From 2bf2dbeb7b118e6a1ba21c339c6a38b5f6d53f28 Mon Sep 17 00:00:00 2001 From: "R. Belmont" Date: Sun, 13 Sep 2009 02:03:14 +0000 Subject: [PATCH] Naomi/AW update: * Hooked up protection for Power Stone 2 and Toy Fighter [R. Belmont, Guru, Cah4e3] * Redumped bad rom in Heavy Metal Geomatrix [Guru] * Redumped bad roms in Virtua Fighter 4 (cartridge version) [Guru] New games marked as GAME_NOT_WORKING ------------------------------------ Net Select Keiba Victory Furlong [Guru] Salary Man Kintarou [Guru] --- src/mame/drivers/naomi.c | 320 ++++++++++++++----------------------- src/mame/machine/naomibd.c | 63 ++++++-- 2 files changed, 164 insertions(+), 219 deletions(-) diff --git a/src/mame/drivers/naomi.c b/src/mame/drivers/naomi.c index 1e306f41447..bf003059756 100644 --- a/src/mame/drivers/naomi.c +++ b/src/mame/drivers/naomi.c @@ -2783,7 +2783,7 @@ ROM_START( f355 ) ROM_LOAD("mpr-21899.ic19",0x9800000, 0x0800000, CRC(14a4b87d) SHA1(33177dea88c6aec31e2c16c8d0d3f29c7ea772c5) ) ROM_LOAD("mpr-21900.ic20",0xa000000, 0x0800000, CRC(81901130) SHA1(1573b5c4360e29ba1a4b4901af49d5399fa1e635) ) ROM_LOAD("mpr-21901.ic21",0xa800000, 0x0800000, BAD_DUMP CRC(55dcbd6d) SHA1(9fec353f9e58016090e177f899a799e2e8fc7c9f) ) // returns bad in Naomi test mode -ROM_END +ROM_END // ROM reads different each time and fails test mode on real h/w, need a new cart ROM_START( hotd2 ) ROM_REGION( 0x200000, "maincpu", 0) @@ -3005,8 +3005,7 @@ ROM_START( hmgeo ) ROM_LOAD("mpr-23712.ic8", 0x4000000, 0x0800000, CRC(154f10ce) SHA1(67f6ff297f77632efe1965a81ed9f5c7dfa7a6b3) ) ROM_LOAD("mpr-23713.ic9", 0x4800000, 0x0800000, CRC(2969bac7) SHA1(5f1cf6ac726c2fe183d66e4022962e44592f9ccd) ) ROM_LOAD("mpr-23714.ic10",0x5000000, 0x0800000, CRC(da462c44) SHA1(ca450b6c07f939f96eba7b44c45b4e38abd598aa) ) - ROM_LOAD("mpr-23715.ic11",0x5800000, 0x0800000, BAD_DUMP CRC(59dfd3ad) SHA1(bb8f7a1bcf16038b18f4485a6b6d81fa72ca7bd0) ) - + ROM_LOAD("mpr-23715.ic11",0x5800000, 0x0800000, CRC(c750abbd) SHA1(2a5bedc2b21cd3f991c7145ccfd8c7a9e7f647ae) ) // trojaned protection data ROM_REGION( 0x200000, "naomibd_prot", ROMREGION_ERASE00 ) ROM_LOAD( "a3075ac0.bin", 0x000000, 0x00ff04, CRC(440dca2a) SHA1(4e261ff309e7e774fa2061de30174b0e4e967c00) ) @@ -3230,12 +3229,9 @@ ROM_START( toyfight ) ROM_LOAD("mpr-22033.ic9", 0x4800000, 0x0800000, CRC(5fe5586e) SHA1(3ff41ae1f81469597684faadd88e62b5e0634352) ) ROM_LOAD("mpr-22034.ic10",0x5000000, 0x0800000, CRC(3aa5ce5e) SHA1(f00a906235e4522d6fc2ac771324114346875314) ) - // trojaned protection data (filename is address read from) - ROM_REGION( 0x4000, "naomibd_prot", ROMREGION_ERASE00 ) - ROM_LOAD( "a0309000.bin", 0x000000, 0x000400, CRC(e4f8b4a2) SHA1(a0d54aa6e1ffd5b1db31002ee4a94943c2157a3e) ) - ROM_LOAD( "a0309500.bin", 0x001000, 0x000400, CRC(5d3a9b15) SHA1(30d55a686493bb2f5e7d2c7d7df3dedf2f93dff0) ) - ROM_LOAD( "a030a000.bin", 0x002000, 0x000400, CRC(22b88804) SHA1(7b53778ddbf360b364376f0358b0acfb689e8713) ) - ROM_LOAD( "a030a500.bin", 0x003000, 0x000400, CRC(6a501389) SHA1(c2c75cd8beed6bb9e3fa39722fa01b35f2e7992d) ) + // protection data (also found in cleartext in the program ROM!) + ROM_REGION( 0x400000, "naomibd_prot", ROMREGION_ERASE00 ) + ROM_COPY("user1", 0, 0, 0x400000) ROM_END @@ -3437,8 +3433,35 @@ ROM_START( pstone2 ) // trojaned protection data (filename is address read from) ROM_REGION( 0x200000, "naomibd_prot", ROMREGION_ERASE00 ) + ROM_LOAD( "a2785e20.bin", 0x000000, 0x0072f0, CRC(52912418) SHA1(ec0992eda50953001801d152e09195a17132cb0f) ) + ROM_LOAD( "a2765e00.bin", 0x010000, 0x00e47c, CRC(d9acaa94) SHA1(6ab7ebc2dd78c0bc007f3656a67f3c24d23d48ae) ) + ROM_LOAD( "a2774280.bin", 0x020000, 0x00c61c, CRC(8dd9581f) SHA1(f852c44e423effa894769d3e156325a132b2df8e) ) + ROM_LOAD( "a27808a0.bin", 0x030000, 0x005568, CRC(4f4aee03) SHA1(453c0ec08ca69ad844f24be290e92bf16231a713) ) + ROM_LOAD( "a154bdc0.bin", 0x040000, 0x00ec9c, CRC(755a7343) SHA1(a4355850e1cb6f81d53d461e70884a5c51083454) ) + ROM_LOAD( "a155aa60.bin", 0x050000, 0x00951c, CRC(fc7a23d8) SHA1(a428114d89471f4b4c8af6d932376e7b0887c4cc) ) + ROM_LOAD( "a1563f80.bin", 0x060000, 0x009f3c, CRC(90903b9c) SHA1(da6fcda74710497bab97c4c8342d93b5dfb14184) ) + ROM_LOAD( "a156dec0.bin", 0x070000, 0x00dbdc, CRC(fb7b0b77) SHA1(ace73e925e5ffa3f805ff0ef68b564119cf4ce41) ) + ROM_LOAD( "a157baa0.bin", 0x080000, 0x00cb3c, CRC(60e5dad6) SHA1(db8880ebbc3ebb02d861aa3bcf2cc34071d613e8) ) + ROM_LOAD( "a15885e0.bin", 0x090000, 0x00e91c, CRC(6b2e1400) SHA1(8965e97e3d85a568c2bef2d1d0faf5b8aee289d0) ) + ROM_LOAD( "a1596f00.bin", 0x0a0000, 0x00a3bc, CRC(cf538afa) SHA1(b7f94195760a0b14c18654823ead2e28fe526b07) ) + ROM_LOAD( "a15a12c0.bin", 0x0b0000, 0x007f04, CRC(e07d589b) SHA1(60bc7f3e91d1f22b4854777644add346e5df58bb) ) + ROM_LOAD( "a15a91e0.bin", 0x0c0000, 0x00c91c, CRC(124fce0b) SHA1(8949df4586c736e22c88b7594221ae114848284a) ) + ROM_LOAD( "a15b5b00.bin", 0x0d0000, 0x00a53c, CRC(453bb126) SHA1(d5251f54e80504f3c427f6cc3443fe56edcd62c0) ) + ROM_LOAD( "a15c0040.bin", 0x0e0000, 0x0088e0, CRC(7d601fb3) SHA1(ff2aca546e0db05b79f48fdb086f0e8e7e0853e4) ) + ROM_LOAD( "a16203e0.bin", 0x0f0000, 0x00c61c, CRC(300c8e1e) SHA1(25f9c4af3bed0da5fc9e440096fb5cf4c29a89b3) ) + ROM_LOAD( "a162ca00.bin", 0x100000, 0x009e9c, CRC(8f0ccd81) SHA1(0ae2209912e31195bb8110e28d0791fc398b49cd) ) + ROM_LOAD( "a16368a0.bin", 0x110000, 0x00b2dc, CRC(e497f060) SHA1(05d8ffc0ead6c31ddc3197c877466fec354a71d9) ) + ROM_LOAD( "a1641b80.bin", 0x120000, 0x00ac5c, CRC(e6d81d57) SHA1(97cfe0b14e1e23c7428dad426848de3fe2496ddb) ) + ROM_LOAD( "a164c7e0.bin", 0x130000, 0x008b7c, CRC(ab6ca421) SHA1(84979f01f82f34a9d708b645e9f2cc45abed03a9) ) + ROM_LOAD( "a1655360.bin", 0x140000, 0x00c8bc, CRC(c5554803) SHA1(06b712aed14a489d167876217cec48ad0aee495f) ) + ROM_LOAD( "a1661c20.bin", 0x150000, 0x0083dc, CRC(4f5abf07) SHA1(3d03f8728ce445b6070f182d84f843f08420ad05) ) + ROM_LOAD( "a166a000.bin", 0x160000, 0x00f73c, CRC(bfddc3bf) SHA1(a89bdebefaffc235e163a022d85b7c3bdbffcaf6) ) + ROM_LOAD( "a1679740.bin", 0x170000, 0x00fb5c, CRC(ec9889a5) SHA1(d7f04b62a8a78b3bfc9a25f1b21be08dcb986546) ) + ROM_LOAD( "a1688d00.bin", 0x180000, 0x00e080, CRC(ad7adaf6) SHA1(516858081ebab25ef0561e4b0f8842026504c5dd) ) + ROM_LOAD( "a1696d80.bin", 0x190000, 0x007c10, CRC(4e0c7365) SHA1(0d564956c8330aa57c504a247aef6a230b1e8884) ) ROM_END + /* SYSTEMID: NAOMI @@ -5207,16 +5230,16 @@ ROM_START( vf4cart ) ROM_REGION( 0xb800000, "user1", ROMREGION_ERASEFF) ROM_LOAD( "epr-23785.ic22", 0x0000000, 0x0400000, CRC(9bd98d4b) SHA1(3b0622625317cd6b2736c5b4a23484fb8bf39e4b) ) ROM_LOAD( "mpr-23774.ic1", 0x0800000, 0x1000000, CRC(0fe7b864) SHA1(357ca3a5d96d7ff27e06367e115ddfd00cb260e3) ) - ROM_LOAD( "mpr-23775.ic2", 0x1800000, 0x1000000, BAD_DUMP CRC(6c64d9d9) SHA1(d2033ca3ab9838cad39e17b5c1eb079c6d15b758) ) + ROM_LOAD( "mpr-23775.ic2", 0x1800000, 0x1000000, CRC(a11cd9e5) SHA1(7fd8f634d0d14a91dfe9f39b5643b9c761dc7053) ) ROM_LOAD( "mpr-23776.ic3", 0x2800000, 0x1000000, CRC(44b8429e) SHA1(0ec6b6156bef1621700791651903a4589f4b5f84) ) ROM_LOAD( "mpr-23777.ic4", 0x3800000, 0x1000000, CRC(78a4264e) SHA1(40d045240173f330ac6f108b132f9a87884922be) ) ROM_LOAD( "mpr-23778.ic5", 0x4800000, 0x1000000, CRC(02dee78b) SHA1(e08ce0fc0b1db2dcef957c2edb6d51db400a38cb) ) ROM_LOAD( "mpr-23779.ic6", 0x5800000, 0x1000000, CRC(6e458eea) SHA1(4c85fcacf4ff46d4a137afcf5906092fd88fe4b1) ) ROM_LOAD( "mpr-23780.ic7", 0x6800000, 0x1000000, CRC(a775a51c) SHA1(b3eae20e5e7d74252368fd902c4e94a6ba6cb154) ) - ROM_LOAD( "mpr-23781.ic8", 0x7800000, 0x1000000, BAD_DUMP CRC(689457fa) SHA1(734b6b5f2ba78af24a613aef8d4e739f296413f7) ) + ROM_LOAD( "mpr-23781.ic8", 0x7800000, 0x1000000, CRC(401bca00) SHA1(10c6011fae7076ea0dc5ab0ebca9cb88659a93e9) ) ROM_LOAD( "mpr-23782.ic9", 0x8800000, 0x1000000, CRC(4f72e901) SHA1(a1d231c446d2c34e5a7e7145754b2313a2d03fd4) ) ROM_LOAD( "mpr-23783.ic10", 0x9800000, 0x1000000, CRC(c8d4f6f9) SHA1(9e9df605c050b3780d7df34bd5041d30bc084d2d) ) - ROM_LOAD( "mpr-23784.ic11", 0xa800000, 0x1000000, BAD_DUMP CRC(3a7ebe78) SHA1(6f414db03761be0d2f995193df8146f3b82c18a8) ) + ROM_LOAD( "mpr-23784.ic11", 0xa800000, 0x1000000, CRC(f74f2fee) SHA1(84b07baa6d116727e66ef27e24ba6484c3393891) ) ROM_END ROM_START( clubkrte ) @@ -5506,7 +5529,7 @@ struct _atomiswave_key int S3[8]; }; -static const atomiswave_key ssu_key = { +static const atomiswave_key sprtshot_key = { {8,10,1,3,7,4,11,2,5,15,6,0,12,13,9,14}, {4,12,8,14,16,30,31,0,23,29,24,21,11,22,27,5,3,20,18,26,10,7,17,1,28,6,15,13,2,9,25,19}, {13,1,0,9,5,12,4,14,3,15,2,10,11,6,8,7}, @@ -5514,7 +5537,7 @@ static const atomiswave_key ssu_key = { {4,0,1,2,5,7,3,6} }; -static const atomiswave_key rm_key = { +static const atomiswave_key rangrmsn_key = { {4,5,9,6,1,13,7,11,10,0,14,12,8,15,2,3}, {3,0,14,17,10,15,31,20,13,2,29,28,9,18,25,27,6,19,30,22,7,12,1,16,23,11,24,4,8,26,21,5}, {2,10,6,9,11,13,4,5,3,15,7,14,12,1,0,8}, @@ -5530,7 +5553,7 @@ static const atomiswave_key fotns_key = { {7,4,1,2,6,0,5,3} }; -static const atomiswave_key xh_key = { +static const atomiswave_key xtrmhunt_key = { {12,7,11,2,0,5,15,6,1,8,14,4,9,13,3,10}, {4,12,8,14,16,30,31,0,23,29,24,21,11,22,27,5,3,20,18,26,10,7,17,1,28,6,15,13,2,9,25,19}, {13,1,0,9,5,12,4,14,3,15,2,10,11,6,8,7}, @@ -5538,7 +5561,7 @@ static const atomiswave_key xh_key = { {4,0,1,2,5,7,3,6} }; -static const atomiswave_key xh2_key = { +static const atomiswave_key xtrmhnt2_key = { {14,1,11,15,7,3,8,13,0,4,2,12,6,10,5,9}, {11,3,7,1,31,17,16,15,24,18,23,26,4,25,20,10,12,27,29,21,5,8,30,14,19,9,0,2,13,6,22,28}, {7,11,10,3,15,6,14,4,9,5,8,0,1,12,2,13}, @@ -5602,6 +5625,22 @@ static const atomiswave_key ggisuka_key = { {1,5,4,7,0,2,6,3} }; +static const atomiswave_key vfurlong_key = { + {12,7,11,2,0,5,15,6,1,8,14,4,9,13,3,10}, + {19,21,6,29,23,2,24,13,15,27,12,10,8,18,11,5,1,28,4,22,30,14,31,9,26,3,25,7,16,20,17,0}, + {6,1,14,8,11,5,15,2,7,0,3,9,13,12,4,10}, + {1,12,0,10,6,11,2,4,8,3,7,9,13,14,5,15}, + {3,7,4,0,6,5,1,2} +}; + +static const atomiswave_key salmankt_key = { + {8,10,1,3,7,4,11,2,5,15,6,0,12,13,9,14}, + {5,23,11,22,8,30,29,9,18,13,12,28,25,21,7,27,2,20,26,0,4,19,1,16,6,14,15,17,24,3,31,10}, + {15,3,0,4,8,5,12,7,10,11,2,14,13,6,9,1}, + {11,5,12,14,1,4,2,0,8,3,13,9,7,6,15,10}, + {0,3,2,7,6,4,5,1} +}; + static UINT16 atomiswave_decrypt(UINT16 cipherText, int address, const atomiswave_key* key) { int b0,b1,b2,b3; @@ -5642,188 +5681,33 @@ static DRIVER_INIT( atomiswave ) intelflash_init(machine, 0, FLASH_MACRONIX_29L001MC, memory_region(machine, "maincpu")); } - -static DRIVER_INIT(fotns) -{ - int i; - UINT16 *src = (UINT16 *)(memory_region(machine, "user1")); - - long rom_size = memory_region_length(machine, "user1"); - - for(i=0; iprot_sum = 0; } @@ -414,6 +417,9 @@ READ64_DEVICE_HANDLER( naomibd_r ) UINT8 *prot = (UINT8 *)v->protdata; UINT32 byte_offset = v->prot_offset*2; + // this is a good time to clear the prot_sum + v->prot_sum = 0; + if (v->prot_translate == NULL) { #if NAOMIBD_PRINTF_PROTECTION @@ -646,7 +652,7 @@ WRITE64_DEVICE_HANDLER( naomibd_w ) v->prot_key = data; #if NAOMIBD_PRINTF_PROTECTION - printf("Protection: set up read @ %x, key %x (PIO %x DMA %x) [%s]\n", v->prot_offset*2, v->prot_key, v->rom_offset, v->dma_offset, cpuexec_describe_context(device->machine)); + printf("Protection: set up read @ %x, key %x sum %x (PIO %x DMA %x) [%s]\n", v->prot_offset*2, v->prot_key, v->prot_sum, v->rom_offset, v->dma_offset, cpuexec_describe_context(device->machine)); v->prot_pio_count = 0; #endif @@ -657,13 +663,13 @@ WRITE64_DEVICE_HANDLER( naomibd_w ) i = 0; while (v->prot_translate[i+1] != 0xffffffff) { - // should we match by key or address? - if (v->prot_translate[i] != -1) + // should we match by key, address, or sum? + if (v->prot_translate[i] == -2) // match sum { - if (v->prot_translate[i] == v->prot_key) + if (v->prot_translate[i+1] == v->prot_sum) { #if NAOMIBD_PRINTF_PROTECTION - printf("Protection: got key %x, translated to %x\n", v->prot_key, v->prot_translate[i+2]); + printf("Protection: got sum %x, translated to %x\n", v->prot_sum, v->prot_translate[i+2]); #endif v->prot_offset = v->prot_translate[i+2]/2; break; @@ -673,7 +679,7 @@ WRITE64_DEVICE_HANDLER( naomibd_w ) i+= 3; } } - else + else if (v->prot_translate[i] == -1) // match address { if (v->prot_translate[i+1] == (v->prot_offset*2)) { @@ -688,6 +694,21 @@ WRITE64_DEVICE_HANDLER( naomibd_w ) i += 3; } } + else // match key + { + if (v->prot_translate[i] == v->prot_key) + { + #if NAOMIBD_PRINTF_PROTECTION + printf("Protection: got key %x, translated to %x\n", v->prot_key, v->prot_translate[i+2]); + #endif + v->prot_offset = v->prot_translate[i+2]/2; + break; + } + else + { + i+= 3; + } + } } } #if NAOMIBD_PRINTF_PROTECTION @@ -698,9 +719,17 @@ WRITE64_DEVICE_HANDLER( naomibd_w ) #endif break; + case 0x2000000: + case 0x2020000: + #if NAOMIBD_PRINTF_PROTECTION + printf("Protection write %04x to upload\n", (UINT32)(data&0xffff)); + #endif + v->prot_sum += (INT16)(data&0xffff); + break; + default: #if NAOMIBD_PRINTF_PROTECTION - printf("naomibd: unknown protection write %x @ %x\n", (UINT32)data, offset); + printf("naomibd: unknown protection write %x @ %x\n", (UINT32)data, v->rom_offset); #endif break; }