diff --git a/src/mame/drivers/model3.c b/src/mame/drivers/model3.c index 83a38c64e2f..7c469610651 100644 --- a/src/mame/drivers/model3.c +++ b/src/mame/drivers/model3.c @@ -664,6 +664,12 @@ ALL VROM ROMs are 16M MASK #include "machine/nvram.h" #include "includes/model3.h" +//#define DECRYPT_ANALYSIS_HACKS + +#ifdef DECRYPT_ANALYSIS_HACKS +int readcount = 0; +int segcount = 0; +#endif void model3_state::update_irq_state() { @@ -1710,22 +1716,8 @@ static const UINT16 eca_prot_data[] = 0x7470, 0x202e, 0x3123, 0x660a, 0x726f, 0x7420, 0x7365, 0x0a74, }; -static const UINT16 oceanhun_prot_data[] = -{ - 0x0000, // dummy read - 0x3d3d, 0x203d, 0x434f, 0x4145, 0x204e, 0x5548, 0x544e, 0x5245, - 0x3d20, 0x3d3d, 0x430a, 0x706f, 0x5279, 0x6769, 0x7468, 0x5320, - 0x4745, 0x2041, 0x6e45, 0x6574, 0x7072, 0x6972, 0x6573, 0x2c73, - 0x4c20, 0x6474, 0x0a2e, 0x6d41, 0x7375, 0x6d65, 0x6e65, 0x2074, - 0x2652, 0x2044, 0x6544, 0x7470, 0x202e, 0x3123, 0x4b0a, 0x7a61, - 0x6e75, 0x7261, 0x2069, 0x7354, 0x6b75, 0x6d61, 0x746f, 0x206f, - 0x6553, 0x7463, 0x6f69, 0x206e, 0x614d, 0x616e, 0x6567, 0x0a72 -}; -/* - dirtdvls: first 2 words read are discarded, then every other word - is written to char RAM starting at f1013400 (in between words are - discarded). -*/ + + READ64_MEMBER(model3_state::model3_security_r) { @@ -1736,6 +1728,11 @@ READ64_MEMBER(model3_state::model3_security_r) case 0x00 / 8: retvalue = 0; break; /* status */ case 0x1c/8: /* security board data read */ { + #ifdef DECRYPT_ANALYSIS_HACKS + readcount += 2; + printf("model3_security_r offset %08x : %08x%08x (%08x%08x) count %08x\n", offset * 8, (UINT32)(retvalue >> 32), (UINT32)(retvalue & 0xffffffff), (UINT32)(mem_mask >> 32), (UINT32)(mem_mask & 0xffffffff), readcount); + #endif + if (core_stricmp(machine().system().name, "fvipers2") == 0) { UINT64 data = (UINT64)fvipers2_prot_data[m_prot_data_ptr++] << 16; @@ -1765,19 +1762,6 @@ READ64_MEMBER(model3_state::model3_security_r) } retvalue = data; } - else if (core_stricmp(machine().system().name, "oceanhun") == 0) - { - UINT64 data = (UINT64)oceanhun_prot_data[m_prot_data_ptr++] << 16; - if (m_prot_data_ptr >= 58) - { - m_prot_data_ptr = 0; - } - retvalue = data; - } - else if (core_stricmp(machine().system().name, "dirtdvls") == 0) - { - retvalue = U64(0xffffffffffffffff); - } else { retvalue = 0; @@ -1785,11 +1769,57 @@ READ64_MEMBER(model3_state::model3_security_r) break; } } - printf("model3_security_r offset %08x : %08x%08x (%08x%08x)\n", offset * 8, (UINT32)(retvalue >> 32), (UINT32)(retvalue & 0xffffffff), (UINT32)(mem_mask >> 32), (UINT32)(mem_mask & 0xffffffff)); return retvalue; } + + +WRITE64_MEMBER(model3_state::model3_security_w) +{ + if (offset == 0x10 / 8) + { + if (data != 0) + printf("model3_security_w address isn't 0?\n"); + + first_read = 1; + + printf("setting base %08x%08x\n", (UINT32)(data >> 32), (UINT32)(data & 0xffffffff)); + } + else if (offset == 0x18 / 8) + { + UINT16 subkey = data >> (32 + 16); + subkey = ((subkey & 0xff00) >> 8) | ((subkey & 0x00ff) << 8); // endian swap the sub-key for this hardware + printf("model3_5881prot_w setting subkey %04x\n", subkey); + +#ifdef DECRYPT_ANALYSIS_HACKS // dump out a copy of protection RAM + FILE* fp2; + char filename[256]; + sprintf(filename,"xxxencrypted_%s_part%d", machine().system().name, segcount); + segcount++; + readcount = 0; + fp2 = fopen(filename, "w+b"); + + { + for (int i = 0; i < 0x8000; i++) + { + UINT16 dat = m_maincpu->space().read_word((0xf0180000 + 4 * i)); + UINT8* dst2 = (UINT8*)&dat; + fwrite(&dst2[1], 1, 1, fp2); + fwrite(&dst2[0], 1, 1, fp2); + } + + } + fclose(fp2); +#endif + + } + else + { + printf("model3_5881prot_w offset %08x : %08x%08x (%08x%08x)\n", offset * 8, (UINT32)(data >> 32), (UINT32)(data & 0xffffffff), (UINT32)(mem_mask >> 32), (UINT32)(mem_mask & 0xffffffff)); + } +} + READ64_MEMBER(model3_state::model3_5881prot_r) { UINT64 retvalue = U64(0xffffffffffffffff); @@ -1851,9 +1881,6 @@ WRITE64_MEMBER(model3_state::model3_5881prot_w) { printf("model3_5881prot_w offset %08x : %08x%08x (%08x%08x)\n", offset * 8, (UINT32)(data >> 32), (UINT32)(data & 0xffffffff), (UINT32)(mem_mask >> 32), (UINT32)(mem_mask & 0xffffffff)); } - - - } WRITE64_MEMBER(model3_state::daytona2_rombank_w) @@ -5548,7 +5575,7 @@ static MACHINE_CONFIG_DERIVED(scud, model3_15) MCFG_SOUND_ROUTE(1, "rspeaker", 1.0) MACHINE_CONFIG_END -static MACHINE_CONFIG_START( model3_20, model3_state ) +static MACHINE_CONFIG_START(model3_20, model3_state) MCFG_CPU_ADD("maincpu", PPC603R, 166000000) MCFG_PPC_BUS_FREQUENCY(66000000) /* Multiplier 2.5, Bus = 66MHz, Core = 166MHz */ MCFG_CPU_PROGRAM_MAP(model3_mem) @@ -5557,8 +5584,8 @@ static MACHINE_CONFIG_START( model3_20, model3_state ) MCFG_CPU_ADD("audiocpu", M68000, 12000000) MCFG_CPU_PROGRAM_MAP(model3_snd) - MCFG_MACHINE_START_OVERRIDE(model3_state,model3_20) - MCFG_MACHINE_RESET_OVERRIDE(model3_state,model3_20) + MCFG_MACHINE_START_OVERRIDE(model3_state, model3_20) + MCFG_MACHINE_RESET_OVERRIDE(model3_state, model3_20) MCFG_EEPROM_SERIAL_93C46_ADD("eeprom") MCFG_NVRAM_ADD_1FILL("backup") @@ -5585,12 +5612,12 @@ static MACHINE_CONFIG_START( model3_20, model3_state ) MCFG_SOUND_ROUTE(0, "rspeaker", 2.0) MACHINE_CONFIG_END -static MACHINE_CONFIG_DERIVED( model3_20_5881, model3_20 ) +static MACHINE_CONFIG_DERIVED(model3_20_5881, model3_20) MCFG_DEVICE_ADD("315_5881", SEGA315_5881_CRYPT, 0) MCFG_SET_READ_CALLBACK(model3_state, crypt_read_callback) MACHINE_CONFIG_END -static MACHINE_CONFIG_START( model3_21, model3_state ) +static MACHINE_CONFIG_START(model3_21, model3_state) MCFG_CPU_ADD("maincpu", PPC603R, 166000000) MCFG_PPC_BUS_FREQUENCY(66000000) /* Multiplier 2.5, Bus = 66MHz, Core = 166MHz */ MCFG_CPU_PROGRAM_MAP(model3_mem) @@ -5599,8 +5626,8 @@ static MACHINE_CONFIG_START( model3_21, model3_state ) MCFG_CPU_ADD("audiocpu", M68000, 12000000) MCFG_CPU_PROGRAM_MAP(model3_snd) - MCFG_MACHINE_START_OVERRIDE(model3_state,model3_21) - MCFG_MACHINE_RESET_OVERRIDE(model3_state,model3_21) + MCFG_MACHINE_START_OVERRIDE(model3_state, model3_21) + MCFG_MACHINE_RESET_OVERRIDE(model3_state, model3_21) MCFG_EEPROM_SERIAL_93C46_ADD("eeprom") MCFG_NVRAM_ADD_1FILL("backup") @@ -5627,6 +5654,7 @@ static MACHINE_CONFIG_START( model3_21, model3_state ) MCFG_SOUND_ROUTE(0, "rspeaker", 2.0) MACHINE_CONFIG_END + UINT16 model3_state::crypt_read_callback(UINT32 addr) { UINT16 dat = 0; @@ -5637,6 +5665,7 @@ UINT16 model3_state::crypt_read_callback(UINT32 addr) // dat = ((dat & 0xff00) >> 8) | ((dat & 0x00ff) << 8); // printf("reading %04x\n", dat); + return dat; } @@ -5691,7 +5720,7 @@ DRIVER_INIT_MEMBER(model3_state, genprot) } else { - m_maincpu->space(AS_PROGRAM).install_read_handler(0xf01a0000, 0xf01a003f, 0, 0x0e000000, read64_delegate(FUNC(model3_state::model3_security_r), this) ); + m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0xf01a0000, 0xf01a003f, 0, 0x0e000000, read64_delegate(FUNC(model3_state::model3_security_r), this), write64_delegate(FUNC(model3_state::model3_security_w), this) ); } } @@ -5925,6 +5954,7 @@ DRIVER_INIT_MEMBER(model3_state,swtrilga) { //UINT32 *rom = (UINT32*)memregion("user1")->base(); DRIVER_INIT_CALL(model3_20); + DRIVER_INIT_CALL(genprot); //rom[(0xf6dd0^4)/4] = 0x60000000; } @@ -5934,6 +5964,7 @@ DRIVER_INIT_MEMBER(model3_state,von2) m_step20_with_old_real3d = true; DRIVER_INIT_CALL(model3_20); + DRIVER_INIT_CALL(genprot); } DRIVER_INIT_MEMBER(model3_state,dirtdvls) @@ -5956,6 +5987,8 @@ DRIVER_INIT_MEMBER(model3_state,daytona2) rom[(0x6063c4^4)/4] = 0x60000000; rom[(0x616434^4)/4] = 0x60000000; rom[(0x69f4e4^4)/4] = 0x60000000; + + DRIVER_INIT_CALL(genprot); } DRIVER_INIT_MEMBER(model3_state,dayto2pe) @@ -5971,6 +6004,8 @@ DRIVER_INIT_MEMBER(model3_state,dayto2pe) rom[(0x618b28^4)/4] = 0x60000000; // jump to encrypted code rom[(0x64ca34^4)/4] = 0x60000000; // dec + + DRIVER_INIT_CALL(genprot); } DRIVER_INIT_MEMBER(model3_state,spikeout) @@ -6027,6 +6062,7 @@ DRIVER_INIT_MEMBER(model3_state,magtruck) m_step20_with_old_real3d = true; DRIVER_INIT_CALL(model3_20); + DRIVER_INIT_CALL(genprot); } DRIVER_INIT_MEMBER(model3_state,lamachin) @@ -6034,6 +6070,7 @@ DRIVER_INIT_MEMBER(model3_state,lamachin) m_step20_with_old_real3d = true; DRIVER_INIT_CALL(model3_20); + DRIVER_INIT_CALL(genprot); } @@ -6061,13 +6098,13 @@ GAME( 1998, vs29815, vs298, model3_15, model3, model3_state, vs29815, ROT0 GAME( 1997, vs2, 0, model3_20, model3, model3_state, vs2, ROT0, "Sega", "Virtua Striker 2 (Step 2.0)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1997, harley, 0, model3_20, harley, model3_state, harley, ROT0, "Sega", "Harley-Davidson and L.A. Riders (Revision B)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1997, harleya, harley, model3_20, harley, model3_state, harleya, ROT0, "Sega", "Harley-Davidson and L.A. Riders (Revision A)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) -GAME( 1998, lamachin, 0, model3_20, model3, model3_state, lamachin, ROT0, "Sega", "L.A. Machineguns", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) +GAME( 1998, lamachin, 0, model3_20_5881, model3, model3_state, lamachin, ROT0, "Sega", "L.A. Machineguns", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, oceanhun, 0, model3_20_5881, model3, model3_state, oceanhun, ROT0, "Sega", "The Ocean Hunter", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, skichamp, 0, model3_20, skichamp, model3_state, skichamp, ROT0, "Sega", "Ski Champ", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, srally2, 0, model3_20, scud, model3_state, srally2, ROT0, "Sega", "Sega Rally 2", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, srally2x, 0, model3_20, scud, model3_state, srally2, ROT0, "Sega", "Sega Rally 2 DX", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) -GAME( 1998, von2, 0, model3_20, model3, model3_state, von2, ROT0, "Sega", "Virtual On 2: Oratorio Tangram (Revision B)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) -GAME( 1998, von254g, von2, model3_20, model3, model3_state, von2, ROT0, "Sega", "Virtual On 2: Oratorio Tangram (ver 5.4g)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) +GAME( 1998, von2, 0, model3_20_5881, model3, model3_state, von2, ROT0, "Sega", "Virtual On 2: Oratorio Tangram (Revision B)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) +GAME( 1998, von254g, von2, model3_20_5881, model3, model3_state, von2, ROT0, "Sega", "Virtual On 2: Oratorio Tangram (ver 5.4g)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, fvipers2, 0, model3_20_5881, model3, model3_state, vs299, ROT0, "Sega", "Fighting Vipers 2 (Revision A)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, vs298, 0, model3_20_5881, model3, model3_state, vs298, ROT0, "Sega", "Virtua Striker 2 '98 (Step 2.0)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1999, vs2v991, 0, model3_20_5881, model3, model3_state, vs299, ROT0, "Sega", "Virtua Striker 2 '99.1 (Revision B)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) @@ -6076,15 +6113,15 @@ GAME( 1999, vs299a, vs2v991, model3_20_5881, model3, model3_state, vs299, GAME( 1999, vs299, vs2v991, model3_20_5881, model3, model3_state, vs299, ROT0, "Sega", "Virtua Striker 2 '99", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) /* Model 3 Step 2.1 */ -GAME( 1998, daytona2, 0, model3_21, daytona2, model3_state, daytona2, ROT0, "Sega", "Daytona USA 2 (Revision A)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) -GAME( 1998, dayto2pe, 0, model3_21, daytona2, model3_state, dayto2pe, ROT0, "Sega", "Daytona USA 2 Power Edition", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) +GAME( 1998, daytona2, 0, model3_21_5881, daytona2, model3_state, daytona2, ROT0, "Sega", "Daytona USA 2 (Revision A)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) +GAME( 1998, dayto2pe, 0, model3_21_5881, daytona2, model3_state, dayto2pe, ROT0, "Sega", "Daytona USA 2 Power Edition", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, dirtdvls, 0, model3_21_5881, scud, model3_state, dirtdvls, ROT0, "Sega", "Dirt Devils (set 1) (Revision A)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, dirtdvlsa, dirtdvls, model3_21_5881, scud, model3_state, dirtdvls, ROT0, "Sega", "Dirt Devils (set 2) (Revision A)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, swtrilgy, 0, model3_21_5881, swtrilgy, model3_state, swtrilgy, ROT0, "Sega / LucasArts", "Star Wars Trilogy (Revision A)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, swtrilgya, swtrilgy, model3_21_5881, swtrilgy, model3_state, swtrilga, ROT0, "Sega / LucasArts", "Star Wars Trilogy", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, spikeout, 0, model3_21_5881, model3, model3_state, spikeout, ROT0, "Sega", "Spikeout (Revision C)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1998, spikeofe, 0, model3_21_5881, model3, model3_state, spikeofe, ROT0, "Sega", "Spikeout Final Edition", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) -GAME( 1998, magtruck, 0, model3_21, eca, model3_state, magtruck, ROT0, "Sega", "Magical Truck Adventure", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) +GAME( 1998, magtruck, 0, model3_21_5881, eca, model3_state, magtruck, ROT0, "Sega", "Magical Truck Adventure", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1999, eca, 0, model3_21_5881, eca, model3_state, eca, ROT0, "Sega", "Emergency Call Ambulance", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1999, ecax, eca, model3_21_5881, eca, model3_state, eca, ROT0, "Sega", "Emergency Call Ambulance (Export)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) GAME( 1999, ecap, eca, model3_21_5881, eca, model3_state, eca, ROT0, "Sega", "Emergency Call Ambulance (US location test?)", GAME_NOT_WORKING | GAME_IMPERFECT_GRAPHICS | GAME_IMPERFECT_SOUND ) diff --git a/src/mame/includes/model3.h b/src/mame/includes/model3.h index 82b40ce1b25..340ae9904c7 100644 --- a/src/mame/includes/model3.h +++ b/src/mame/includes/model3.h @@ -231,6 +231,9 @@ public: DECLARE_READ64_MEMBER(network_r); DECLARE_WRITE64_MEMBER(network_w); DECLARE_READ64_MEMBER(model3_security_r); + DECLARE_WRITE64_MEMBER(model3_security_w); + + DECLARE_WRITE64_MEMBER(daytona2_rombank_w); DECLARE_WRITE16_MEMBER(model3snd_ctrl); UINT32 pci_device_get_reg(); diff --git a/src/mame/machine/315-5881_helper.c b/src/mame/machine/315-5881_helper.c index 80658009d33..ec31f78223d 100644 --- a/src/mame/machine/315-5881_helper.c +++ b/src/mame/machine/315-5881_helper.c @@ -150,8 +150,14 @@ static const struct game_keys keys_table[] = { "eca", -1 }, // ???? 317-0265-COM Model 3 { "ecax", -1 }, // ???? 317-0265-COM Model 3 { "ecap", -1 }, // ???? 317-0265-COM Model 3 - { "spikeout", -1 }, // ???? ? Model 3 - { "spikeofe", -1 }, // ???? ? Model 3 + { "spikeout", -1 }, // ???? 317-0247-COM Model 3 + { "spikeofe", -1 }, // ???? 317-0247-COM Model 3 + { "lamachin", -1 }, // ???? 317-0244-COM Model 3 + { "magtruck", -1 }, // ???? ? Model 3 + { "von2", -1 }, // ???? ? Model 3 + { "von254g", -1 }, // ???? ? Model 3 + { "daytona2", -1 }, // ???? ? Model 3 + { "dayto2pe", -1 }, // ???? ? Model 3 { NULL, 0 } // end of table