mirror of
https://github.com/holub/mame
synced 2025-04-23 00:39:36 +03:00
notes (nw)
This commit is contained in:
David Haywood
parent
ad27c3045a
commit
2998430da7
@ -104,7 +104,7 @@ READ16_MEMBER( funkyjet_state::funkyjet_protection_region_0_146_r )
|
||||
// UINT16 realdat = deco16_146_funkyjet_prot_r(space,offset&0x3ff,mem_mask);
|
||||
|
||||
int real_address = 0 + (offset *2);
|
||||
int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 5, 6, 4, 7, 3, 8, 2, 9, 1, 10, 0) & 0x7fff;
|
||||
int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) & 0x7fff;
|
||||
UINT8 cs = 0;
|
||||
UINT16 data = m_deco146->read_data( deco146_addr, mem_mask, cs );
|
||||
|
||||
@ -119,7 +119,7 @@ WRITE16_MEMBER( funkyjet_state::funkyjet_protection_region_0_146_w )
|
||||
// deco16_146_funkyjet_prot_w(space,offset&0x3ff,data,mem_mask);
|
||||
|
||||
int real_address = 0 + (offset *2);
|
||||
int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 5, 6, 4, 7, 3, 8, 2, 9, 1, 10, 0) & 0x7fff;
|
||||
int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) & 0x7fff;
|
||||
UINT8 cs = 0;
|
||||
m_deco146->write_data( space, deco146_addr, data, mem_mask, cs );
|
||||
}
|
||||
@ -337,6 +337,8 @@ static MACHINE_CONFIG_START( funkyjet, funkyjet_state )
|
||||
MCFG_SCREEN_UPDATE_DRIVER(funkyjet_state, screen_update_funkyjet)
|
||||
|
||||
MCFG_DECO146_ADD("ioprot")
|
||||
MCFG_DECO146_SET_INTERFACE_SCRAMBLE_INTERLEAVE
|
||||
|
||||
|
||||
MCFG_GFXDECODE(funkyjet)
|
||||
MCFG_PALETTE_LENGTH(1024)
|
||||
|
||||
@ -1,68 +1,9 @@
|
||||
/****************************************************************************
|
||||
|
||||
Data East 104 based protection/IO chips
|
||||
(a variation on the Deco 146 protection, see deco146.c for notes)
|
||||
|
||||
|
||||
Game Custom chip number
|
||||
------------------------------------------------
|
||||
Caveman Ninja 104
|
||||
Wizard Fire 104
|
||||
Pocket Gal DX 104
|
||||
Boogie Wings 104
|
||||
Rohga 104
|
||||
Diet GoGo 104
|
||||
Tattoo Assassins 104?
|
||||
Dream Ball 104
|
||||
Night Slashers 104
|
||||
Double Wings 104
|
||||
Schmeiser Robo 104
|
||||
|
||||
for more modern 60/66/75/146 knowledge see deco146.c
|
||||
|
||||
|
||||
This series of chips is used for I/O and copy protection. They are all
|
||||
16 bit word based chips, with 0x400 write addresses, and 0x400 read
|
||||
addresses. The basic idea of the protection is that read & write
|
||||
addresses don't match. So if you write to write address 0, you might
|
||||
read that data back at read address 10, and something else will be at 0.
|
||||
In addition, the data read back may be bit shifted in various ways.
|
||||
Games can be very well protected by writing variables to the chip, and
|
||||
expecting certain values back from certain read addresses. With care,
|
||||
it can be impossible to tell from the game code what values go where,
|
||||
and what shifting goes on. Eg, writing 10 values to the chip, of which
|
||||
7 are dummy values, then reading back 3 particular values, and using them
|
||||
in a multiplication and add calculation to get a jump address for the
|
||||
program. Even if you can guess one of many possible legal jump addresses
|
||||
it's hard to tell what values should be bit shifted in what way.
|
||||
|
||||
It's also been found some chips contain a hardwired XOR port and hardwired
|
||||
NAND port which affects only certain read values.
|
||||
|
||||
The chips also handle the interface to the sound cpu via a write address,
|
||||
and game inputs via several read addresses. The I/O input data is also
|
||||
mirrored to several locations, some with bit shifting.
|
||||
|
||||
Although several games use chip 104, each seems to be different, the
|
||||
address lines leading to the chip on each game are probably arranged
|
||||
differently, to further scramble reads/writes. From hardware tests
|
||||
chips 60 && 66 appear to be identical.
|
||||
|
||||
Update January - April 2006:
|
||||
Further work on examining the 146 chip has revealed that if you
|
||||
read an address immediately after writing it, you always get
|
||||
the written value returned. This behaviour is confirmed
|
||||
to only exist for one read/write 'tick' - any other read will
|
||||
return that location to its usual state - ie, bit shifter
|
||||
or input port. This has been emulated for the 146 chip in
|
||||
Nitroball and Fighters History but the behaviour probably
|
||||
also exists in earlier chips as it explains the 'one-shot'
|
||||
ports in Mutant Fighter.
|
||||
|
||||
The 'double buffer' feature seen in the 104 chip is also
|
||||
confirmed to exist in the 146 chip. Again, this may well
|
||||
be present in the earlier chip too.
|
||||
|
||||
Emulation by Bryan McPhail, mish@tendril.co.uk
|
||||
original protection simulations by Bryan McPhail, mish@tendril.co.uk
|
||||
|
||||
***************************************************************************/
|
||||
|
||||
|
||||
@ -1,43 +1,87 @@
|
||||
/* Data East 146 protection chip / memory-mapper & I/O interface */
|
||||
|
||||
/*
|
||||
this was based on the analysis of a 146 chip by Charles MacDonald
|
||||
http://cgfm2.emuviews.com/new/detech.txt
|
||||
using a Super Shanghai board
|
||||
The 146 emulation was based on the analysis of a 146 chip by
|
||||
Charles MacDonald http://cgfm2.emuviews.com/new/detech.txt
|
||||
using a Super Shanghai board and comparisons with the old protection
|
||||
simulations.
|
||||
|
||||
Currently used for
|
||||
146 Super Shanghai
|
||||
146 Funky Jet / Sotsugyo Shousho
|
||||
60 Edward Randy
|
||||
66 Mutant Fighter
|
||||
75 Captain America
|
||||
The 104 emulation (deco104.c) currently only has per-game cases and
|
||||
is incomplete.
|
||||
|
||||
60,66,75 appear to operate in the same way as 146, possibly the same chip rebadged?
|
||||
The Deco 146 and 104 chips act as I/O chips and as protection devices
|
||||
by using 2 banks of 0x80 words of RAM built into the chips.
|
||||
|
||||
the lower 10 address lines are often rearranged when the chip is hooked up
|
||||
The chip has 0x400 read addresses each of which is mapped to one of
|
||||
the RAM addresses (scrambled) as well as logic for shifting, xoring
|
||||
and masking the bits returned.
|
||||
|
||||
The following games use 146 compatible chips, but appear to use some kind of different
|
||||
read mode (legacy implementations included)
|
||||
In addition there is the aformentioned bankswitch behavior triggered
|
||||
by causing a read related to a specific write address.
|
||||
|
||||
146? Fighters History*
|
||||
146 Nitro Ball*
|
||||
75 Robocop 2**
|
||||
75 Lemmings**
|
||||
The chip also provides takes an additional 4 address lines and uses
|
||||
them to map Chip Select outputs meaning depending on some
|
||||
configuration registers meaning it can potentially be used as a
|
||||
memory mapping device similar to the Sega System 16 ones, however
|
||||
nothing makes proper use of this functionality.
|
||||
|
||||
*Address lines are connected backwards compared to Robocop 2, reverse them to get
|
||||
the sound / xor / mask write ports at the expected addresses, but the input port
|
||||
addresses are still different to our implementation (the same as Robocop 2)
|
||||
There seems to be a way to select an alt read mode too, causing
|
||||
the port read lines to be xored.
|
||||
|
||||
** need to move here
|
||||
Many games only use the basic I/O functions!
|
||||
|
||||
The following are also 146 style chips and need moving
|
||||
146 Stadium Hero 96
|
||||
146 Dragon Gun / Lock 'n' Loaded
|
||||
Data East Customs
|
||||
60,66,75 and 146 all appear to have identical functionality
|
||||
|
||||
Custom chip 104 appears to work in the same way but with different
|
||||
internal tables and different special ports.
|
||||
|
||||
Chip 146 104
|
||||
XOR register port 0x2c 0x42
|
||||
MASK register port 0x36 0xee
|
||||
Soundlatch port 0x64 0xa8
|
||||
Bankswitch port 0x78 0x66
|
||||
Extra addr Xor(if used) 0x44a 0x2a4
|
||||
|
||||
Both chips are often connected with the lower 10 address lines
|
||||
scrambled or reversed.
|
||||
|
||||
Game Chip Address Scramble Extra Read Address Xor?
|
||||
|
||||
--- 146 compatible games ---
|
||||
|
||||
Edward Randy 60 None No
|
||||
Mutant Fighter 66 None No
|
||||
Captain America 75 None No
|
||||
Lemmings 75 None Yes
|
||||
Robocop 2 75 None Yes
|
||||
Super Shanghai Dragon's Eye 146 None No
|
||||
Funky Jet 146 Interleave No
|
||||
Sotsugyo Shousho (same board / config as Funky Jet)
|
||||
Nitro Ball 146 Reversed Yes
|
||||
Fighters History 146? (surface scratched) Interleave Yes
|
||||
Stadium Hero 96 146 None Yes
|
||||
Dragon Gun 146 Reversed No
|
||||
Lock 'n' Loaded (same board / config as Dragon Gun)
|
||||
|
||||
--- 104 games ---
|
||||
|
||||
Caveman Ninja 104 None Yes
|
||||
Wizard Fire 104 Reversed No
|
||||
Pocket Gal DX 104 None* No*
|
||||
Boogie Wings 104 Reversed Yes
|
||||
Rohga 104 None No
|
||||
Diet GoGo 104 Interleave Yes
|
||||
Tattoo Assassins 104 Interleave No
|
||||
Dream Ball 104 None No
|
||||
Night Slashers 104 Interleave No
|
||||
Double Wings 104 Interleave** Yes**
|
||||
Schmeiser Robo 104 None No
|
||||
|
||||
|
||||
* not currently hooked up, conflicts on an input port with Rohga, needs more investigation
|
||||
** simulation massively incomplete
|
||||
|
||||
Chip 104 seems to be a similar thing but almost certainly has different internal
|
||||
tables, see decoprot.c
|
||||
|
||||
*/
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user