Tekken Tag Tournament
The largest of the six. System 12 has no BIOS, no CD, no SPU and no pads — so alongside the recompiled MIPS I had to build the board itself: the ROM bank window, Namco's ROM-DMA channel, the KEYCUS protection chip, and an H8/3002 sound sub-CPU driving a 32-voice C352 PCM chip. An instrumented MAME served as a bit-exact oracle so every subsystem could be proven against real behaviour rather than eyeballed.
- Five separate crash addresses were one bug. All of them resolved to a 46-entry
fighter-state jump table at
0x800104FCindexed by[S1+0x156]. Rather than assume the base, I confirmed it against six already-resolved switch cases before declaring the 39 targets. - The performance metrics were lying.
guestFps,pumpHzandpresentFpsall read counters the port itself drives, so they cheerfully reported 60 while the game actually ran at 12.gpuDmaHzwas the one honest number, and it exposed an exact 5:1 vsync lock that was also starving the AI. - Protection chip solved arithmetically. The "exploded fighter" corruption came down
to a single missing halfword from the KEYCUS chip; the constant
0x2651was derived from two table entries rather than brute-forced. - GPU decode corrected against real hardware: texture-page Y is two bits on this GPU, and CLUT Y is ten bits with bit 15 as the high bit — which is what finally made the portrait grid render.
- Audio built from nothing. The H8/3002 core ran 1.77 billion instructions with zero
unimplemented opcodes.
SHARwas doing a logical instead of an arithmetic shift, and the C352 loop/reverse flag mapping was proven correct by a 979-key-on census instead of being swapped on a hunch. - ROM-DMA made bit-identical to MAME across all 84 transfers.