How to make Capcom Play System 1/2 emulator option.


For example, consider Final Burn Alpha


CPS1/2 memory map:

Work RAM is FF0000-FFFFFF (64Kb) like in Sega Genesis.


We'll find a zero address on known address of parameter:

Game: Captain Commando

Known address of parameter: Time in player select (exact value) integer 1 byte 00FF9275

We need to find an equivalent PC address , then add to that address
offset -9275
h, and we have got our zero address.


FinalBurn Alpha, FBA Plus, FBA Shuffle, FBA-ReRecording new versions uses module addressing, as well as those emulators:

Sega Saturn SSF

Gamecube/Wii Dolphin



PSX PCSX Reloaded, PSXjin


DreamCast NullDC, NullDC Optimized

Sega Model 3 - Supermodel

You have to create emulator options with module addressing for these

3DO FreeDO, 4DO

Dos - DosBox

Multisystem MESS, MAME (Contains a debugger with memory editor that is useful to find a zero addresses)


Other emulator options with pointer to zero address regularly tested for two different Windows versions, if pointer will not work on any version of Windows, it will also be converted to a module addressing.


The following emulators without a pointer to zero address (speed access to memory is faster without the pointer):

PC Engine/Turbografx/CD Mednafen

SSony PlayStation - ePSXe

DreamCast, Sega Naomi 1/2, Sammy Atomiswave Demul (zero address fixed at 2C000000)


Nes VirtualNes (older versions), puNes, Bsnes, Nintendulator 0.975 beta 9-12-11

Nintendo 64 1964, emu-1964 (zero address fixed at 20000000)

PC Engine/Turbografx/CD Mednafen, PCEjin

Arcade emulator ZiNc (Capcom ZN1/ZN2 based on PSX hardware)

Wonderswan Color, NeoGeo Pocket/Color - Mednafen

Killer Instinct 1/2 Ultra64 emu

Atari Jaguar Jagulator

Atari 8-bit, Atari 5200 - Altirra

and others.

Emulators with Pointer-to-pointer structure - Sega Model 2 emu (thanks to ArtMoney developers) , GB/GBC emulator TGB Dual, Multisystem emulator Mednafen in Atari Lynx emulation mode, and Atari ST emulator SainT.


ArtMoney can select emulator options automatically when loading of ArtMoney table. You can view MD5 file hash in "Process Information" window.


Start the Final Burn Alpha emulator. Next, open the Process Information and check MD5 hash

Now run Captain Commando, wait until player selection screen is loading, then press Pause button. Exact value search (value is 9):


Take off pause for two seconds , when value was equal to 7. Enter value 7 and click OK button


We can easily determine address of a timer from two remaining addresses. RMB at this address - "Copy" (Ins). Next enter offset -9275h in "Plus" field, and click "Plus" button.

Next, run the search for pointer to the zero address with a module addressing - note Use module addressing and Scan only static addresses in modules when searching.:






We get pointer in the FBA.EXE module. We need address in module:


As a result, we obtain the emulator option:


Final Burn Alpha v0.2.97.10;fba.exe;N;e8d939293fb19e2b5a1b8f9b12f64e65

;RAM 64Kb;FF0000;FBA.EXE+P00DFCB30;10000


Emulator option contains a version of the emulator, EXE fie name, bytes order, MD5 checksum, emulator virtual zero address (base address, start of RAM, RAM base), and a module name, address in module/pointer and size of this memory area


It's necessary to test emulator option on games in two different Windows versions. I made this emulator option in Windows 7 , check the settings on the XP SP3

Street Fighter Zero CPS Changer (Japan)

Windows 7

Armored Warriors

Windows XP SP3