Need help ripping sfiii3rd strike (non vgm format)

insertnamehere · Post by **insertnamehere** » 2017-11-23, 15:37:17

A day ago i asked in the chatbox if i cloud get some help for ripping the sfiii3rd strike (even if never ripped a videogame without a specialized software like vgmtrans), and it started a brainstorm, but i wanted to make a thread that would make centralised that discussion.
This game is not supported in the vgm, and i do not necessarly need the rip in vgm format anyway, so i will be happy with any other possible format.
I know that cps3 is not interesting because for this system there are only 6 games, 3 of these are street fighter 3, but i really like the sfiii3 soundtrack.
I wanted to do it myself, but i dont have the knowledge or the expirience to do it, so i ask if somebody cloud help me.

Thanks for listening.

Edit: somebody is saying that crt is doing this stuff with konami games, the time he is done i wanted to ask he wanted to help me too.
Edit 2: it was namco games, not konami.

l_oliveira · Post by **l_oliveira** » 2017-11-23, 16:05:40

It was NAMCO games, though.

The player is called "QUATTRO player" after Quattro Pro spreadsheet program NAMCO folks used to make the music sheets into.

Welcome aboard, by the way.

insertnamehere · Post by **insertnamehere** » 2017-11-23, 16:31:33

Oops, i will correct that.

ctr · Post by **ctr** » 2017-11-23, 23:27:36

On most arcade systems (CPS2, Konami games, Namco games, etc), the sound driver is running on a dedicated processor, making it easy to isolate the sound code and reverse engineer it. On the CPS3, everything runs on the main CPU, making it hard to isolate sound related code from everything else, and on top of that the main CPU runs encrypted code too!

nevertheless, I managed to find the sound driver working memory in RAM, which led me to find sample headers, music sequences and instrument tables in ROM. Reversing the sequence format and all that is a time consuming process, so I haven't bothered with that for now. All these memory addresses are as used in the MAME debugger, apply for 'sfiii3n', the Japanese No CD romset.

Code: Select all

CPS3 - Street fighterIII 3rd Strike
sfiii3n

Sound driver work area
02078ce4

Channel work area
02078d0c (116 bytes per channel)

Sample headers
0678c000 (16 bytes per sample)
  header + 0x00 : Sample start
  header + 0x04 : Sample loop offset
  header + 0x08 : Sample end offset
  header + 0x0c : Sample key

Instrument bank table ?
06788000 - 0678803f (32 bit pointers, 16 entries)
  bank + 0x00 : 16 bit offsets
  bank + 0x100 : instrument data

Tables
0660cd44
0660cdc4
0660ce44 : (LFO rate table from qsound sound driver)
0660cf44 : (Vibrato detph table from qsound sound driver)
0660d044 : (Tremolo depth table from qsound sound driver)

Song-related data
0678f000

Song table (first entry i don't know what is)
0678f000+0x08 song 1 offset
 song + 0x00 : global tempo or something
 song + 0x01 : channel 1 offset
 song + 0x03 : channel 2 offset
 ...
0678f000+0x0c song 2 offset
 ....

If you're feeling adventurous, you can start trying to figure out the sequence data by yourself. A hint is that the first song's first channel sequence begins at 0x67922f1. Use the MAME debugger's memory viewer to explore these addresses.

If you've used VGMTrans, you know that you can see the raw data from the song in a color coded format, this lets you easily see how the music data is typically structured. Take some notes from that and try to apply it here.

insertnamehere · Post by **insertnamehere** » 2017-11-24, 15:55:08

Hi ctr, and thanks for the help, actually i didnt know that vgmtrans had such options, and this is the first time doing something like this, but i kinda understand your chart/document, so i sorta know where to look at.
Not sure what i need to do though.
Edit: forgot to mention that i have a very basic assembly knowledge, im not the best candidad for this, but i will find a way to be useful, somehow.

Edit 2: in the service mode(in mame i entered it using f2), under the 7th option, i found that you can change the sound mode(?), in system configuration, form "JAMMA" to "EXTERNAL", does this mean anything?
(other that the fact that "EXTERNAL" sounds a lot better)

: An image of the sound test

Edit 3(yes, i edit a lot): in the sound test(option 3 of service mode), the order in which songs/sounds is shown as a 2 byte that goes from 0000 to ffff, even though it doesnt use them all, so at a certain point it loops.
Is it viable source for knowing the order of songs, or it is useless?
Because song 0001 is this song.

Edit 4(ok this is the last(maybe)): added an image i found interesting regarding the memory view of 0x67922f1, but i dont know, maybe its just me.

Every 8th line, there is a letter of the alphabet, and it has a command called extu.b.

ctr · Post by **ctr** » 2017-11-24, 19:08:56

insertnamehere wrote: Edit 4(ok this is the last(maybe)): added an image i found interesting regarding the memory view of 0x67922f1, but i dont know, maybe its just me.
memory viewer.JPG
Every 8th line, there is a letter of the alphabet, and it has a command called extu.b.
disassembly.JPG

The disassembly view is for checking CPU instructions, what i mentioned is not CPU instructions but rather sequence data. In the end it'll decode to something similar to MIDI. MAME does not have built in tools to convert this, so you need to figure out this by yourself. Also I suggest you set "1-byte chunks" in the memory viewer options, this makes it a little easier to read imo.

Anyway, to begin with, create a tracker module and add some samples. Then look at the memory viewer, find out which bytes correspond to the notes using a table like this (the notes may not be 100% like in that table, they may be transposed a few semitones or so) and add notes to the tracker module to test. Then find out which bytes correspond to note durations (usually but not always, lower values will correspond to quicker notes, an example 06 = 16th, 0c = 8th, etc). And finally, which bytes correspond to effects like tempo, LFO, instrument, loops, jumps, etc.

insertnamehere · Post by **insertnamehere** » 2017-11-24, 21:59:44

You mean import the simm3 files into an openmpt instrument?
because i did that, but the first song is actually a prerecorded song, chopped up every 4 bars(16 beats),at least until 0:14.
It plays fine in f#4(but i never got a 100 percent accurate sample rip, so i am not too trustfull)
f#4 is 42 in hex.
with mame, tried to write a dump.txt from 0x67922f1 to 067d1f71(where i found a bunch of zeros), but mame kept writing outside until it crashed.
later or tomorrow an edit with the ones i find interesting
Edit:

Code: Select all

interesting adresses
067927B1:  401616BF 41813F01 3FBF4281 3C013CBF
067927D1:  40BF4281 3C013CBF 43813701 37BB4583
06792861:  41813F01 3FBF4281 3C013CBF 43814101
06792871:  41BF4481 410141BF 41814001 40BF4281
06792A11:  01C77F01 9E3C1E1E D0BF3D81 420142BF
06792A21:  3E813F01 3FBF3F81 420142BF 40813F01
06792A31:  3FBF3D81 420142BF 3E813F01 3FBF3F81
06792A41:  420142BF 40813F01 3FD400FF E74001C2
06792A71:  3F814201 42BF4081 3F013FBF 3D814201

cant dump them in 1 byte separtion.
maybe i need a better way that using notepad...
i will try with mame or cheat engine
Edit 2:cheat engine didnt work...

but i somehow was able to trigger a channel by changing a specific, but inconsistent, adress containing c0 to 20...
it will always be in the 10000000 to 20000000 group, but i dont know.

ctr · Post by **ctr** » 2017-11-24, 22:33:40

Actually i suggest you use just a normal instrument, like piano or something. You want to identify notes first. once you've got that done, identifying durations and that stuff becomes much easier.

Also, if you just want to get samples, you can read the sample table which i described earlier. The values are just offsets into one of those simm files. Because MAME code is weird and sometimes illogical, you may have to byteswap the files to make the samples sound correct.

insertnamehere · Post by **insertnamehere** » 2017-11-24, 22:53:03

ah ok...
i will stick to shorter posts.
so its easier to read.
Edit: how do i propelly use the debugger's search function?

ctr · Post by **ctr** » 2017-11-25, 0:43:07

Try entering "help" in the debugger console.

insertnamehere · Post by **insertnamehere** » 2017-11-25, 1:00:01

i figured it out, but its a bit confusing, can't search from more that 1 address, maybe tomorrow i will do something about it, maybe more experts will come to give me additional help, im still a novice but i learned quite a bit...
or at least feel like i did...

insertnamehere · Post by **insertnamehere** » 2017-11-25, 12:37:21

so, i need to dump the midi, but mame won't let me do it, maybe i have to find an utility...
or analyze the data for the first sequence, is there any good midi analyzer that works with text?
...
im totally lost, maybe i need to have more expirience...
also, i try to search things, but it still does not work, tried online dociumentation, but no mention of it.

Edit: i was using cheat engine 6.6 and i found something

2017-11-25 16-52-55.zip: something i found on cheat engine; (531.68 KiB) Downloaded 1577 times

its a video where i casually discovered something(its a long story how i found it), maybe i found the player, where are described pitch and other things that i dont understand.
its also unreliable, as it changes everytime mame is rebooted, but it always stays in the 14000000 group.

ctr · Post by **ctr** » 2017-11-25, 18:59:00

You found this area. you can just go to it in the MAME debugger and mess with it there, as then it will always be in the same place. With cheat engine you're really not debugging the game but rather the emulator.

ctr wrote: Sound driver work area
02078ce4

insertnamehere · Post by **insertnamehere** » 2017-11-25, 19:36:07

ok, but i fell like the mame debugger is complicated...
didnt know how to use it, until i remembered that youtube is loaded with tutorials, but otherwise i found no site that mentioned how to use it...
and i dont understand how to change values in the memory editor, i need it to modify the song so i am sure what certain values control pitch, volume, vibrato, etc...

Edit: finding the pitch adresses, so, for analysing the song 1, i have at least what pitch the samples are playing, sorry it took so long to figure out what to do, when i will give you the specs of song 1, and how it works, can i give to somebody that can make a tool?
because im still a novice in terms of programming...

insertnamehere · Post by **insertnamehere** » 2017-11-25, 23:06:17

but i am totally lost on what i need to do.
i will try to do something, figure out everything, but not too sure if i can.
its open to who everybody wants to try to figure out how it works...

some info for ctr
mame on my pc runs slow when in debug mode...
to search the note variables, it takes 2-3 minutes, even if i specify a resonable search range, and even then, it almost freezes.
i found out that song 1 uses a instrument with chopped up samples, from the note 60 to 69, this is information i found with the sound driver area.
tried to search 60, i found adresses that where way too distant, not sure how to use the search function, i use it like "find 0x67922f1,0x6793631,1,60", and it goes as far as 0x6e5e424...
and it starts at 0x679f23d.