GoldenEye’s hidden ZX Spectrum 48x emulator

Unbeknownst to the world, retail versions of GoldenEye contain a ZX Spectrum 48x emulator, merely lacking a program monitor and user access. This video displays the results of a nifty little patch to re-enable the content. In total, nine games are embedded. Each is mapped to keypresses on controller 3. The original access point couldn’t be determined, so now you load the games while on the folder select menu (menu 5).
c left Sabre Wulf
c right Atic Atac
c up Jetpac
c down Lunar Jetman
+ left Alien 8
+ right Gun Fright
+ up Underwurlde
+ down Knight Lore
A button Pssst
(default) Cookie

The video displays short sections from each of the games. (Forgot to map the A button, so Pssst won’t appear in this video.) The emulator is fully-compartmentilzed so you can leave, load another game, or play GoldenEye normally.

The emulator was a side-project of one of the programmers, experimentally inserted in the current game under production to see if Spectrum emulation on the N64 was possible. Access to it was removed before release, but the emulation code itself remained embedded, much like debug and devtool support, within a large chunk of assembly code. The patch, exclusively for the North American release (NGEE), is available here:
http://www.mediafire.com/download.php…

Don’t pirate ROMs! In most countries you can legally make your own backup copies and apply the patch to those. No direct links to ROMs of any kind, patched or otherwise. Respect the Fuzz!

+_+

Update:
Steve Ellis, who originally created the emulator, sent an email to clarify how the original Spectrum ROM was set up. Since it wasn’t included and the copyright has been lifted by Amstrad I’ve included the complete one with the patch. If there is any further issue I’ll reduce it to a copyright-unrestricted version.
Here’s the letter though, and be certain to check out Crash Lab. Really!

“Hi,
I see various posts about this on the web now. I thought I’d clarify the point about spec_rom.seg.rz – the contents of this file fill the bottom 16kb of the Spectrum’s memory. On the original Spectrum, the bottom 16kb would have included the whole operating system (the BASIC programming language, functions for loading from and saving to cassettes, etc.). Since the ROM is copyrighted we weren’t able to use it. However, some of the games that we were emulating wanted to call one or two Spectrum ROM functions. The solution to this was to create an empty ROM (99.9% filled with NOP’s), but with newly-created (copyright-free) replacements for the few short functions that the games needed to call. The games should run with this minimal replacement ROM.

BTW, if you’d like to send any people in the direction of @CrashLab or facebook.com/CrashLab, I’d be grateful. We’re going to release something later this year that hopefully should appeal to fans of “old-school” games.

Regards

Steve Ellis
Crash Lab

www.crashlab.co.uk
www.facebook.com/CrashLab
www.twitter.com/CrashLab

+_+

Check the thread at:
http://www.shootersforever.com/forums…
For Steve Ellis’s letter and a snippet debunking DK64 Spectrum emulation.

Also, check out Steve’s latest venture at Crash Lab. Expect some great stuff out of there!

So I thought I’d have some fun with jsmips

Hello World!

Hello World!

The Javascript MIPS emulator.. So after snagging the source, and all went well building the binutils, gcc, then gcc again, the libc. All seemed well except I couldn’t work out exactly what goes where…

So after a bunch of messing around I managed to get it run..  kind of.  I think the php file that proxies the filesystem is broken as I get something like this from the now broken main js page..

function genroot(p){var dir=new Directory(p);function genbin(p){var dir=new Directory(p);dir.children["=listusers"]=remoteFile("./bin/listusers","http://codu.org/jsmips/server/dir.php?f=.%2Fbin%2Flistusers");dir.children["=apropos"]=remoteFile("./bin/apropos","http://codu.org/jsmips/server/dir.php?f=.%2Fbin%2Fapropos");dir.children["=banner"]=remoteFile("./bin/banner","http://codu.org/jsmips/server/dir.php?f=.%2Fbin%2Fbanner");

And yet I get this kind of output:

{error: false, type: ‘d’, cont: [“dtextc.dat+”,”hi+”,”var/”,”hi.c+”,”source/”,”bin/”,”dungn27s.zip+”,”dungeon+”,”./”, “../”]}

Which.. isn’t right enough.  I’m not sure what is up with dir.php ..

Oh well, I was able to build a simple hello world type program, but anything that hopes to pull data off the drive won’t work.  If anyone thinks they can do better my archive of all the bits is here (48MB), and the ‘runnable’ version is here .. hi is about as much fun as it’ll get.

Windows NT 4.0 MIPS on Qemu 1.1.1 (OS X)

I’ve got to find a way to build Qemu for Win64, it looks like the only way for it to produce anything other than trivial hello world applications is to cross compile on linux.. which no doubt will need a billion dependencies…

But in the interim the MIPS emulator in Qemu 1.1.1 has made a bunch of progress and can install & run NT 4.0 without any issues!

There are a few things to look out for, the first is that you have to specify a NVRAM image file to keep it persistant across instances. And you need to ‘expand’ it beyond the definition size to get things like the MAC address to be stored.

./qemu-system-mips64el  -L . -M magnum -hda MIPS.disk -net nic -net user  -global ds1225y.filename=nvram  -global ds1225y.size=8200

And by default the Qemu MAC address to configure within the Magnum BIOS is 525400123456 ..

Windows NT 4.0 MIPS on Qemu 1.1.1 on OS X

I’ve been able to download & install Internet Explorer 3, and Quake World.. And even connect up to quake.xs4all.nl and it worked!

One thing I’d advise is to copy the directory OS\WINNT40 on the system partition to OS\NT to make it that much easier to re-add the boot statement, if you have to go down that road.

ARC boot statement

As always, special thanks to Herve Poussineau for making all of this possible.

RetroBSD!

2.11 BSD Unix for PIC32, build #826:
     Compiled 2011-08-07 by [email protected]:
     /Volumes/Users/vak/Project/retrobsd/trunk/sys/pic32/compile
phys mem  = 128 kbytes
user mem  = 96 kbytes
root dev  = (0,0)
root size = 16384 kbytes
swap size = 2048 kbytes
standard daemons: update.
Sun Aug  7 16:47:45 PST 2011

2.11 BSD UNIX (pic32) (console)

login: root
Password:
Welcome to RetroBSD!
# _

Wow isn’t that cool? Who needs a ‘basic stamp’ if you can have UNIX!  Not to mention it’s from Serge Vakulenko, of DEMOS fame!

From the main site:

RetroBSD is a port of 2.11BSD Unix intended for embedded systems with fixed memory mapping. The current target is Microchip PIC32microcontroller with 128 kbytes of RAM and 512 kbytes of Flash. PIC32 processor has MIPS M4K architecture, executable data memory and flexible RAM partitioning between user and kernel modes.

Main features:

  • Small resource requirements. RetroBSD requires only 128 kbytes of RAM to be up and running user applications.
  • Memory protection. Kernel memory is fully protected from user application using hardware mechanisms.
  • Open functionality. Usually, user application is fixed in Flash memory – but in case of RetroBSD, any number of applications could be placed into SD card, and run as required.
  • Real multitasking. Standard POSIX API is implemented (fork, exec, wait4 etc).
  • Development system on-board. It is possible to have C compiler in the system, and to recompile the user application (or the whole operating system) when needed.

Internet Explorer 3.0 for the MIPS.

I got a tip that there actually was a version of Internet Explorer 3.0 for the MIPS. I was thinking there was no way, as there was no mention of this thing as IE 3.0 came out after the MIPS had been dropped from the roster.

Well luckily it turns out to be true.

The original download link is here, and I’ve mirrored it here.

Who knows what other things are out there for the MIPS?

Javascript MIPS

Hot on the heels of the javascript 80386 emulator, I found this javascript MIPS syscall emulator, jsmips.

What is cool about this one, is that commands are downloaded on demand.  And it supports more browsers, like Internet Explorer (well modern ones, IE 5.5sp2 didn’t work).

Vi works, but you’ll need to reset the terminal afterwards.  At least with this on demand filesystem it’d make it easier to add new binaries…

It’s amazing how far the world of javascript has come, but at the same time, it’s scary how precarious it is perched on browsers where stuff only seems to work at the moment and on select browsers.  But then that’s the way things seem to go.

 

 

Microsoft Giano and NetBSD 4.0.1

Well using the link at Microsoft, I managed to get NetBSD installed. Don’t forget you’ll need a new version of putty that supports serial ports, and connect it to \\.\pipe\USART0 when requested by the simulator. I always get a C++ exception, that I just ignore and let it keep on chugging.

So for the curious, here is a bootlog….

NetBSD/emips 4.0.1 Netboot Bootstrap, Revision 1.0
([email protected], Mon Aug 9 00:23:36 PDT 2010)

Default: 0/ace(0,0)/netbsd
boot:
Loading: 0/ace(0,0)/netbsd
2694960+177944 [152192+143455]=0x305cf4
Starting at 0x80020000

memory segment 0 start 00000000 size 10000000
memory segment 1 start 10000000 size 00100000
Too much memory in cluster 1, trimming memory to range 10000000..10000000
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.

NetBSD 4.0.1 (GENERIC) #137: Fri Dec 17 00:21:13 PST 2010
[email protected]:/usr/obj/sys/arch/emips/compile/GENERIC
Xilinx ML50x (eMIPS)
total memory = 256 MB
avail memory = 247 MB
timecounter: Timecounters tick every 62.500 msec
mainbus0 (root)
cpu0 at mainbus0: Microsoft eMIPS CPU (0x70401) Rev. 1 with software emulated floating point
cpu0: 64 TLB entries
ebus0 at mainbus0
eclock0 at ebus0 addr 0xfff80000: eMIPS clock
timecounter: Timecounter “eclock” frequency 10000000 Hz quality 2000
dz0 at ebus0 addr 0xfff90000: neilsart 1 line
ace0 at ebus0 addr 0xfff50000 : System ACE
ace1 at ebus0 addr 0xfff50100 : System ACE
enic0 at ebus0 addr 0xfff10000: eNIC [16 16], address 00:03:ff:e1:5e:ea
icap0 at ebus0 addr 0xffed0000: Internal Configuration Access Port
epio0 at ebus0 addr 0xfff60000: GPIO controller
gpio0 at epio0: 32 pins
flash0 at ebus0 addr 0xfffb0000 base f0000000: 8MB flash memory (2 x StrataFlash 28F320)
lcd at ebus0 addr 0xfff40000 not configured
evga at ebus0 addr 0xfff20000 not configured
ps2 at ebus0 addr 0xfff30000 not configured
ac97 at ebus0 addr 0xffef0000 not configured
timecounter: Timecounter “clockinterrupt” frequency 16 Hz quality 0
flash0: 8192 KB, 1 cyl, 1 head, 16384 sec, 512 bytes/sect x 16384 sectors
ace0: drive supports 255-sector PIO transfers
ace0: card is
ace0: 2048 MB, 128 cyl, 1 head, 32768 sec, 512 bytes/sect x 4194304 sectors
ace1: drive supports 255-sector PIO transfers
ace1: card is
ace1: 4460 KB, 0 cyl, 1 head, 32768 sec, 512 bytes/sect x 8920 sectors
boot device: ace0 part0
root on ace0a dumps on ace0b
root file system type: ffs
dzparam: c_ispeed 9600 ignored, keeping 38400
Sat Mar 19 21:10:50 GMT 2011
swapctl: adding /dev/ace0b as swap device at priority 0
Checking for botched superblock upgrades: done.
Starting file system checks:
/dev/race0a: file system is clean; not checking
/dev/race0d: file system is clean; not checking
/dev/race0e: file system is clean; not checking
/dev/race0f: file system is clean; not checking
Setting tty flags.
Setting sysctl variables:
Starting network.
/etc/rc: WARNING: $hostname not set.
IPv6 mode: host
Configuring network interfaces:.
Adding interface aliases:
Building databases…
Starting syslogd.
Checking for core dump…
savecore: no core dump
Mounting all filesystems…
Clearing /tmp.
Checking quotas: done.
Setting securelevel: kern.securelevel: 0 -> 1
Starting virecover.
Starting local daemons:.
Updating motd.
postfix: rebuilding /etc/mail/aliases (missing /etc/mail/aliases.db)
newaliases: warning: valid_hostname: empty hostname
newaliases: fatal: unable to use my own hostname
Mar 19 17:11:08 postfix/sendmail[402]: fatal: unable to use my own hostname
Starting inetd.
Starting cron.
Sat Mar 19 17:11:09 EDT 2011

NetBSD/emips (Amnesiac) (console)

login: root
Mar 19 17:11:14 login: ROOT LOGIN (root) ON console
Last login: Sat Mar 19 17:04:07 2011 on console
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.

NetBSD 4.0.1 (GENERIC) #137: Fri Dec 17 00:21:13 PST 2010

Welcome to NetBSD!

Terminal type is vt100.
We recommend creating a non-root account and using su(1) for root access.
#

It’s not very often you see any UNIX originating from Microsoft* (Yes I know .. Xenix) anyways it does boot, and to save anyone interested, I’ll spare you the 1.5 HOUR long install and give you my disk image.

Speaking of which, it’s SLOW. I mean S-L-O-W.

Also as a side note, here is how to mount a CD-ROM ISO image…

mount -t cd9660 /dev/ace1c /mnt

At any rate, the speed just isn’t there for any real usage.

Microsoft Giano

I stumbled across this the other day, Giano, a simulation framework.

Included is a bunch of stuff, like a basic x86 / cepc (with Windows CE 6.0 image), an Xbox 360 emulator, a SPOT emulator, some eval boards (AT91EB63?) with both MIPS and ARM cpus that even include a doom kernel like experience! A Macintosh G5 (I wonder if it’d boot with Apple ROMS..?) Oh and..

A VAX.

The VAX code is taken from SIMH but I guess to show how extensible the framework is, they mashed in enough microvax to get it going.

SIMH in a way you’ve never seen it…

At any rate, here is some other screen shots of Giano in action….

CEPC

xbox 360 alpha test

xbox360 console

And of course….

Giano MIPS doom

DOOM

Also buried in there is a new MIPS variant, the emips along with a donated NetBSD port!

Sadly I had no luck running NetBSD….

Default: 0/ace(0,0)/netbsd
boot: 0/ace(1,0)/netbsd
Loading: 0/ace(1,0)/netbsd
5085072+70448=0x4eae14
Starting at 0x80020000

memory segment 0 start 00000000 size 10000000
memory segment 1 start 10000000 size 00100000
Too much memory in cluster 0, trimming memory to range 00000000..08000000
Too much memory, ignoring memory range 10000000..10100000
pmap_steal_memory: seg 0: 0x50b 0x50b 0x7fff 0x7fff
pmap_steal_memory: seg 0: 0x54b 0x54b 0x7fff 0x7fff
pmap_steal_memory: seg 0: 0x54d 0x54d 0x7fff 0x7fff
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007, 2008, 2009, 2010, 2011
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.

NetBSD 5.99.48 (RAMDISK) #0: Tue Mar 15 01:01:14 UTC 2011
[email protected]:/home/builds/ab/HEAD/emips/201103142200Z-obj/home/builds/ab/HEAD/src/sys/arch/emips/compile/RAMDISK
Xilinx ML50x (eMIPS)
total memory = 128 MB
avail memory = 120 MB
sysctl_createv: sysctl_create(no_sa_support) returned 22
mainbus0 (root)
cpu0 at mainbus0: Toshiba or Microsoft eMIPS CPU (0x70401) Rev. 1 with software emulated floating point
cpu0: 64 TLB entries
ebus0 at mainbus0
pid 0(system): trap: cpu0, TLB miss (load or instr. fetch) in kernel mode
status=0x2000000, cause=0x8, epc=0x8002d5c8, vaddr=0xd0000000
tf=0x8054cc78 ksp=0x8054cd18 ra=0x8002d5b8 ppl=0xd0000000
kernel: TLB miss (load or instr. fetch) trap
Stopped in pid 0.1 (system) at 0x8002d5c8: lw v0,0(s0)
db>

Maybe someone else will have better luck.

— edit, it seems Microsoft has a NetBSD 4.01 download, here. And it boots!

Windows NT 4.0 MIPS revisited

MIPS at it's best

MIPS at it’s best

Over the last few days, I’ve received a few ports of some software for Windows NT 4.0 MIPS, that I am sure the rest of everyone will be interested in.

The first one provided by nandhp is lynx, the text mode browser! While it may not seem like a super big deal, it *IS* a http 1.1 compliant browser, and it is more useful then Internet Explorer 2.0.

The next, also by nandhp is putty! So now you can ssh out into the world!

I’ve also received unzip & gzip for handling compressed files.. .No word on a tar yet. For now I’m using gnutar for MS-DOS.

And finally I took my quakeworld for MS-DOS with some of the SDL parts merged in to provide a preliminary QuakeWorld for the MIPS.

What is more cool, is that there is still people out there playing Quake. I suspect the non intel numbers are pretty low.

At any rate, enjoy!

Net Hack wiki moved

I just received notice that the NetHack wiki has now moved and the new site is nethackwiki.com.

It’s great when old software just doesn’t revive for a little while then fade back to obscurity, so update your links, or just browse the site and be blown away by all their information on such a great (and difficult) game.

And of course, I have NetHack for the Windows NT 4.0 MIPS, and various 4.X BSD on sourceforge under the package tapes….