL
FIX CDDA
IP.BIN HACK (BINHACK)
0x61C0= 25C7 to 0900
TETRISDC.EXE
0x3F11A= 01E7 to 00E7
0x3F122= 04E1 to FFE1
There is no need to place dummy tracks.

Possibly Sega Rally 2 and Virtua Cop 2 can be repaired with this method...
But the functions must be different and change their values, since a search to hexadecimal has been of no use in both games.

[ateam]

Great work, pitito!

[Loloretro]

Great, I wasn't able to offer a CDI when I released Worms Pinball

Thanks a lot for your work

[pitito]

It has been difficult but in the end it has been achieved

Now the only games that are missing for the CDDA to play in their CDI versions are Virtua COP 2 and Sega Rally 2 which have the same problem as Worms Pinball, although these are developed differently.
This type of wince has a type of protection called HDR (High Density Rom), which only looks for the CDDA in the High Density layer of the GDROM, for this reason it does not work in CDI versions.
In Worms Pinball, following the calls of Sound.dll I found ordinal function 179 of core.dll and overriding one of these calls made the CDDA play.
So when I investigated further, I found the value that determines the CDDA start track, all of this was done in the Pinball.exe executable.

In the case of Sega Rally 2 and Virtua COP 2 the function is the same.
The ordinal 179 of core.dll, but it is somewhat more complex, since in this case in addition to being found in the executable.EXE of the game there are also several .dlls such as MGAMEAUDIO.DLL, IECEUI.DLL and PLATUTIL.DLL that use that function .

[nuggetreggae]

Terrific work Pitito ... funny that games that have been broken forever getting fixed now, you're the man!!

[streeker]

Excellent work! Thanks a lot!
I've tested the fixes for "Armada" and "Worms Pinball" - both games work fine now.
Keeping my fingers crossed, that you'll also succeed with "Virtua Cop 2".

[MoeFoh]

Excellent work! Thanks a lot!
I've tested the fixes for "Armada" and "Worms Pinball" - both games work fine now.
Keeping my fingers crossed, that you'll also succeed with "Virtua Cop 2".

@streeker, can you post your CDI of "Worms Pinball" for us to download? Thanks!

[streeker]

It seems, that Laurent C has already updated the original release page. So, you can just grab a working .cdi from there: https://en.sega-dreamcast-info-games-pr ... pe-iso-gdi

[nuggetreggae]

Hi Pitito,
I noted with interest your statement "Possibly Sega Rally 2 and Virtua Cop 2 can be repaired with this method...
But the functions must be different and change their values, since a search to hexadecimal has been of no use in both games.
And started comparing and searching hex between your fixed worms and SR2. I searched code proceeding and after the fix hoping to hit actual cpu instructions instead of memory pointers (which obviously change). When i searched "0B40371F" SR2.EXE popped up at $45196 "04E70B40371F" and I thought "my god, it couldn't be??? and changed 04 to 00 but the boot hangs at the WinCE splash... Do I appear to be barking up the wrong tree, or is there some checksum check (next i'll change an 00 to 04 somewhere else in case it's a simple XOR check..... the code does look a little similar......

I'd love to learn how to view the code in these, either using disassembler, or is there emulator with debugger or whatever? The code looks weird, almost like microcode from the hex editor.

[pitito]

Hi Pitito,
I noted with interest your statement "Possibly Sega Rally 2 and Virtua Cop 2 can be repaired with this method...
But the functions must be different and change their values, since a search to hexadecimal has been of no use in both games.
And started comparing and searching hex between your fixed worms and SR2. I searched code proceeding and after the fix hoping to hit actual cpu instructions instead of memory pointers (which obviously change). When i searched "0B40371F" SR2.EXE popped up at $45196 "04E70B40371F" and I thought "my god, it couldn't be??? and changed 04 to 00 but the boot hangs at the WinCE splash... Do I appear to be barking up the wrong tree, or is there some checksum check (next i'll change an 00 to 04 somewhere else in case it's a simple XOR check..... the code does look a little similar......

I'd love to learn how to view the code in these, either using disassembler, or is there emulator with debugger or whatever? The code looks weird, almost like microcode from the hex editor.

Yes, it is possible that it can be fixed but there is something else...
Since both games handle their own .DLLs, so they are not common WINCE ones, such as MGAMEXXXX.DLL, in addition to the OLE32.DLL sound driver and some other dlls.
For example, the MGAMEAUDIO.DLL file controls everything related to the CDDA. This dll contains the track numbering control, which is the fix applied in worms pinball
Offset
0xB8A
04E7
If the value is changed in the GDI to 00E7, the track played is track 6 in both games and it still does not work in the CDI.
If I change the value to FE07, track 01 is played in the GDI, although only noise will be heard as it is a data track, but for a possible CDI it could be suitable to avoid placing fictitious tracks.
Although at the moment the CDDA still does not play.
All the calls to ordinal 179 or functions that are called by it, I'm almost sure that one could be the cause of the problem.
Although without leaving aside the calls to OLE32 which is the sound driver.
About the value you mention in SRALLY2.EXE...
Offset 0x3CEF6
If you change the value 04E7 to a lower value it freezes on boot, but if you deactivate the ordinal 179 from that place changing its call to "nop" the game will start although the cdda will still not play.