Hi,

The H8 bug is present in many chess computers from Saitek (since 1997, 28 years!):

Saitek Talking Chess Academy
Saitek Cosmos
Saitek Centurion
Saitek Cougar
Saitek Challenger
Saitek Expert Travel
Saitek Explorer Pro and Pewatronic Explorer Pro.


I began to work on it end of march with Cougar on Mame.
I first found the fun bug and fixed it in the first hour (Fun bug and H8 bug are not related).

I wrote the second week a "bizarre" as comment to the line generating the bug, but I moved on.
After checked the move generator and the very complex time management (partially because very scattered code) without result,
I found the origin of the H8 bug and I coding the patch may 28 for Cougar/Centurion (same rom).
This patch is 50% more long than the patch for AT time level for the Emerald Classic Plus, so it is necessary to change ... 3 bits!

Since I have fully understood the origin of the bug, I can confidently guarantee that this patch will fix all other chess computers
with the H8 bug (after finding the right offsets), and this without even having seen their program yet.

This bug stop quickly the search when a piece in h8 (necessary condition but not sufficient), so always be suspicious when the computer
reply with a bizarre move from h8 in less than 2 seconds.
Another point confirmed : the bugged code is not used with checkmate levels.

The patch for the H8 bug and Fun bug together (only for Cougar/Centurion, as no others roms are available):
The understanding of the bug give a solution (but with wasted time) for the bug with a real chess computer (or emulation without patched rom).
if no castling is possible, you can translate the position with a vertical symetry (h8 to a8, h7 to a7..) with the same color for pieces and
color to move, without a piece of the color to play in h8 (formerly in a8).
If this is the case or castling exist, the last solution is to create the same position with color of pieces and color to move exchanged (so a white queen in
h8 become a black queen in a1).

To Saitek : Now you can make new chess computers without H8 bug ;-)


Cordialy,

mychess.

Hallo Mychess..

Mein Englisch ist nicht so gut , daher schreibe ich in Deutsch.
Habe da eine Frage...
Wäre es dann auch möglich, dem Mark 3 die Rochade erneut beizubringen, nachdem eine korrekte Stellung eingegeben wurde?

Viele Grüße
Mark 1

Hi Mychess,
great job - a lot of work for only 3 bits!

Question 1: we have many H8 engines in CB-Emu - don't any other of these engines (apart from Centurion/Cougar) have this H8 bug?

Question 2: there's a difference in the Fun level bugfix between the 2 versions you've posted in your first thread and today:
66d0 : 7F 52 72 60 41 62 7F 52 72 70 5A 00 50 62 (from 31.03.2025)
66d0 : 7f 52 72 60 41 50 7f 52 72 70 5a 00 50 62 (from today)
So which one is correct?

Regards,
Franz

__________________
Meine Webseite: https://fhub.jimdofree.com/

Hi Fhub,


Question 1 : The list of computers with H8 bug come from Spacious-Mind : https://hiarcs.net/forums/viewtopic.php?f=1&t=6021,
so no doubt !

Question 2 : Both are correct, this byte is a dummy byte for checksum control when you power on the computer.
In the new version, it is modified to take account of the patch for H8 bug.

Code:

patch for H8 bug   :  3288 : 6b01 fe60 1c19
patch for Fun bug  :  505e : 5a00 66d0                                    
                      66d0 : 7f 52 72 60 41 50 7f 52 72 70 5a 00 50 62

Cordialy,

mychess

Hi Mychess,
ok, but there's still one thing that I don't understand with your Fun-level bugfix:
66d0 : 7f 52 72 60 41 50 7f 52 72 70 5a 00 50 62
I've disassambled the code at this address with the debugger and got:
Since I don't understand H8 assembly code I've searched the Internet for the H8 instruction set and found, this 'bf' (at 66D4) means 'branch if false' - but I don't know 'if WHAT is false' (I guess it's usually any condition/compare before this command)!?

Now I wonder why did you put this 'checksum correction' byte(s) 41 50 WITHIN your bugfix code - couldn't it happen that this 'WHAT' condition is indeed false when this code is executed, and in this case the program would jump/branch to an address (6726) with no valid code?
So why didn't you just put these correction bytes (41 50) at the end of your bugfix code, which would definitely never be executed?

Regards,
Franz

__________________
Meine Webseite: https://fhub.jimdofree.com/

Hi Fhub,


You can put the good byte for a good checksum at the end of the patch.
However, a curious programmer (Fh..) could be astonished by a byte never adressed by the patch.

So I prefer to use a dummy short instruction (yes, with 2 clocks CPU lost) with the good byte as immediate value.
The BF is a "branch never", as BT is a branch always, without testing any code condition.
So 41 50 is a 2 clocks cpu lost instruction who only make PC = PC+2, and 50 is the byte for a good checksum.

You can make a best performance patch with :

66D0: 7F52 7260 bclr #6, @h'ff52
66D4: 7F52 7270 bclr #7, @h'ff52
66D8: 5A00 5062 jmp h'5062
66DC: 91 ; (41+50)

Cordialy,

Mychess

Yes, I'm a VERY curious programmer!
Ok, now I understand that this jump is never done.
But what is an instruction BF good for, when it actually never does anything?

The 2 clocks CPU lost is of course no problem, because I think this bugfix code is only executed when the user changes the level (to or away from a Fun level).

__________________
Meine Webseite: https://fhub.jimdofree.com/

And from your "66DC: 91 ; (41+50)" I guess the program uses only a 1-byte checksum, correct?
Then why not just change the checksum byte instead of adding such a dummy byte?

__________________
Meine Webseite: https://fhub.jimdofree.com/

Yes, only a one byte checksum.
However, the checksum is not stored, it should be 00, so I add a byte to obtain 00.

Another solution would be to delete the checksum call from the rom, but I'm follower of "Entia non sunt multiplicanda praeter necessitatem", or principle of parsimony.


Cordialy,

Mychess

Well, a 1-byte checksum is a quite simple method - how does the program react when it detects a wrong checksum?
I remember such a situation for any other ROM that I've patched, and it actually returned an error message (I've just skipped this error routine).

__________________
Meine Webseite: https://fhub.jimdofree.com/