Start Here
This series documents the reverse engineering of Marvel vs. Capcom 1 on Capcom's CPS-2 arcade hardware. The work progresses from initial binary analysis through ROM expansion, custom diagnostics, and cross-architecture audio injection. Each post builds on discoveries from previous ones.
Target system: CPS-2 arcade board (1998). Motorola 68000 CPU @ 11.8 MHz, Z80 sound CPU @ 8 MHz, QSound DSP, 8-way interleaved GFX ROMs, hardware-encrypted program code.
Prerequisites: Comfort reading hex dumps, basic familiarity with assembly concepts, general understanding of memory-mapped I/O.
Reading Order
1. Reverse Engineering a UI State Machine from Compiled Binary
What: How do you understand a binary's entity system with no source code? Documents the forensic techniques for mapping character IDs, cursor navigation tables, and three distinct secret character table formats.
Key discoveries: Character data table at $065CCA (32 bytes/entry), player structures at $FF3000/$FF3100, unlock flags at $FF803C-$FF804C, three secret table types (A/B/C) with different formats.
2. Binary Forensics: Recovering an Unreleased Character
What: Using the entity system knowledge from Post 1, systematically scan for hidden content. Found 85 code references for character ID 0x2E (Armored Spider-Man), 4 conditional load points, and evidence that this character was planned but disabled before shipping.
Key discoveries: BEQ-guarded load points at $06DC76, $096B86, $0A8A9E, $0BAD8E. False positive filtering for IDs 0x30/0x32 (opcode 0x303C). All 4 secret character load functions decompiled to C.
3. Injecting New Behaviors into a Binary Without Source Code
What: The engineering plan for re-enabling Armored Spider-Man. Covers ROM patching strategy, 68000 assembly injection, palette engineering (RGB444), and input sequence state machines. (Status: the Armored Spider-Man plan was later retired -- the $2E slot pivoted to a Dark Sakura port from MSHvSF; the techniques remain valid.)
Key techniques: Position check patching in expanded ROM space ($0F1000+), palette swap via CPS-2 RGB444 format, proposed 10-input directional code.
4. CPS-2 Maximum Memory Model & Expansion
What: Expanding every ROM type to hardware theoretical limits. GFX ROM files from 32MB to 128MB, Audio from 8MB to 16MB, Program from 1MB toward 4MB. Built a fully automated Python pipeline. (Corrected July 2026: padding is file-level only -- the stock emulator masks GFX at 32MB and QSound at 8MB. The genuine cap-break, 64MB GFX + 16MB QSound, came via a custom FBNeo core; see the post's Editor's update.)
Key techniques: 8-way GFX ROM interleaving, transparent padding (0xFF for GFX, 0x00 for audio), GOLD marker verification, MAME compatibility.
5. Runtime Verification via Test Menu Injection
What: Embedding a 22-line diagnostic screen into the game's F2 Test Menu using 68000 assembly. Proves every claim from the documentation by running verification on the target hardware.
Key techniques: Hardware-polled input, dual OBJ bank clearing, VRAM tile fix, sound test with live QSound programming, interrupt-disabled display.
6. Cross-Architecture Audio Injection
What: The most advanced post. Porting MvC2 Dreamcast soundtrack to CPS-2 by building a multi-bank streaming engine in Z80 machine code, with QSound DSP programming and a custom 68000 sound test interface.
Key techniques: Z80 dispatch table hook, ISR exit hook for bank-advance streaming, QSound register programming (int16_t constraints), 68000 sound command range extension.
Supporting Posts
Making Reverse Engineering Work Reproducible
What: Meta-post on methodology. How to structure RE work so both humans and AI can execute it. The "observe → instrument → validate → automate → publish" loop.
Platform Architecture: Next-Gen Emulator with Metal + ML
What: Architecture specification for a development platform that combines Apple Metal rendering, CoreML/PyTorch inference for AI opponents, and massively parallel headless training. The CPS-2 work validates why these tools matter.
Project Status (updated July 2026)
| Component | Status |
|---|---|
| ROM expansion (148MB file set) | Complete at file level; addressable expansion (64MB GFX + 16MB QSound) via custom FBNeo core |
| ULTRA SETTINGS diagnostic screen | Complete |
| Audio injection (5 MvC2 tracks) | Complete at ROM level (banks past 8MB playable only under custom core) |
| Multi-bank streaming engine | Complete (Z80 hook + ISR streaming) |
| Character ID 0x2E forensics | Complete |
| Secret table forensics (3 types) | Complete |
| Armored Spider-Man injection | Retired -- the $2E slot pivoted to a Dark Sakura port (MSHvSF, char-id $2A there) |
| Cross-game character import | Active -- Dark Sakura is a same-generation direct table port (byte-identical anim/frame tables) |
| Stage soundtrack replacement | Planned |