From 43b1a48c89cd8fb5202897cc10b89424d1bb0871 Mon Sep 17 00:00:00 2001 From: davidhay Date: Tue, 3 Jun 2008 21:23:58 +0000 Subject: [PATCH] added some extra tecmosys protection notes (nuapete), added skeleton driver for black touch 96 (me), will continue to work on it. --- .gitattributes | 1 + src/mame/drivers/blackt96.c | 198 ++++++++++++++++++++++++++++++++++++ src/mame/machine/tecmosys.c | 31 ++++-- src/mame/mame.mak | 1 + src/mame/mamedriv.c | 1 + 5 files changed, 224 insertions(+), 8 deletions(-) create mode 100644 src/mame/drivers/blackt96.c diff --git a/.gitattributes b/.gitattributes index e63da7778dc..9b4a4a9c290 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1252,6 +1252,7 @@ src/mame/drivers/bionicc.c svneol=native#text/plain src/mame/drivers/bishi.c svneol=native#text/plain src/mame/drivers/bishjan.c svneol=native#text/plain src/mame/drivers/bking.c svneol=native#text/plain +src/mame/drivers/blackt96.c svneol=native#text/plain src/mame/drivers/bladestl.c svneol=native#text/plain src/mame/drivers/blktiger.c svneol=native#text/plain src/mame/drivers/blmbycar.c svneol=native#text/plain diff --git a/src/mame/drivers/blackt96.c b/src/mame/drivers/blackt96.c new file mode 100644 index 00000000000..ae6cb13976a --- /dev/null +++ b/src/mame/drivers/blackt96.c @@ -0,0 +1,198 @@ +/* + + Black Touch '96 + + +Black Touch 96 +D.G.R.M. of Korea, 1996 + +This game is a beat'em-up like Double Dragon + +PCB Layout +---------- + +D.G.R.M. NO 1947 +|---------------------------------------------| +| M6295 1 8MHz | +| M6295 2 2018 2018 | +| 16C57 2018 2018 | +|HA13001 2018 2018 | +| 2018 2018 | +| PAL PAL | +| 6116 5 6 | +|J 6116 7 8 | +|A | +|M | +|M | +|A | +| 9 10 | +| DSW1 24MHz PAL | +| DSW2 | +| PAL PAL ACTEL 6116 11 | +| 62256 62256 A1020B 12 | +| 3 4 PL84C 6264 13 | +| 6264 14 | +|18MHz 68000 6264 | +|---------------------------------------------| +Notes: + 68000 clock 9.000MHz [18/2] + M6295 clocks 1.000MHz [8/8] pin 7 high + + +*/ + +#include "driver.h" +#include "sound/okim6295.h" + +VIDEO_START( blackt96 ) +{ + +} + +VIDEO_UPDATE( blackt96 ) +{ + return 0; +} + +static READ16_HANDLER( blackt96_80000_r ) +{ + return 0x0000; +} + +static READ16_HANDLER( blackt96_c0000_r ) +{ + return 0x0000; +} + +static READ16_HANDLER( blackt96_e0000_r ) +{ + return 0x0000; +} + +static READ16_HANDLER( blackt96_e8000_r ) +{ + return 0x0000; +} + +static READ16_HANDLER( blackt96_f0000_r ) +{ + return 0x0000; +} + +static READ16_HANDLER( blackt96_f0008_r ) +{ + return 0x0000; +} + +static WRITE16_HANDLER( blackt96_c0000_w ) +{ + printf("blackt96_c0000_w %04x %04x\n",data,mem_mask); +} + +static ADDRESS_MAP_START( blackt96_map, ADDRESS_SPACE_PROGRAM, 16 ) + AM_RANGE(0x000000, 0x07ffff) AM_ROM + AM_RANGE(0x080000, 0x080001) AM_READ(blackt96_80000_r) AM_WRITE(SMH_NOP) + AM_RANGE(0x0c0000, 0x0c0001) AM_READ(blackt96_c0000_r) AM_WRITE(blackt96_c0000_w) + AM_RANGE(0x0e0000, 0x0e0001) AM_READ(blackt96_e0000_r) + AM_RANGE(0x0e8000, 0x0e8001) AM_READ(blackt96_e8000_r) + AM_RANGE(0x0f0000, 0x0f0001) AM_READ(blackt96_f0000_r) + AM_RANGE(0x0f0008, 0x0f0009) AM_READ(blackt96_f0008_r) + + AM_RANGE(0x100000, 0x100fff) AM_RAM + AM_RANGE(0x200000, 0x207fff) AM_RAM + AM_RANGE(0x400000, 0x400fff) AM_RAM + AM_RANGE(0xc00000, 0xc03fff) AM_RAM // main ram + +ADDRESS_MAP_END + + + +static INPUT_PORTS_START( blackt96 ) + PORT_START + PORT_BIT( 0xffff, IP_ACTIVE_LOW, IPT_UNKNOWN ) +INPUT_PORTS_END + + + +static const gfx_layout blackt96_layout = +{ + 16,16, + RGN_FRAC(1,1), + 8, + { 0,1,2,3,4,5,6,7 }, + { 1024+32, 1024+40, 1024+48, 1024+56, 1024+0, 1024+8, 1024+16, 1024+24, + 32,40,48,56,0,8,16,24 }, + { 0*64, 1*64, 2*64, 3*64, 4*64, 5*64, 6*64, 7*64, 8*64,9*64,10*64,11*64,12*64,13*64,14*64,15*64 }, + 32*64 +}; + + +static GFXDECODE_START( blackt96 ) + GFXDECODE_ENTRY( REGION_GFX1, 0, blackt96_layout, 0x0, 2 ) + GFXDECODE_ENTRY( REGION_GFX2, 0, blackt96_layout, 0x0, 2 ) + GFXDECODE_ENTRY( REGION_GFX3, 0, blackt96_layout, 0x0, 2 ) +GFXDECODE_END + + +static MACHINE_DRIVER_START( blackt96 ) + MDRV_CPU_ADD_TAG("main", M68000, 18000000 /2) + MDRV_CPU_PROGRAM_MAP(blackt96_map,0) + MDRV_CPU_VBLANK_INT("main", irq1_line_hold) + + MDRV_GFXDECODE(blackt96) + + MDRV_SCREEN_ADD("main", RASTER) + MDRV_SCREEN_REFRESH_RATE(60) + MDRV_SCREEN_VBLANK_TIME(ATTOSECONDS_IN_USEC(0)) + MDRV_SCREEN_FORMAT(BITMAP_FORMAT_INDEXED16) + MDRV_SCREEN_SIZE(64*8, 32*8) + MDRV_SCREEN_VISIBLE_AREA(8*8, 48*8-1, 2*8, 30*8-1) + + MDRV_PALETTE_LENGTH(0x200) + + MDRV_VIDEO_START(blackt96) + MDRV_VIDEO_UPDATE(blackt96) + + MDRV_SPEAKER_STANDARD_STEREO("left", "right") + + MDRV_SOUND_ADD(OKIM6295, 8000000/8) + MDRV_SOUND_CONFIG(okim6295_interface_region_1_pin7high) + MDRV_SOUND_ROUTE(ALL_OUTPUTS, "left", 0.47) + MDRV_SOUND_ROUTE(ALL_OUTPUTS, "right", 0.47) + + MDRV_SOUND_ADD(OKIM6295, 8000000/8) + MDRV_SOUND_CONFIG(okim6295_interface_region_1_pin7high) + MDRV_SOUND_ROUTE(ALL_OUTPUTS, "left", 0.47) + MDRV_SOUND_ROUTE(ALL_OUTPUTS, "right", 0.47) +MACHINE_DRIVER_END + + +ROM_START( blackt96 ) + ROM_REGION( 0x80000, REGION_CPU1, 0 ) /* 68000 Code */ + ROM_LOAD16_BYTE( "3", 0x00001, 0x40000, CRC(fc2c1d79) SHA1(742478237819af16d3fd66039283202b3c07eedd) ) + ROM_LOAD16_BYTE( "4", 0x00000, 0x40000, CRC(caff5b4a) SHA1(9a388cbb07211fa66f27082a8a5b847168c86a4f) ) + + ROM_REGION( 0x080000, REGION_SOUND1, 0 ) /* Samples */ + ROM_LOAD( "1", 0x00000, 0x80000, CRC(6a934174) SHA1(087f5fa226dc68ee217f99c64d16cdf14372d44c) ) + + ROM_REGION( 0x040000, REGION_SOUND2, 0 ) /* Samples */ + ROM_LOAD( "2", 0x00000, 0x40000, CRC(94009cd4) SHA1(aa36298e280c20bf86d70f3eb3fb33aca4df07e3) ) + + ROM_REGION( 0x180000, REGION_GFX1, 0 ) // tiles, 16x16x8 + ROM_LOAD16_BYTE( "5", 0x00000, 0x40000, CRC(6e52c331) SHA1(31ef1d352d4ee5f7b3ef336b1f052c3a1468f22e) ) + ROM_LOAD16_BYTE( "6", 0x00001, 0x40000, CRC(69637a5a) SHA1(a5731478856d8bb91d34b747838b2b47772864ef) ) + ROM_LOAD16_BYTE( "7", 0x80000, 0x80000, CRC(6b04e8a8) SHA1(309ba1efd60600a30e1ae8f6e8b92939c23cd9c6) ) + ROM_LOAD16_BYTE( "8", 0x80001, 0x80000, CRC(16c656be) SHA1(06c40c16080a97b01a638776d28f36594ce4fb3b) ) + + ROM_REGION( 0x100000, REGION_GFX2, 0 ) // not tiles? + ROM_LOAD( "11", 0x00000, 0x40000, CRC(9eb773a3) SHA1(9c91ee938438a61f5fa650ced6249e34aa5321bd) ) + ROM_LOAD( "12", 0x40000, 0x40000, CRC(8894e608) SHA1(389974a0b208b7cbf7d5f83641ddc058ad5ebe87) ) + ROM_LOAD( "13", 0x80000, 0x40000, CRC(0acceb9d) SHA1(e8a85c7eab45d84613ac37a9b7ffbc45b44eb2e5) ) + ROM_LOAD( "14", 0xc0000, 0x40000, CRC(b5e3de25) SHA1(33ac5602ab6bcadc8b0d1aa805a3bdce0b67c215) ) + + ROM_REGION( 0x100000, REGION_GFX3, 0 ) // not tiles? + ROM_LOAD( "9", 0x00000, 0x10000, CRC(81a4cf4c) SHA1(94b2bbcbc8327d9babbc3b222bd88954c7e7b80e) ) + ROM_LOAD( "10", 0x10000, 0x10000, CRC(b78232a2) SHA1(36a4f01011faf64e46b73f0082ab04843ac8b0e2) ) +ROM_END + +GAME( 1996, blackt96, 0, blackt96, blackt96, 0, ROT0, "D.G.R.M.", "Black Touch '96", GAME_NOT_WORKING ) diff --git a/src/mame/machine/tecmosys.c b/src/mame/machine/tecmosys.c index 13fbdc74e67..a22c25633e8 100644 --- a/src/mame/machine/tecmosys.c +++ b/src/mame/machine/tecmosys.c @@ -3,14 +3,28 @@ /* The device validates a password, then uploads the size of a code upload followed by the code upload itself. - After that, it uploads 4 ranges of code to checksum, followed by the checksums. + After that, it uploads 4 ranges of code to checksum, followed by the 4 checksums. + The 68K does the checksumming, and returns the results to the protection device. - Apart from inital protection calls and code upload, both games in the main game loop - write to the protection but they seem to ignore the returned data so maybe it is tied to something else too. + Apart from inital protection calls and code upload, the vblank in both games writes + info to the protection but they seem to ignore the returned data. + Maybe the protection is tied to something else, or maybe it was preliminary work on + further security. + This is what happens in the vblank: + - prot_w( 0xff ) + - val = prot_r() + - prot_w( checksum1[val] ) + (The area following checksum1 is the code upload in deroon, and active RAM in tkdensho, + so the value sent may be meaningless.) + + There is provision for calling the protection read/write functions from two of the trap 0xf switch + statements in the 68K, but I don't see it being used anywhere. It looks like the code upload is very plain, it can only be 0xff bytes long, and not contain the byte 0xff. The checksum ranges can't contain 0xff either, although the checksum values can. I'd be very interested in putting some trojan ROMs together if anyone has a board to run them on. + It might be possible to use one set of ROMs to get the checksum ranges, + and another set with dump code places outside those ranges. You can get me at nuapete@hotmail.com */ @@ -107,7 +121,8 @@ WRITE16_HANDLER(prot_data_w) { // Only LSB data >>= 8; - //logerror("+ prot_w( 0x%02x )\n", data); + + //logerror("+ prot_w( 0x%02x )\n", data ); switch( device_status ) { @@ -169,10 +184,10 @@ WRITE16_HANDLER(prot_data_w) case DS_DONE: switch( data ) { - case 0x00: - case 0x20: - case 0xbf: - case 0xff: + case 0xff: // trigger + case 0x00: // checksum1[val] tkdensho + case 0x20: // checksum1[val] deroon \ This is active RAM, so there may be more cases + case 0x01: // checksum1[val] deroon / that can be ignored break; default: diff --git a/src/mame/mame.mak b/src/mame/mame.mak index ed8d131a404..1302c80f296 100644 --- a/src/mame/mame.mak +++ b/src/mame/mame.mak @@ -1511,6 +1511,7 @@ $(MAMEOBJ)/misc.a: \ $(DRIVERS)/attckufo.o $(AUDIO)/attckufo.o $(VIDEO)/attckufo.o \ $(DRIVERS)/aztarac.o $(AUDIO)/aztarac.o $(VIDEO)/aztarac.o \ $(DRIVERS)/beaminv.o \ + $(DRIVERS)/blackt96.o \ $(DRIVERS)/bmcbowl.o \ $(DRIVERS)/calomega.o $(VIDEO)/calomega.o \ $(DRIVERS)/carrera.o \ diff --git a/src/mame/mamedriv.c b/src/mame/mamedriv.c index 76b17aa390b..0e2116c0c55 100644 --- a/src/mame/mamedriv.c +++ b/src/mame/mamedriv.c @@ -8087,6 +8087,7 @@ Other Sun games DRIVER( capcor ) /* (c) 2001 Nazionale Elettronica */ DRIVER( euro2k2 ) /* (c) 2001 Nazionale Elettronica */ DRIVER( euro2k2a ) /* (c) 2001 Nazionale Elettronica */ + DRIVER( blackt96 ) /* Astro Corp. */ DRIVER( showhand )