03232: thoop: Black screen when you continue on 4 stage

ID	Category [?]	Severity [?]	Reproducibility	Date Submitted	Last Update
03232	Crash/Freeze	Critical (emulation)	Always	Jun 2, 2009, 20:16	Dec 14, 2021, 21:46

Tester	umbrio	View Status	Public	Platform	MAME (Self-compiled)
Assigned To	Haze	Resolution	Fixed	OS
Status [?]	Resolved			Driver	gaelco/gaelco.cpp
Version	0.131u3	Fixed in Version	0.239	Build
		Fixed in Git Commit	edc0dfb	Github Pull Request #

Summary	03232: thoop: Black screen when you continue on 4 stage
Description	when you are defeat on 4 stage ( lose all your lifes) and you push continue the game the screen put on black.
Steps To Reproduce	1-reaches the 4th stage 2-lose all your lives 3-Continue the game (push start before the count reaches to 0)
Additional Information	any times in 4 stage when you lose one life also appear the black screen
Github Commit

Flags	Verified with Original, Verified with Code
Regression Version
Affected Sets / Systems	thoop

Attached Files	thoop.zip (134,258 bytes) Jun 3, 2009, 09:08

No.04442 Kale Developer Jun 3, 2009, 00:24 edited on: Jun 3, 2009, 00:25	Could you please post an inp about this issue? This game ranks pretty high in my list of frustrating games and I don't want to learn to play it ;-)
No.04444 umbrio Tester Jun 3, 2009, 09:10	in inp attached the black screen appear when i lose a life in 4th stage.
No.04445 Tafoid Administrator Jun 3, 2009, 12:08	I'm able to confirm with attached .INP. Thank you for submitting it.
No.04456 umbrio Tester Jun 5, 2009, 14:03	This bug is still in version 131u4, but although the game does not officially support the savestates I created one using an earlier version of mame that the game does work and when I use this savestate in 131u4 the game works perfectly (never reappears the black screen). can i upload the savestate or he include info with copyright?
No.14203 Kale Developer Oct 3, 2017, 16:05	On dying at stage 4 it jumps to 20002500: add.l D5, INVALID 31 Which is already invalid on a plain m68k, apparently something corrupts the stack. Maybe a vram encryption issue?
No.14204 Haze Senior Tester Oct 3, 2017, 18:37 edited on: Oct 3, 2017, 18:38	or just an original game bug, since it apparently requires you to reach stage 4 on 1 life, it might have slipped by testing. so far nobody has been able to acomplish that on a PCB to tell me if it happens there also there could be undumped revisions, if this recent Gaelco work has shown anything it's that there are a lot more revisions of the games out there than we had.
No.14205 Fortuna Tester Oct 3, 2017, 20:22	Bug aren't not a bug? Or probably little problems with the protection?
No.16038 MetalGod Senior Tester Jan 16, 2019, 12:42 edited on: Jan 18, 2019, 19:52	Tested on mame 0.205 The bug still exists and it doesn't require any condition once stage 4 is reached. I've had a black screen after losing one life right at the beginning of the fourth level. No need to continue before or after that, so the "steps to reproduce the problem" here are wrong. No matter how many lives I lost on previous levels or how many times I continued. I made it to the fourth stage, lost one life and got black screen. I doubt this is pcb behaviour. Here's my full gameplay untill the error. Could it be related to 06027 ?
No.16408 Glacius Tester May 2, 2019, 22:04	quote: so far nobody has been able to acomplish that on a PCB to tell me if it happens there I have recently played this game on an original cabinet/board, and I reached level 4 with no lost lives. Then at this level I began to lose lives and got a game over, but I never got a black screen. The bug seems not present in the original.
No.17291 Dumple Tester Dec 23, 2019, 02:27	I observed this bug in 0.216. Zones 1-3 work normally, but death in zone 4 or in zone 5 led to a black screen. (That was true whether losing last life or first life).
No.17316 arcade addict Tester Jan 3, 2020, 14:09 edited on: Jan 3, 2020, 14:09	I thought it worth a mention that if you use the stage select cheat and start the game on level 4 or 5 rather than playing through all the previous levels first you dont get the black screen issue when you lose a life or continue.
No.19414 Haze Senior Tester Nov 3, 2021, 01:25 edited on: Nov 3, 2021, 01:35	I've been looking into this a bit more. If you kill yourself on the spike at the end of the stage 3 boss, as it is also dying, the game doesn't appear to crash when you die on stage 4. this almost suggests some issue with the transition sequence between the stages which does not play if you die on stage 3
No.19505 Haze Senior Tester Nov 28, 2021, 16:03 edited on: Nov 28, 2021, 16:03	wp FFD2E1,1,w (can monitor for level changing to 3) fill ffe08e,1,00 (to clear ffe08e to 00) the value in ffe08e gets set to 27, if it's 27 and you die, the game crashes. you can set it to 27 at any point during the game, and if you die, the game will crash. any other value seems fine needs more digging. this could easily be some extra 'protection failure' flag.
No.19506 Haze Senior Tester Nov 28, 2021, 16:14	set by code at c368
No.19507 Haze Senior Tester Nov 28, 2021, 16:24 edited on: Nov 28, 2021, 16:24	16d00 contains an explicit check against the value being 0x27, this code, unsurprisingly, triggers when you die.
No.19510 Haze Senior Tester Nov 28, 2021, 23:33	also this happens way back in 0.104 which is the first major release this was marked as 'working' so I'm not sure where the claim otherwise is coming from, unless a cheat was used in the making of that state?
No.19512 Haze Senior Tester Nov 29, 2021, 11:33	I think it is still some kind of protection, kinda wondering if it's going to come down to timing of the vram encryption, or some edge case behavior. The code doing these checks, and setting the flag in RAM appears to be intentionally obfusicated 00C334: move.l A4, -(A7) 00C336: cmpi.b #$3, $ffd2e1.l 00C33E: bne $c36c 00C340: lea $ffde79.l, A4 00C346: adda.l #$214, A4 00C34C: tst.b (A4) (ffe08d) 00C34E: bne $c36c 00C350: cmpi.b #$5, $ffdc45.l 00C358: bne $c36c 00C35A: addq.b #1, (A4) 00C35C: lea $ffc92b.l, A4 00C362: adda.l #$1763, A4 00C368: move.b #$27, (A4) (ffe08e) 00C36C: movea.l (A7)+, A4 note, the 00C340: lea $ffde79.l, A4 00C346: adda.l #$214, A4 to get ffe08d and 00C35C: lea $ffc92b.l, A4 00C362: adda.l #$1763, A4 to get ffe08e there's no real reason to do that unless you want to hide those addresses from somebody studying the disassembly.
No.19513 Robbbert Senior Tester Dec 1, 2021, 13:53	See discussions about possible remedies.. https://github.com/mamedev/mame/pull/8903 https://github.com/mamedev/mame/pull/8916