diff --git a/src/mame/drivers/funkyjet.c b/src/mame/drivers/funkyjet.c index 5e9e1698412..855ef96c499 100644 --- a/src/mame/drivers/funkyjet.c +++ b/src/mame/drivers/funkyjet.c @@ -104,7 +104,7 @@ READ16_MEMBER( funkyjet_state::funkyjet_protection_region_0_146_r ) // UINT16 realdat = deco16_146_funkyjet_prot_r(space,offset&0x3ff,mem_mask); int real_address = 0 + (offset *2); - int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 5, 6, 4, 7, 3, 8, 2, 9, 1, 10, 0) & 0x7fff; + int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) & 0x7fff; UINT8 cs = 0; UINT16 data = m_deco146->read_data( deco146_addr, mem_mask, cs ); @@ -119,7 +119,7 @@ WRITE16_MEMBER( funkyjet_state::funkyjet_protection_region_0_146_w ) // deco16_146_funkyjet_prot_w(space,offset&0x3ff,data,mem_mask); int real_address = 0 + (offset *2); - int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 5, 6, 4, 7, 3, 8, 2, 9, 1, 10, 0) & 0x7fff; + int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) & 0x7fff; UINT8 cs = 0; m_deco146->write_data( space, deco146_addr, data, mem_mask, cs ); } @@ -337,6 +337,8 @@ static MACHINE_CONFIG_START( funkyjet, funkyjet_state ) MCFG_SCREEN_UPDATE_DRIVER(funkyjet_state, screen_update_funkyjet) MCFG_DECO146_ADD("ioprot") + MCFG_DECO146_SET_INTERFACE_SCRAMBLE_INTERLEAVE + MCFG_GFXDECODE(funkyjet) MCFG_PALETTE_LENGTH(1024) diff --git a/src/mame/machine/deco104.c b/src/mame/machine/deco104.c index c4deecca4ce..077571d3741 100644 --- a/src/mame/machine/deco104.c +++ b/src/mame/machine/deco104.c @@ -1,68 +1,9 @@ /**************************************************************************** Data East 104 based protection/IO chips + (a variation on the Deco 146 protection, see deco146.c for notes) - - Game Custom chip number - ------------------------------------------------ - Caveman Ninja 104 - Wizard Fire 104 - Pocket Gal DX 104 - Boogie Wings 104 - Rohga 104 - Diet GoGo 104 - Tattoo Assassins 104? - Dream Ball 104 - Night Slashers 104 - Double Wings 104 - Schmeiser Robo 104 - - for more modern 60/66/75/146 knowledge see deco146.c - - - This series of chips is used for I/O and copy protection. They are all - 16 bit word based chips, with 0x400 write addresses, and 0x400 read - addresses. The basic idea of the protection is that read & write - addresses don't match. So if you write to write address 0, you might - read that data back at read address 10, and something else will be at 0. - In addition, the data read back may be bit shifted in various ways. - Games can be very well protected by writing variables to the chip, and - expecting certain values back from certain read addresses. With care, - it can be impossible to tell from the game code what values go where, - and what shifting goes on. Eg, writing 10 values to the chip, of which - 7 are dummy values, then reading back 3 particular values, and using them - in a multiplication and add calculation to get a jump address for the - program. Even if you can guess one of many possible legal jump addresses - it's hard to tell what values should be bit shifted in what way. - - It's also been found some chips contain a hardwired XOR port and hardwired - NAND port which affects only certain read values. - - The chips also handle the interface to the sound cpu via a write address, - and game inputs via several read addresses. The I/O input data is also - mirrored to several locations, some with bit shifting. - - Although several games use chip 104, each seems to be different, the - address lines leading to the chip on each game are probably arranged - differently, to further scramble reads/writes. From hardware tests - chips 60 && 66 appear to be identical. - - Update January - April 2006: - Further work on examining the 146 chip has revealed that if you - read an address immediately after writing it, you always get - the written value returned. This behaviour is confirmed - to only exist for one read/write 'tick' - any other read will - return that location to its usual state - ie, bit shifter - or input port. This has been emulated for the 146 chip in - Nitroball and Fighters History but the behaviour probably - also exists in earlier chips as it explains the 'one-shot' - ports in Mutant Fighter. - - The 'double buffer' feature seen in the 104 chip is also - confirmed to exist in the 146 chip. Again, this may well - be present in the earlier chip too. - - Emulation by Bryan McPhail, mish@tendril.co.uk + original protection simulations by Bryan McPhail, mish@tendril.co.uk ***************************************************************************/ diff --git a/src/mame/machine/deco146.c b/src/mame/machine/deco146.c index 726bcd129cb..c51dce7fa28 100644 --- a/src/mame/machine/deco146.c +++ b/src/mame/machine/deco146.c @@ -1,43 +1,87 @@ /* Data East 146 protection chip / memory-mapper & I/O interface */ /* - this was based on the analysis of a 146 chip by Charles MacDonald - http://cgfm2.emuviews.com/new/detech.txt - using a Super Shanghai board + The 146 emulation was based on the analysis of a 146 chip by + Charles MacDonald http://cgfm2.emuviews.com/new/detech.txt + using a Super Shanghai board and comparisons with the old protection + simulations. - Currently used for - 146 Super Shanghai - 146 Funky Jet / Sotsugyo Shousho - 60 Edward Randy - 66 Mutant Fighter - 75 Captain America + The 104 emulation (deco104.c) currently only has per-game cases and + is incomplete. - 60,66,75 appear to operate in the same way as 146, possibly the same chip rebadged? + The Deco 146 and 104 chips act as I/O chips and as protection devices + by using 2 banks of 0x80 words of RAM built into the chips. - the lower 10 address lines are often rearranged when the chip is hooked up + The chip has 0x400 read addresses each of which is mapped to one of + the RAM addresses (scrambled) as well as logic for shifting, xoring + and masking the bits returned. - The following games use 146 compatible chips, but appear to use some kind of different - read mode (legacy implementations included) + In addition there is the aformentioned bankswitch behavior triggered + by causing a read related to a specific write address. - 146? Fighters History* - 146 Nitro Ball* - 75 Robocop 2** - 75 Lemmings** + The chip also provides takes an additional 4 address lines and uses + them to map Chip Select outputs meaning depending on some + configuration registers meaning it can potentially be used as a + memory mapping device similar to the Sega System 16 ones, however + nothing makes proper use of this functionality. - *Address lines are connected backwards compared to Robocop 2, reverse them to get - the sound / xor / mask write ports at the expected addresses, but the input port - addresses are still different to our implementation (the same as Robocop 2) + There seems to be a way to select an alt read mode too, causing + the port read lines to be xored. - ** need to move here + Many games only use the basic I/O functions! - The following are also 146 style chips and need moving - 146 Stadium Hero 96 - 146 Dragon Gun / Lock 'n' Loaded + Data East Customs + 60,66,75 and 146 all appear to have identical functionality + + Custom chip 104 appears to work in the same way but with different + internal tables and different special ports. + + Chip 146 104 + XOR register port 0x2c 0x42 + MASK register port 0x36 0xee + Soundlatch port 0x64 0xa8 + Bankswitch port 0x78 0x66 + Extra addr Xor(if used) 0x44a 0x2a4 + + Both chips are often connected with the lower 10 address lines + scrambled or reversed. + + Game Chip Address Scramble Extra Read Address Xor? + + --- 146 compatible games --- + + Edward Randy 60 None No + Mutant Fighter 66 None No + Captain America 75 None No + Lemmings 75 None Yes + Robocop 2 75 None Yes + Super Shanghai Dragon's Eye 146 None No + Funky Jet 146 Interleave No + Sotsugyo Shousho (same board / config as Funky Jet) + Nitro Ball 146 Reversed Yes + Fighters History 146? (surface scratched) Interleave Yes + Stadium Hero 96 146 None Yes + Dragon Gun 146 Reversed No + Lock 'n' Loaded (same board / config as Dragon Gun) + + --- 104 games --- + + Caveman Ninja 104 None Yes + Wizard Fire 104 Reversed No + Pocket Gal DX 104 None* No* + Boogie Wings 104 Reversed Yes + Rohga 104 None No + Diet GoGo 104 Interleave Yes + Tattoo Assassins 104 Interleave No + Dream Ball 104 None No + Night Slashers 104 Interleave No + Double Wings 104 Interleave** Yes** + Schmeiser Robo 104 None No + * not currently hooked up, conflicts on an input port with Rohga, needs more investigation + ** simulation massively incomplete - Chip 104 seems to be a similar thing but almost certainly has different internal - tables, see decoprot.c */