Sprinter/mame
2
0
Fork 0
mirror of https://github.com/holub/mame synced 2025-06-03 03:16:30 +03:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

viper.c: more notes about the DS2430 (nw)

Browse Source
This commit is contained in:
Guru 2014-12-11 08:41:00 +00:00
parent 49d7b3dfdf
commit 5fdef925ef
1 changed files with 24 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/mame/drivers/viper.c
View File

@ -84,10 +84,12 @@ MB81G163222-80 - Fujitsu MB81G163222-80 256k x 32-bit x 2 banks Synchronous Grap
(application register reads all 0xFF and the status register reads back 0xFF), so it's probably safe (application register reads all 0xFF and the status register reads back 0xFF), so it's probably safe
to assume they're not used on any of them. to assume they're not used on any of them.
It appears the DS2430 is not protected from reading and the unique silicon serial number is It appears the DS2430 is not protected from reading and the unique silicon serial number is
included in the 40 byte dump. In the Police 911 2 NVRAM dump the serial number is located at both 0x002A and 0x1026 included in the 40 byte dump. This serial number is used as a check to verify the NVRAM and DS2430.
so that means it is tied to the DS2430. If the serial number in the NVRAM and DS2430 match then they are In the Police 911 2 NVRAM dump the serial number of the DS2430 is located at 0x002A and 0x1026
paired. The same serial number is likely present in the CF card image and a compare is done there too. If the serial number in the NVRAM and DS2430 match then they are paired and the game accepts the NVRAM.
If they don't match the game requires an external DS2430 (i.e. dongle) If they don't match the game requires an external DS2430 (i.e. dongle) and flags the NVRAM as 'BAD'
The serial number is not present in the CF card (2 different Police 911 2 cards of the same version
were dumped and matched).
When the lasered ROM is read from the DS2430, it comes out from LSB to MSB (family code, LSB of When the lasered ROM is read from the DS2430, it comes out from LSB to MSB (family code, LSB of
S/N->MSB of S/N, CRC) S/N->MSB of S/N, CRC)
For Police 911 2 that is 0x14 0xB2 0xB7 0x4A 0x00 0x00 0x00 0x83 For Police 911 2 that is 0x14 0xB2 0xB7 0x4A 0x00 0x00 0x00 0x83
@ -102,6 +104,23 @@ MB81G163222-80 - Fujitsu MB81G163222-80 256k x 32-bit x 2 banks Synchronous Grap
It may be possible to hand craft a DS2430 for a dongle-protected version of a game simply by using It may be possible to hand craft a DS2430 for a dongle-protected version of a game simply by using
one of the existing DS2430 dumps and adjusting the serial number found in a dump of the NVRAM to pair them one of the existing DS2430 dumps and adjusting the serial number found in a dump of the NVRAM to pair them
or adjusting the serial number in the NVRAM to match the serial number found in one of the dumped DS2430s. or adjusting the serial number in the NVRAM to match the serial number found in one of the dumped DS2430s.
This Police 911 2 board was upgraded from Police 911 by plugging in the dongle and changing the CF card.
The NVRAM had previously died and the board was dead. Normally for a Viper game that is fatal. Using
the NVRAM from Police 911 allowed it to boot and then the NVRAM upgraded itself with some additional
data (the original data remained untouched). This means the dongle does more than just protect the game.
Another interesting fact about this upgrade is it has been discovered that the PCB can write to the
external DS2430 in the dongle. This has been proven because the serial number of the DS2430 soldered
on the PCB is present in the EEPROM area of the Police 911 2 DS2430.
Here is a dump of the DS2430 from Police 911. Note the EEPROM area is empty and the serial number (from 0x20 onwards)
is present in the above Police 911 2 DS2430 dump at locations 0x11, 0x10 and 0x0F
00000000h FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000010h FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000020h 14 A9 30 74 00 00 00 E7
This proves that the EEPROM area in the DS2430 is unused by an unprotected game and in fact the on-board
DS2430 is completely unused by an unprotected game. That is why any unprotected game will work on any
Viper PCB regardless of the on-board DS2430 serial number.
The existing DS2430 'common' dump used in the unprotected games was actually from a (dongle-protected)
Mahjong Fight Club PCB but that PCB was used to test and run all of the unprotected Viper games.
M48T58Y - ST Microelectronics M48T58Y Timekeeper RAM (DIP28 @ U39). When this dies (after 10 year lifespan) M48T58Y - ST Microelectronics M48T58Y Timekeeper RAM (DIP28 @ U39). When this dies (after 10 year lifespan)
the game will complain with error RTC BAD then reset. The data inside the RTC can not be hand created the game will complain with error RTC BAD then reset. The data inside the RTC can not be hand created
(yet) so to revive the PCB the correct RTC data must be re-programmed to a new RTC and replaced (yet) so to revive the PCB the correct RTC data must be re-programmed to a new RTC and replaced
@ -114,7 +133,7 @@ MB81G163222-80 - Fujitsu MB81G163222-80 256k x 32-bit x 2 banks Synchronous Grap
required and plugged in it overrides the DS2430 on the main board. Without the (on-board) required and plugged in it overrides the DS2430 on the main board. Without the (on-board)
DS2430 the PCB will complain after the CF check with HARDWARE ERROR. If the DS2430 is not DS2430 the PCB will complain after the CF check with HARDWARE ERROR. If the DS2430 is not
correct for the game the error given is RTC BAD even if the RTC is correct. Most games don't require correct for the game the error given is RTC BAD even if the RTC is correct. Most games don't require
a dongle and use the factory DS2430 on the main board. a dongle and accept any DS2430 on the main board.
CN12 - 4 pin connector (possibly stereo audio output?) CN12 - 4 pin connector (possibly stereo audio output?)
CN13 - Power connector for plug-in daughterboard CN13 - Power connector for plug-in daughterboard
CN15/CN16 - Multi-pin IDC connectors for plug-in daughterboard (see detail below) CN15/CN16 - Multi-pin IDC connectors for plug-in daughterboard (see detail below)