Sprinter/mame
2
0
Fork 0
mirror of https://github.com/holub/mame synced 2025-04-21 07:52:35 +03:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

(MESS) megadriv.c: emulated protection in pirate Super Mario World 64, based on research by Eke and andlabs [Fabio Priuli]

Browse Source
This commit is contained in:
Fabio Priuli 2013-02-26 09:39:14 +00:00
parent 49dacaeaa9
commit 324eb6ea48
6 changed files with 265 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

130
hash/megadriv.xml
View File

@ -26119,7 +26119,19 @@ Notice that these are not working on real hardware due to bugged code with VDP i
</part>
</software>
<software name="xinqig1" cloneof="xinqig">
<software name="beggarp">
<description>Beggar Prince (USA)</description>
<year>2005</year>
<publisher>Super Fighter Team</publisher>
<part name="cart" interface="megadriv_cart">
<feature name="slot" value="rom_beggar" />
<dataarea name="rom" size="4194304">
<rom name="beggar prince (unl).bin" size="4194304" crc="f3af46cd" sha1="f481b970756c482d8f408c4bab8902172837e7d8" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="xinqig1" cloneof="beggarp">
<description>Xin Qi Gai Wang Zi (Chi, Alt)</description>
<year>1996</year>
<publisher>C&amp;E</publisher>
@ -26131,7 +26143,7 @@ Notice that these are not working on real hardware due to bugged code with VDP i
</part>
</software>
<software name="xinqig">
<software name="xinqig" cloneof="beggarp">
<description>Xin Qi Gai Wang Zi (Chi)</description>
<year>1996</year>
<publisher>C&amp;E</publisher>
@ -26863,6 +26875,18 @@ Notice that these are not working on real hardware due to bugged code with VDP i
</part>
</software>
<software name="smw64">
<description>Super Mario World 64</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<feature name="slot" value="rom_smw64" />
<dataarea name="rom" size="1048576">
<rom name="super mario world 64 (unl).bin" size="1048576" crc="e7ac4161" sha1="2ccf970fffd173f1984e69617c330a8f297f3481" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="redcliff">
<description>The Battle of Red Cliffs - Romance of the Three Kingdoms</description>
<year>199?</year>
@ -27300,6 +27324,28 @@ Notice that these are not working on real hardware due to bugged code with VDP i
</part>
</software>
<software name="chipndal">
<description>Chip 'n Dale Rescue Rangers (Rus)</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="468616">
<rom name="chip and dale rescue rangers (unl).bin" size="468616" crc="09614862" sha1="d58c3b171ce88638d15df681670a8eb5725210a4" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="chipndl2">
<description>Chip 'n Dale Rescue Rangers 2 (Rus)</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="616952">
<rom name="chip and dale rescue rangers 2 (unl).bin" size="616952" crc="51eebddc" sha1="21d62ac2307147d733141e22399bb04616f977df" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="commconq">
<description>Command &amp; Conquer (Prototype)</description>
<year>199?</year>
@ -27344,6 +27390,17 @@ Notice that these are not working on real hardware due to bugged code with VDP i
</part>
</software>
<software name="darkwing">
<description>Darkwing Duck (Rus)</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="644592">
<rom name="darkwing duck (unl).bin" size="644592" crc="922d49ff" sha1="ae238741113de481147ab20baee74d9c723453b5" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="deathcal">
<description>Death Caliber (Rus)</description>
<year>199?</year>
@ -27390,6 +27447,28 @@ Notice that these are not working on real hardware due to bugged code with VDP i
</part>
</software>
<software name="dbfb">
<description>Dragon Ball Final Bout (Chi?)</description>
<year>1998</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="2097152">
<rom name="dragon ball final bout (unl).bin" size="2097152" crc="63847005" sha1="6014cbf37fbabc51df581f7a93a1f8df09a66665" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="felix">
<description>Felix the Cat (Rus)</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="737528">
<rom name="felix the cat (unl).bin" size="737528" crc="90c4655c" sha1="6954e0c76a3585d74c7394b574d8e01cf4edb577" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="fifa2k2" cloneof="wcs2">
<description>FIFA World Cup 2002 (Rus)</description>
<year>199?</year>
@ -27682,6 +27761,18 @@ Notice that these are not working on real hardware due to bugged code with VDP i
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<info name="alt_title" value="Mario 3 Вокруг света"/>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="2097152">
<rom name="mario 3 (unl)[a1].bin" size="2097152" crc="6f630ebd" sha1="167f17f3a9d24f5d3ed1fbf7d7310fae53015258" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="mario3d" cloneof="mario3">
<description>Mario 3 - Vokrug Sveta (Rus, Demo?)</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<info name="alt_title" value="Mario 3 Вокруг света"/>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="2097152">
<rom name="mario 3 (unl).bin" size="2097152" crc="69f5b02f" sha1="7c2ebe7c88503bc719d5bcecae183619a7be503c" offset="000000" loadflag="load16_word_swap" />
@ -27701,30 +27792,6 @@ Notice that these are not working on real hardware due to bugged code with VDP i
</part>
</software>
<!-- Needs emulation of the protection. -->
<software name="smario64" supported="no">
<description>Super Mario World 64</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="1048576">
<rom name="super mario world 64 (unl).bin" size="1048576" crc="e7ac4161" sha1="2ccf970fffd173f1984e69617c330a8f297f3481" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<!-- This can be removed when protected version is emulated correctly -->
<software name="smario64h" cloneof="smario64">
<description>Super Mario World 64 (Hacked Protection)</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="1048576">
<rom name="super mario world 64 (hacked).bin" size="1048576" crc="a20f98aa" sha1="47fd007173419906ecdc7b0efc7d49f42de70c91" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="mgs" cloneof="crkdown">
<description>Metal Gear Solid (Rus)</description>
<year>199?</year>
@ -27880,6 +27947,17 @@ Notice that these are not working on real hardware due to bugged code with VDP i
</part>
</software>
<software name="samspir2" cloneof="samsho">
<description>Samurai Spirits II (Pirate)</description>
<year>199?</year>
<publisher>&lt;unknown&gt;</publisher>
<part name="cart" interface="megadriv_cart">
<dataarea name="rom" size="2097152">
<rom name="samurai spirits ii (unl).bin" size="2097152" crc="2942f180" sha1="fe5a6a28542a313f142ba938956fd43187834805" offset="000000" loadflag="load16_word_swap" />
</dataarea>
</part>
</software>
<software name="shrek" cloneof="yogibear">
<description>Shrek (Rus)</description>
<year>199?</year>

1
src/mess/drivers/megadriv.c
View File

@ -341,6 +341,7 @@ static SLOT_INTERFACE_START(md_cart)
SLOT_INTERFACE_INTERNAL("rom_sbubl", MD_ROM_SBUBL)
SLOT_INTERFACE_INTERNAL("rom_smb", MD_ROM_SMB)
SLOT_INTERFACE_INTERNAL("rom_smb2", MD_ROM_SMB2)
SLOT_INTERFACE_INTERNAL("rom_smw64", MD_ROM_SMW64)
SLOT_INTERFACE_INTERNAL("rom_smouse", MD_ROM_SMOUSE)
SLOT_INTERFACE_INTERNAL("rom_soulb", MD_ROM_SOULB)
SLOT_INTERFACE_INTERNAL("rom_squir", MD_ROM_SQUIR)

134
src/mess/machine/md_rom.c
View File

@ -27,6 +27,7 @@ const device_type MD_ROM_FRAM = &device_creator<md_rom_fram_device>;
const device_type MD_ROM_SSF2 = &device_creator<md_rom_ssf2_device>;
const device_type MD_ROM_BUGSLIFE = &device_creator<md_rom_bugslife_device>;
const device_type MD_ROM_SMOUSE = &device_creator<md_rom_smouse_device>;
const device_type MD_ROM_SMW64 = &device_creator<md_rom_smw64_device>;
const device_type MD_ROM_SMB = &device_creator<md_rom_smb_device>;
const device_type MD_ROM_SMB2 = &device_creator<md_rom_smb2_device>;
const device_type MD_ROM_SBUBL = &device_creator<md_rom_sbubl_device>;
@ -101,6 +102,11 @@ md_rom_smb2_device::md_rom_smb2_device(const machine_config &mconfig, const char
{
}
md_rom_smw64_device::md_rom_smw64_device(const machine_config &mconfig, const char *tag, device_t *owner, UINT32 clock)
: md_std_rom_device(mconfig, MD_ROM_SMW64, "MD Super Mario World 64", tag, owner, clock)
{
}
md_rom_sbubl_device::md_rom_sbubl_device(const machine_config &mconfig, const char *tag, device_t *owner, UINT32 clock)
: md_std_rom_device(mconfig, MD_ROM_SBUBL, "MD Super Bubble Bobble", tag, owner, clock)
{
@ -253,6 +259,19 @@ void md_rom_squir_device::device_start()
save_item(NAME(m_latch));
}
void md_rom_smw64_device::device_start()
{
m_latch0 = 0xf;
m_latch1 = 0xf;
memset(m_reg, 0, sizeof(m_reg));
memset(m_ctrl, 0, sizeof(m_ctrl));
save_item(NAME(m_latch0));
save_item(NAME(m_latch1));
save_item(NAME(m_reg));
save_item(NAME(m_ctrl));
}
void md_rom_topf_device::device_start()
{
m_latch = 0;
@ -817,6 +836,121 @@ READ16_MEMBER(md_rom_smb2_device::read_a13)
return 0xffff;
}
/*-------------------------------------------------
SUPER MARIO WORLD 64
-------------------------------------------------*/
READ16_MEMBER(md_rom_smw64_device::read)
{
// 0x000000-0x0fffff: lower 512KB ROM (up to 0x07ffff) + mirror
// 0x600000-0x6fffff: internal hardware (up to 0x67ffff) + mirror
// Namely,
// * 60xxx = bank1 of the upper 512KB ROM
// * 61xxx = bank2 of the upper 512KB ROM
// * 62xxx = alternate 4KB chunks of 0x0000 ~ 0xffff
// * 63xxx = same as 62xxx
// * 64xxx = returns 0x0000
// * 65xxx = same as 64xxx
// * 66xxx = CTRL/DATA
// * 67xxx = CTRL/DATA
if (offset < 0x100000/2)
return m_rom[offset & 0x3ffff];
if ((offset >= 0x600000/2) && (offset < 0x610000/2))
return m_rom[(m_latch0 * 0x10000)/2 + (offset & 0x7fff)];
if ((offset >= 0x610000/2) && (offset < 0x620000/2))
return m_rom[(m_latch1 * 0x10000)/2 + (offset & 0x7fff)];
if ((offset >= 0x620000/2) && (offset < 0x640000/2))
return (offset & 0x1000/2) ? 0x0000 : 0xffff;
if ((offset >= 0x640000/2) && (offset < 0x660000/2))
return 0x0000;
if ((offset >= 0x660000/2) && (offset < 0x670000/2))
{
offset &= 7;
switch (offset)
{
case 0x0:
case 0x2:
case 0x4:
return m_reg[offset/2]; // DATA1, DATA2, DATA3
case 0x1:
case 0x3:
case 0x5:
return m_reg[offset/2] + 1; // DATA1+1, DATA2+1, DATA3+1
case 0x6:
return m_reg[2] + 2; // DATA3+2
case 0x7:
return m_reg[2] + 3; // DATA3+3
}
}
if ((offset >= 0x670000/2) && (offset < 0x680000/2))
{
UINT16 data = (m_ctrl[1] & 0x80) ? ((m_ctrl[2] & 0x40) ? (m_reg[4] & m_reg[5]) : (m_reg[4] ^ 0xff)) : 0x0000;
if (offset & 0x1) // odd offset, return lower 7 bits of the above
return data & 0x7f;
else // even offset, return whole data above, but also update the regs if CTRL3 has 0x80 set
{
if (m_ctrl[2] & 0x80) // update regs if CTRL3 has bit7 set
{
if (m_ctrl[2] & 0x20)
m_reg[2] = (m_reg[5] << 2) & 0xfc; // DATA3
else
m_reg[0] = ((m_reg[4] << 1) ^ m_reg[3]) & 0xfe; // DATA1
}
return data;
}
}
return 0xffff;
}
WRITE16_MEMBER(md_rom_smw64_device::write)
{
// 0x600000-0x6fffff: internal hardware (up to 0x67ffff) + mirror
// Namely,
// * 62xxx/63xxx = unknown/unmapped
// * 65xxx/66xxx = unknown/unmapped
// * remaining ranges = CTRL/DATA
if ((offset >= 0x600000/2) && (offset < 0x610000/2))
{
if (offset & 1)
{
if ((m_ctrl[0] & 7) == 0)
m_reg[0] = ((m_reg[0] ^ m_reg[3]) ^ data) & 0xfe; // DATA1
if ((m_ctrl[0] & 7) == 1)
m_reg[1] = data & 0xfe; // DATA2
if ((m_ctrl[0] & 7) == 7)
m_latch1 = 8 + ((data & 0x1c) >> 2); // ROM BANKSWITCH $61
m_reg[3] = data; // DATA4
}
else
m_ctrl[0] = data; // CTRL1
}
if ((offset >= 0x610000/2) && (offset < 0x620000/2))
{
if (offset & 1)
m_ctrl[1] = data; // CTRL2
}
if ((offset >= 0x640000/2) && (offset < 0x650000/2))
{
if (offset & 1)
m_reg[5] = data; // DATA6
else
m_reg[4] = data; // DATA5
}
if ((offset >= 0x670000/2) && (offset < 0x680000/2))
{
if (!(offset & 1))
{
m_ctrl[2] = data; // CTRL3
if (m_ctrl[1] & 0x80)
m_latch0 = 8 + ((data & 0x1c) >> 2); // ROM BANKSWITCH $60
}
}
}
/*-------------------------------------------------
TOP FIGHTER
-------------------------------------------------*/

27
src/mess/machine/md_rom.h
View File

@ -369,6 +369,28 @@ public:
virtual DECLARE_READ16_MEMBER(read_a13);
};
// ======================> md_rom_smw64_device
class md_rom_smw64_device : public md_std_rom_device
{
public:
// construction/destruction
md_rom_smw64_device(const machine_config &mconfig, const char *tag, device_t *owner, UINT32 clock);
// device-level overrides
virtual void device_start();
virtual void device_config_complete() { m_shortname = "md_rom_smw64"; }
// reading and writing
virtual DECLARE_READ16_MEMBER(read);
virtual DECLARE_WRITE16_MEMBER(write);
private:
UINT32 m_latch0, m_latch1;
UINT16 m_reg[6];
UINT16 m_ctrl[3];
};
// ======================> md_rom_smouse_device
class md_rom_smouse_device : public md_std_rom_device
@ -484,6 +506,7 @@ extern const device_type MD_ROM_RX3;
extern const device_type MD_ROM_SBUBL;
extern const device_type MD_ROM_SMB;
extern const device_type MD_ROM_SMB2;
extern const device_type MD_ROM_SMW64;
extern const device_type MD_ROM_SMOUSE;
extern const device_type MD_ROM_SOULB;
extern const device_type MD_ROM_SSF2;
@ -491,8 +514,4 @@ extern const device_type MD_ROM_SQUIR;
extern const device_type MD_ROM_TOPF;
extern const device_type MD_ROM_RADICA;
// this are currently unused... protection is directly patched out!
extern const device_type MD_ROM_MULAN;
extern const device_type MD_ROM_POKE2;
#endif

1
src/mess/machine/md_slot.c
View File

@ -277,6 +277,7 @@ static const md_slot slot_list[] =
{ SBUBBOB, "rom_sbubl" },
{ SMB, "rom_smb" },
{ SMB2, "rom_smb2" },
{ SMW64, "rom_smw64" },
{ SMOUSE, "rom_smouse" },
{ SOULBLAD, "rom_soulblad" },
{ SQUIRRELK, "rom_squir" },

3
src/mess/machine/md_slot.h
View File

@ -21,7 +21,7 @@ enum
// Cart + NVRAM
SEGA_SRAM, SEGA_FRAM,
HARDBALL95, /* Hardball 95 uses different sram start address */
BEGGAR, /* Xin Qigai Wangzi uses different sram start address and has no valid header */
BEGGAR, /* Beggar Prince / Xin Qigai Wangzi uses different sram start address and has no valid header */
// EEPROM
SEGA_EEPROM, /* Wonder Boy V / Evander Holyfield's Boxing / Greatest Heavyweights of the Ring / Sports Talk Baseball / Megaman */
@ -60,6 +60,7 @@ enum
SBUBBOB, /* Super Bubble Bobble */
SMB, /* Super Mario Bros. */
SMB2, /* Super Mario Bros. 2 */
SMW64, /* Super Mario World 64 */
SMOUSE, /* Smart Mouse */
SOULBLAD, /* Soul Blade */
SQUIRRELK, /* Squirrel King */