mirror of
https://github.com/holub/mame
synced 2025-10-06 09:00:04 +03:00
Improvements to Dragon World 3 protection simulation, game seems mostly playable now although a DMA mode copying 68k code to RAM is still missing [iq_132]
This commit is contained in:
David Haywood
parent
a8d5c35583
commit
620f455f6b
@ -977,7 +977,7 @@ ROM_START( drgw3 )
|
||||
ROM_LOAD16_BYTE( "dw3_v106.u13", 0x100000, 0x080000, CRC(28284e22) SHA1(4643a69881ddb7383ca10f3eb2aa2cf41be39e9f) )
|
||||
|
||||
ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data - is it correct for this set? */
|
||||
ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
|
||||
ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
|
||||
|
||||
ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
|
||||
PGM_VIDEO_BIOS
|
||||
@ -1003,7 +1003,7 @@ ROM_START( drgw3105 )
|
||||
ROM_LOAD16_BYTE( "dw3_v105.u13", 0x100000, 0x080000, CRC(8d6c9d39) SHA1(cb79303ab551e91f07e11414db4254d5b161d415) )
|
||||
|
||||
ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data - is it correct for this set? */
|
||||
ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
|
||||
ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
|
||||
|
||||
ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
|
||||
PGM_VIDEO_BIOS
|
||||
@ -1051,7 +1051,7 @@ ROM_START( drgw3100 )
|
||||
ROM_LOAD16_BYTE( "dw3_v100.u13", 0x100000, 0x080000, CRC(b7cded21) SHA1(c1ae2af2e42227503c81bbcd2bd6862aa416bd78) )
|
||||
|
||||
ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */
|
||||
ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
|
||||
ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
|
||||
|
||||
ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
|
||||
PGM_VIDEO_BIOS
|
||||
@ -1103,7 +1103,7 @@ ROM_START( dwex )
|
||||
ROM_LOAD16_BYTE( "ex_v100.u13", 0x100000, 0x080000, CRC(7afe6322) SHA1(a52d71af1d6de16c5a3df23eacdab3466693ba8d) )
|
||||
|
||||
ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */
|
||||
ROM_LOAD16_WORD_SWAP( "ex_data.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
|
||||
ROM_LOAD( "ex_data.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
|
||||
|
||||
ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
|
||||
PGM_VIDEO_BIOS
|
||||
@ -1861,7 +1861,7 @@ ROM_START( killbld )
|
||||
ROM_LOAD16_WORD_SWAP( "p0300_v109.u9", 0x100000, 0x200000, CRC(2fcee215) SHA1(855281a9090bfdf3da9f4d50c121765131a13400) )
|
||||
|
||||
ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */
|
||||
ROM_LOAD16_WORD_SWAP( "kb_u2.rom", 0x000000, 0x010000, CRC(de3eae63) SHA1(03af767ef764055bda528b5cc6a24b9e1218cca8) )
|
||||
ROM_LOAD( "kb_u2.rom", 0x000000, 0x010000, CRC(de3eae63) SHA1(03af767ef764055bda528b5cc6a24b9e1218cca8) )
|
||||
|
||||
ROM_REGION( 0x800000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
|
||||
PGM_VIDEO_BIOS
|
||||
@ -1897,7 +1897,7 @@ ROM_START( killbld104 )
|
||||
ROM_LOAD16_BYTE( "kb_u5_v104.u5", 0x200000, 0x080000, CRC(a0bafc29) SHA1(b20db7c16353c6f87ed3c08c9d037b07336711f1) )
|
||||
|
||||
ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */
|
||||
ROM_LOAD16_WORD_SWAP( "kb_u2_v104.u2", 0x000000, 0x010000, CRC(c970f6d5) SHA1(399fc6f80262784c566363c847dc3fdc4fb37494) )
|
||||
ROM_LOAD( "kb_u2_v104.u2", 0x000000, 0x010000, CRC(c970f6d5) SHA1(399fc6f80262784c566363c847dc3fdc4fb37494) )
|
||||
|
||||
ROM_REGION( 0x800000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
|
||||
PGM_VIDEO_BIOS
|
||||
@ -4014,8 +4014,15 @@ GAME( 1997, dw2v100x, drgw2, pgm_012_025_drgw2, pgm, pgm_012_025_sta
|
||||
GAME( 1997, drgw2j, drgw2, pgm_012_025_drgw2, pgm, pgm_012_025_state, drgw2j, ROT0, "IGS", "Chuugokuryuu II (ver. 100J, Japan)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE )
|
||||
GAME( 1997, drgw2c, drgw2, pgm_012_025_drgw2, pgm, pgm_012_025_state, drgw2c, ROT0, "IGS", "Zhong Guo Long II (ver. 100C, China)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE )
|
||||
|
||||
GAME( 1998, killbld, pgm, pgm_022_025_kb, killbld, pgm_022_025_state, killbld, ROT0, "IGS", "The Killing Blade (ver. 109, Chinese Board)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
|
||||
GAME( 1998, killbld104, killbld, pgm_022_025_kb, killbld, pgm_022_025_state, killbld, ROT0, "IGS", "The Killing Blade (ver. 104)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
|
||||
GAME( 1998, killbld, pgm, pgm_022_025, killbld, pgm_022_025_state, killbld, ROT0, "IGS", "The Killing Blade (ver. 109, Chinese Board)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
|
||||
GAME( 1998, killbld104, killbld, pgm_022_025, killbld, pgm_022_025_state, killbld, ROT0, "IGS", "The Killing Blade (ver. 104)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
|
||||
|
||||
// these seem playable but the DMA mode transfering 68k code to RAM is not emulated so there could still be problems
|
||||
GAME( 1998, drgw3, pgm, pgm_022_025, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 106, Korean Board)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
|
||||
GAME( 1998, drgw3105, drgw3, pgm_022_025, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 105)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
|
||||
GAME( 1998, drgw3100, drgw3, pgm_022_025, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 100)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) // Japan Only?
|
||||
|
||||
GAME( 1998, dwex, pgm, pgm_022_025, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 EX (ver. 100)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
|
||||
|
||||
// region provided by internal ARM rom
|
||||
GAME( 1999, photoy2k, pgm, pgm_arm_type1, photoy2k, pgm_arm_type1_state, photoy2k, ROT0, "IGS", "Photo Y2K (ver. 105)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
|
||||
@ -4134,14 +4141,6 @@ GAME( 1999, kovsgqyzb, kovplus, pgm_arm_type1_sim, sango_ch, pgm_arm_ty
|
||||
NOT Working (mostly due to needing internal protection roms dumped)
|
||||
-----------------------------------------------------------------------------------------------------------------------*/
|
||||
|
||||
// should have DMA protection, like killbld, as well as the math / bitswap / memory manipulation stuff, but it never attempts to trigger the DMA? - we currently have a RAM dump to allow it to boot, but I think this stuff should be DMA copied into RAM, like killbld
|
||||
GAME( 1998, drgw3, pgm, pgm_022_025_dw, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 106, Korean Board)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE )
|
||||
GAME( 1998, drgw3105, drgw3, pgm_022_025_dw, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 105)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE )
|
||||
GAME( 1998, drgw3100, drgw3, pgm_022_025_dw, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 100)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) // Japan Only?
|
||||
|
||||
GAME( 1998, dwex, pgm, pgm_022_025_dw, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 EX (ver. 100)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE )
|
||||
|
||||
|
||||
GAME( 1999, puzlstar, pgm, pgm_arm_type1_sim, pstar, pgm_arm_type1_state, pstar, ROT0, "IGS", "Puzzle Star (ver. 100MG)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
|
||||
|
||||
GAME( 2001, py2k2, pgm, pgm_arm_type1_sim, py2k2, pgm_arm_type1_state, py2k2, ROT0, "IGS", "Photo Y2K 2", GAME_NOT_WORKING ) /* need internal rom of IGS027A */
|
||||
|
||||
@ -65,7 +65,6 @@ public:
|
||||
UINT8 m_cal_cnt;
|
||||
system_time m_systime;
|
||||
|
||||
|
||||
DECLARE_READ16_MEMBER(pgm_videoram_r);
|
||||
DECLARE_WRITE16_MEMBER(pgm_videoram_w);
|
||||
DECLARE_WRITE16_MEMBER(pgm_coin_counter_w);
|
||||
@ -148,12 +147,14 @@ public:
|
||||
UINT8 m_asic3_reg;
|
||||
UINT8 m_asic3_latch[3];
|
||||
UINT8 m_asic3_x;
|
||||
UINT8 m_asic3_y;
|
||||
UINT8 m_asic3_z;
|
||||
UINT8 m_asic3_h1;
|
||||
UINT8 m_asic3_h2;
|
||||
UINT8 m_asic3_y;
|
||||
UINT8 m_asic3_z;
|
||||
UINT16 m_asic3_h1;
|
||||
UINT16 m_asic3_h2;
|
||||
UINT16 m_asic3_hold;
|
||||
|
||||
|
||||
|
||||
DECLARE_DRIVER_INIT(orlegend);
|
||||
void asic3_compute_hold();
|
||||
DECLARE_READ16_MEMBER( pgm_asic3_r );
|
||||
@ -279,7 +280,7 @@ public:
|
||||
UINT8 coverage[256]; // coverage is how much of the table we've managed to verify using known facts about the table structure
|
||||
|
||||
int command_31_write_type;
|
||||
|
||||
|
||||
|
||||
// the maximum level size returned or read by the device appears to be this size
|
||||
UINT16 level_structure[8][10];
|
||||
@ -399,14 +400,13 @@ public:
|
||||
int m_kb_reg;
|
||||
int m_kb_ptr;
|
||||
UINT8 m_kb_swap;
|
||||
UINT32 m_kb_regs[0x10];
|
||||
UINT32 m_kb_regs[0x100];
|
||||
|
||||
required_shared_ptr<UINT16> m_sharedprotram;
|
||||
|
||||
DECLARE_DRIVER_INIT(killbld);
|
||||
DECLARE_DRIVER_INIT(drgw3);
|
||||
DECLARE_MACHINE_RESET(killbld);
|
||||
DECLARE_MACHINE_RESET(dw3);
|
||||
void pgm_dw3_decrypt();
|
||||
void pgm_killbld_decrypt();
|
||||
void killbld_protection_calculate_hilo();
|
||||
@ -555,8 +555,7 @@ MACHINE_CONFIG_EXTERN( pgm_arm_type3 );
|
||||
|
||||
/*----------- defined in machine/pgmprot4.c -----------*/
|
||||
|
||||
MACHINE_CONFIG_EXTERN( pgm_022_025_kb );
|
||||
MACHINE_CONFIG_EXTERN( pgm_022_025_dw );
|
||||
MACHINE_CONFIG_EXTERN( pgm_022_025 );
|
||||
|
||||
INPUT_PORTS_EXTERN( killbld );
|
||||
INPUT_PORTS_EXTERN( dw3 );
|
||||
|
||||
@ -5,10 +5,8 @@
|
||||
used on the following PGM games
|
||||
|
||||
The Killing Blade
|
||||
Dragon World 3*
|
||||
Dragon World 3 EX*
|
||||
|
||||
* preliminary, not working
|
||||
Dragon World 3
|
||||
Dragon World 3 EX
|
||||
|
||||
----
|
||||
|
||||
@ -26,10 +24,10 @@
|
||||
/* The IGS022 is an MCU which performs encrypted DMA used by
|
||||
- The Killing Blade
|
||||
- Dragon World 3
|
||||
- Dragon World 3 Ex
|
||||
|
||||
There is also an automatic transfer which happens on startup using params stored in the data ROM.
|
||||
This has been verified on real hardware running without any 68k game program.
|
||||
|
||||
*/
|
||||
|
||||
void pgm_022_025_state::pgm_dw3_decrypt()
|
||||
@ -187,8 +185,9 @@ static const UINT8 killbld_source_data[0x0c][0xec] = // offsets to these tables
|
||||
|
||||
// all tables xored with data from $149c4c
|
||||
// tables are the same as olds and drgw2
|
||||
static const UINT8 dw3_source_data[0x07][0xec] =
|
||||
static const UINT8 dw3_source_data[0x08][0xec] =
|
||||
{
|
||||
{ 0, },
|
||||
{ // region 1, $14c21a
|
||||
0x67, 0x51, 0xf3, 0x19, 0xa0, 0x09, 0xb1, 0x21, 0xb0, 0xee, 0xe3, 0xf6, 0xbe, 0x81, 0x35, 0xe3,
|
||||
0xfb, 0xe6, 0xef, 0xdf, 0x61, 0x01, 0xfa, 0x22, 0x5d, 0x43, 0x01, 0xa5, 0x3b, 0x17, 0xd4, 0x74,
|
||||
@ -325,8 +324,6 @@ void pgm_022_025_state::IGS022_do_dma(UINT16 src, UINT16 dst, UINT16 size, UINT1
|
||||
1,2,3 table based ops
|
||||
*/
|
||||
|
||||
//mame_printf_debug("src %04x dst %04x size %04x mode %04x\n", src, dst, size, mode);
|
||||
|
||||
param = mode >> 8;
|
||||
mode &=0xf; // what are the other bits?
|
||||
|
||||
@ -350,44 +347,41 @@ void pgm_022_025_state::IGS022_do_dma(UINT16 src, UINT16 dst, UINT16 size, UINT1
|
||||
UINT16 dat2 = PROTROM[src + x];
|
||||
|
||||
UINT8 extraoffset = param&0xff;
|
||||
UINT8* dectable = (UINT8*)memregion("igs022data")->base(); // the basic decryption table is at the start of the mcu data rom! at least in killbld
|
||||
UINT8* dectable = (UINT8*)memregion("igs022data")->base(); // the basic decryption table is at the start of the mcu data rom!
|
||||
UINT8 taboff = ((x*2)+extraoffset) & 0xff; // must allow for overflow in instances of odd offsets
|
||||
UINT16 extraxor = ((dectable[taboff+0]) << 8) | (dectable[taboff+1] << 0);
|
||||
|
||||
dat2 = ((dat2 & 0x00ff)<<8) | ((dat2 & 0xff00)>>8);
|
||||
UINT16 extraxor = ((dectable[taboff+1]) << 8) | (dectable[taboff+0] << 0);
|
||||
|
||||
// mode==0 plain
|
||||
if (mode==3) dat2 ^= extraxor;
|
||||
if (mode==2) dat2 += extraxor;
|
||||
if (mode==1) dat2 -= extraxor;
|
||||
|
||||
//if (dat!=dat2)
|
||||
// printf("Mode %04x Param %04x Mismatch %04x %04x\n", mode, param, dat, dat2);
|
||||
|
||||
m_sharedprotram[dst + x] = dat2;
|
||||
}
|
||||
|
||||
/* Killing Blade: hack, patches out some additional security checks... we need to emulate them instead! */
|
||||
// different region IGS025 devices supply different sequences - we currently only have the china sequence for Killing Blade
|
||||
//if ((mode==3) && (param==0x54) && (src*2==0x2120) && (dst*2==0x2600)) m_sharedprotram[0x2600 / 2] = 0x4e75;
|
||||
|
||||
}
|
||||
if (mode == 4)
|
||||
else if (mode == 4)
|
||||
{
|
||||
mame_printf_debug("unhandled copy mode %04x!\n", mode);
|
||||
|
||||
int x;
|
||||
for (x = 0; x < size; x++)
|
||||
{
|
||||
m_sharedprotram[dst + x] = 0x4e75; // Hack until algorithm for decoding this is figured out.
|
||||
}
|
||||
|
||||
// not used by killing blade
|
||||
/* looks almost like a fixed value xor, but isn't */
|
||||
}
|
||||
else if (mode == 5)
|
||||
{
|
||||
/* mode 5 seems to be a straight copy */
|
||||
/* mode 5 seems to be a straight copy, byteswap */
|
||||
int x;
|
||||
UINT16 *PROTROM = (UINT16*)memregion("igs022data")->base();
|
||||
for (x = 0; x < size; x++)
|
||||
{
|
||||
UINT16 dat = PROTROM[src + x];
|
||||
|
||||
m_sharedprotram[dst + x] = dat;
|
||||
m_sharedprotram[dst + x] = (dat << 8) | (dat >> 8);
|
||||
}
|
||||
}
|
||||
else if (mode == 6)
|
||||
@ -416,9 +410,9 @@ void pgm_022_025_state::IGS022_do_dma(UINT16 src, UINT16 dst, UINT16 size, UINT1
|
||||
else
|
||||
{
|
||||
mame_printf_debug("unhandled copy mode %04x!\n", mode);
|
||||
logerror ("DMA MODE: %d, src: %4.4x, dst: %4.4x, size: %4.4x, param: %2.2x\n", mode, src, dst, size, param);
|
||||
// not used by killing blade
|
||||
/* invalid? */
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@ -428,16 +422,15 @@ void pgm_022_025_state::IGS022_reset()
|
||||
{
|
||||
int i;
|
||||
UINT16 *PROTROM = (UINT16*)memregion("igs022data")->base();
|
||||
UINT16 tmp;
|
||||
|
||||
// fill ram with A5 patern
|
||||
for (i = 0; i < 0x4000/2; i++)
|
||||
m_sharedprotram[i] = 0xa55a;
|
||||
|
||||
// the auto-dma
|
||||
UINT16 src = PROTROM[0x100 / 2];
|
||||
UINT32 dst = PROTROM[0x102 / 2];
|
||||
UINT16 size = PROTROM[0x104/ 2];
|
||||
UINT16 src = PROTROM[0x100 / 2];
|
||||
UINT32 dst = PROTROM[0x102 / 2];
|
||||
UINT16 size = PROTROM[0x104 / 2];
|
||||
UINT16 mode = PROTROM[0x106 / 2];
|
||||
|
||||
src = ((src & 0xff00) >> 8) | ((src & 0x00ff) << 8);
|
||||
@ -447,23 +440,18 @@ void pgm_022_025_state::IGS022_reset()
|
||||
|
||||
src >>= 1;
|
||||
|
||||
// printf("Auto-DMA %04x %04x %04x %04x\n",src,dst,size,mode);
|
||||
|
||||
IGS022_do_dma(src,dst,size,mode);
|
||||
|
||||
// there is also a version ID? (or is it some kind of checksum) that is stored in the data rom, and gets copied..
|
||||
// Dragon World 3 checks it
|
||||
tmp = PROTROM[0x114/2];
|
||||
tmp = ((tmp & 0xff00) >> 8) | ((tmp & 0x00ff) << 8);
|
||||
m_sharedprotram[0x2a2/2] = tmp;
|
||||
// Setting $3002a0 to #3 causes Dragon World 3 to skip this check
|
||||
m_sharedprotram[0x2a2/2] = PROTROM[0x114/2];
|
||||
}
|
||||
|
||||
void pgm_022_025_state::IGS022_handle_command()
|
||||
{
|
||||
UINT16 cmd = m_sharedprotram[0x200/2];
|
||||
|
||||
//mame_printf_debug("command %04x\n", cmd);
|
||||
|
||||
if (cmd == 0x6d) // Store values to asic ram
|
||||
{
|
||||
UINT32 p1 = (m_sharedprotram[0x298/2] << 16) | m_sharedprotram[0x29a/2];
|
||||
@ -473,8 +461,9 @@ void pgm_022_025_state::IGS022_handle_command()
|
||||
{
|
||||
int reg = (p2 >> 16) & 0xffff;
|
||||
|
||||
if (reg & 0x200)
|
||||
if (reg & 0x300) { // 300?? killbld expects 0x200, drgw3 expects 0x100?
|
||||
m_kb_regs[reg & 0xff] = p1;
|
||||
}
|
||||
}
|
||||
|
||||
if ((p2 & 0xffff) == 0x6) // Add value
|
||||
@ -501,16 +490,34 @@ void pgm_022_025_state::IGS022_handle_command()
|
||||
m_sharedprotram[0x29c/2] = (m_kb_regs[reg] >> 16) & 0xffff;
|
||||
m_sharedprotram[0x29e/2] = m_kb_regs[reg] & 0xffff;
|
||||
}
|
||||
|
||||
m_sharedprotram[0x202 / 2] = 0x7c; // this mode complete?
|
||||
}
|
||||
|
||||
if(cmd == 0x4f) //memcpy with encryption / scrambling
|
||||
// Is this actually what this is suppose to do? Complete guess.
|
||||
if (cmd == 0x12) // copy??
|
||||
{
|
||||
UINT16 src = m_sharedprotram[0x290 / 2] >> 1; // ?
|
||||
UINT32 dst = m_sharedprotram[0x292 / 2];
|
||||
m_sharedprotram[0x28c / 2] = m_sharedprotram[0x288 / 2];
|
||||
m_sharedprotram[0x28e / 2] = m_sharedprotram[0x28a / 2];
|
||||
|
||||
m_sharedprotram[0x202 / 2] = 0x23; // this mode complete?
|
||||
}
|
||||
|
||||
// what do these do? write the completion byte for now...
|
||||
if (cmd == 0x45) m_sharedprotram[0x202 / 2] = 0x56;
|
||||
if (cmd == 0x5a) m_sharedprotram[0x202 / 2] = 0x4b;
|
||||
if (cmd == 0x2d) m_sharedprotram[0x202 / 2] = 0x3c;
|
||||
|
||||
if (cmd == 0x4f) // memcpy with encryption / scrambling
|
||||
{
|
||||
UINT16 src = m_sharedprotram[0x290 / 2] >> 1; // External mcu data is 8 bit and addressed as such
|
||||
UINT32 dst = m_sharedprotram[0x292 / 2];
|
||||
UINT16 size = m_sharedprotram[0x294 / 2];
|
||||
UINT16 mode = m_sharedprotram[0x296 / 2];
|
||||
|
||||
IGS022_do_dma(src,dst,size,mode);
|
||||
|
||||
m_sharedprotram[0x202 / 2] = 0x5e; // this mode complete?
|
||||
}
|
||||
}
|
||||
|
||||
@ -553,8 +560,6 @@ void pgm_022_025_state::killbld_protection_calculate_hilo()
|
||||
|
||||
WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w )
|
||||
{
|
||||
offset &= 0xf;
|
||||
|
||||
if (offset == 0)
|
||||
{
|
||||
m_kb_cmd = data;
|
||||
@ -567,12 +572,17 @@ WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w )
|
||||
m_kb_reg = data;
|
||||
break;
|
||||
|
||||
//case 0x01: // ??
|
||||
//break;
|
||||
|
||||
case 0x02:
|
||||
case 0x01: // drgw3
|
||||
{
|
||||
if (data == 0x0001) { // Execute cmd
|
||||
if (data == 0x0002) { // Execute command
|
||||
IGS022_handle_command();
|
||||
}
|
||||
}
|
||||
break;
|
||||
|
||||
case 0x02: // killbld
|
||||
{
|
||||
if (data == 0x0001) { // Execute command
|
||||
IGS022_handle_command();
|
||||
m_kb_reg++;
|
||||
}
|
||||
@ -584,7 +594,7 @@ WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w )
|
||||
break;
|
||||
|
||||
case 0x04:
|
||||
m_kb_ptr = data;
|
||||
// m_kb_ptr = data; // Suspect. Not good for drgw3
|
||||
break;
|
||||
|
||||
case 0x20:
|
||||
@ -599,8 +609,8 @@ WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w )
|
||||
killbld_protection_calculate_hold(m_kb_cmd & 0x0f, data & 0xff);
|
||||
break;
|
||||
|
||||
// default:
|
||||
// logerror("%06X: ASIC25 W CMD %X VAL %X\n", space.device().safe_pc(), m_kb_cmd, data);
|
||||
// default:
|
||||
// logerror("%06X: ASIC25 W CMD %X VAL %X\n", space.device().safe_pc(), m_kb_cmd, data);
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -612,15 +622,13 @@ READ16_MEMBER(pgm_022_025_state::killbld_igs025_prot_r )
|
||||
switch (m_kb_cmd)
|
||||
{
|
||||
case 0x00:
|
||||
return BITSWAP8((m_kb_swap+1)&0xff, 0,1,2,3,4,5,6,7); // dw3
|
||||
return BITSWAP8((m_kb_swap+1) & 0x7f, 0,1,2,3,4,5,6,7); // drgw3
|
||||
|
||||
case 0x01:
|
||||
return m_kb_reg & 0x7f;
|
||||
|
||||
case 0x05:
|
||||
{
|
||||
logerror ("ptr: %d\n", m_kb_ptr);
|
||||
|
||||
switch (m_kb_ptr)
|
||||
{
|
||||
case 1:
|
||||
@ -635,7 +643,6 @@ READ16_MEMBER(pgm_022_025_state::killbld_igs025_prot_r )
|
||||
case 4:
|
||||
return 0x3f00 | ((m_kb_game_id >> 24) & 0xff);
|
||||
|
||||
case 5:
|
||||
default: // >= 5
|
||||
return 0x3f00 | BITSWAP8(m_kb_prot_hold, 5,2,9,7,10,13,12,15);
|
||||
}
|
||||
@ -645,10 +652,10 @@ READ16_MEMBER(pgm_022_025_state::killbld_igs025_prot_r )
|
||||
|
||||
case 0x40:
|
||||
killbld_protection_calculate_hilo();
|
||||
return 0; // is this used?
|
||||
return 0; // Read and then discarded
|
||||
|
||||
//default:
|
||||
// logerror("%06X: ASIC25 R CMD %X\n", space.device().safe_pc(), m_kb_cmd);
|
||||
// default:
|
||||
// logerror("%06X: ASIC25 R CMD %X\n", space.device().safe_pc(), m_kb_cmd);
|
||||
}
|
||||
}
|
||||
|
||||
@ -670,7 +677,7 @@ MACHINE_RESET_MEMBER(pgm_022_025_state,killbld)
|
||||
m_kb_ptr = 0;
|
||||
m_kb_swap = 0;
|
||||
|
||||
memset(m_kb_regs, 0, 0x10 * sizeof(UINT32));
|
||||
memset(m_kb_regs, 0, 0x100 * sizeof(UINT32));
|
||||
}
|
||||
|
||||
DRIVER_INIT_MEMBER(pgm_022_025_state,killbld)
|
||||
@ -691,7 +698,7 @@ DRIVER_INIT_MEMBER(pgm_022_025_state,killbld)
|
||||
m_kb_reg = 0;
|
||||
m_kb_ptr = 0;
|
||||
m_kb_swap = 0;
|
||||
memset(m_kb_regs, 0, 0x10 * sizeof(UINT32));
|
||||
memset(m_kb_regs, 0, 0x100 * sizeof(UINT32));
|
||||
|
||||
save_item(NAME(m_kb_prot_hold));
|
||||
save_item(NAME(m_kb_prot_hilo));
|
||||
@ -702,69 +709,15 @@ DRIVER_INIT_MEMBER(pgm_022_025_state,killbld)
|
||||
save_item(NAME(m_kb_regs));
|
||||
}
|
||||
|
||||
MACHINE_RESET_MEMBER(pgm_022_025_state,dw3)
|
||||
{
|
||||
MACHINE_RESET_CALL_MEMBER(pgm);
|
||||
/* fill the protection ram with a5 + auto dma */
|
||||
IGS022_reset();
|
||||
|
||||
/* game won't boot unless various values are in protection RAM
|
||||
- these should almost certainly end up there as the result of executing the protection
|
||||
commands are startup, but which, and how? */
|
||||
|
||||
m_sharedprotram[0x200/2] = 0x006d;
|
||||
m_sharedprotram[0x202/2] = 0x007c; // it cares about this, operation status flag?
|
||||
|
||||
m_sharedprotram[0x20c/2] = 0x0000;
|
||||
m_sharedprotram[0x20e/2] = 0x0007;
|
||||
m_sharedprotram[0x210/2] = 0x0000;
|
||||
m_sharedprotram[0x212/2] = 0x0004;
|
||||
m_sharedprotram[0x214/2] = 0x0000;
|
||||
m_sharedprotram[0x216/2] = 0x0007;
|
||||
m_sharedprotram[0x218/2] = 0x0000;
|
||||
m_sharedprotram[0x21a/2] = 0x0004;
|
||||
|
||||
m_sharedprotram[0x288/2] = 0x0000;
|
||||
m_sharedprotram[0x28a/2] = 0x00c2;
|
||||
m_sharedprotram[0x28c/2] = 0x0000;
|
||||
m_sharedprotram[0x28e/2] = 0x00c2;
|
||||
m_sharedprotram[0x290/2] = 0x0500;
|
||||
m_sharedprotram[0x292/2] = 0x1000;
|
||||
m_sharedprotram[0x294/2] = 0x00c3;
|
||||
m_sharedprotram[0x296/2] = 0x7104;
|
||||
m_sharedprotram[0x298/2] = 0x0000;
|
||||
m_sharedprotram[0x29a/2] = 0x0003;
|
||||
m_sharedprotram[0x29c/2] = 0x0108;
|
||||
m_sharedprotram[0x29e/2] = 0x0009;
|
||||
|
||||
m_sharedprotram[0x2a2/2] = 0x84f6; // it cares about this, it's the version number of the data rom, copied automatically!
|
||||
|
||||
m_sharedprotram[0x2ac/2] = 0x006d;
|
||||
m_sharedprotram[0x2ae/2] = 0x0000;
|
||||
|
||||
m_sharedprotram[0x2b0/2] = 0xaf56;
|
||||
|
||||
|
||||
// Reset IGS025 stuff
|
||||
m_kb_prot_hold = 0;
|
||||
m_kb_prot_hilo = 0;
|
||||
m_kb_prot_hilo_select = 0;
|
||||
m_kb_cmd = 0;
|
||||
m_kb_reg = 0;
|
||||
m_kb_ptr = 0;
|
||||
m_kb_swap = 0;
|
||||
memset(m_kb_regs, 0, 0x10 * sizeof(UINT32));
|
||||
|
||||
}
|
||||
|
||||
DRIVER_INIT_MEMBER(pgm_022_025_state,drgw3)
|
||||
{
|
||||
pgm_basic_init();
|
||||
pgm_dw3_decrypt();
|
||||
|
||||
m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0xDA5610, 0xDA5613, read16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_r),this), write16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_w),this));
|
||||
m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0xda5610, 0xda5613, read16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_r),this), write16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_w),this));
|
||||
|
||||
m_kb_source_data = dw3_source_data;
|
||||
m_kb_source_data_offset = 1;
|
||||
m_kb_source_data_offset = 0;
|
||||
m_kb_game_id = 0x00060000;
|
||||
|
||||
m_kb_prot_hold = 0;
|
||||
@ -774,9 +727,15 @@ DRIVER_INIT_MEMBER(pgm_022_025_state,drgw3)
|
||||
m_kb_reg = 0;
|
||||
m_kb_ptr = 0;
|
||||
m_kb_swap = 0;
|
||||
memset(m_kb_regs, 0, 0x10 * sizeof(UINT32));
|
||||
memset(m_kb_regs, 0, 0x100 * sizeof(UINT32));
|
||||
|
||||
pgm_dw3_decrypt();
|
||||
save_item(NAME(m_kb_prot_hold));
|
||||
save_item(NAME(m_kb_prot_hilo));
|
||||
save_item(NAME(m_kb_prot_hilo_select));
|
||||
save_item(NAME(m_kb_cmd));
|
||||
save_item(NAME(m_kb_reg));
|
||||
save_item(NAME(m_kb_ptr));
|
||||
save_item(NAME(m_kb_regs));
|
||||
}
|
||||
|
||||
|
||||
@ -787,8 +746,7 @@ static ADDRESS_MAP_START( killbld_mem, AS_PROGRAM, 16, pgm_022_025_state )
|
||||
ADDRESS_MAP_END
|
||||
|
||||
|
||||
|
||||
MACHINE_CONFIG_START( pgm_022_025_kb, pgm_022_025_state )
|
||||
MACHINE_CONFIG_START( pgm_022_025, pgm_022_025_state )
|
||||
MCFG_FRAGMENT_ADD(pgmbase)
|
||||
|
||||
MCFG_CPU_MODIFY("maincpu")
|
||||
@ -798,16 +756,6 @@ MACHINE_CONFIG_START( pgm_022_025_kb, pgm_022_025_state )
|
||||
MACHINE_CONFIG_END
|
||||
|
||||
|
||||
MACHINE_CONFIG_START( pgm_022_025_dw, pgm_022_025_state )
|
||||
MCFG_FRAGMENT_ADD(pgmbase)
|
||||
|
||||
MCFG_CPU_MODIFY("maincpu")
|
||||
MCFG_CPU_PROGRAM_MAP(killbld_mem)
|
||||
|
||||
MCFG_MACHINE_RESET_OVERRIDE(pgm_022_025_state,dw3)
|
||||
MACHINE_CONFIG_END
|
||||
|
||||
|
||||
INPUT_PORTS_START( killbld )
|
||||
PORT_INCLUDE ( pgm )
|
||||
|
||||
@ -817,12 +765,12 @@ INPUT_PORTS_START( killbld )
|
||||
PORT_DIPSETTING( 0x0017, DEF_STR( China ) )
|
||||
PORT_DIPSETTING( 0x0018, DEF_STR( Hong_Kong ) )
|
||||
PORT_DIPSETTING( 0x0019, DEF_STR( Japan ) )
|
||||
// PORT_DIPSETTING( 0x001a, "1a" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001b, "1b" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001c, "1c" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001d, "1d" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001e, "1e" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001f, "1f" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001a, "1a" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001b, "1b" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001c, "1c" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001d, "1d" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001e, "1e" ) // invalid
|
||||
// PORT_DIPSETTING( 0x001f, "1f" ) // invalid
|
||||
PORT_DIPSETTING( 0x0020, DEF_STR( Korea ) )
|
||||
PORT_DIPSETTING( 0x0021, DEF_STR( World ) )
|
||||
INPUT_PORTS_END
|
||||
@ -832,7 +780,7 @@ INPUT_PORTS_START( dw3 )
|
||||
|
||||
PORT_MODIFY("Region") /* Region - supplied by protection device */
|
||||
PORT_CONFNAME( 0x000f, 0x0006, DEF_STR( Region ) )
|
||||
// PORT_CONFSETTING( 0x0000, "0" )
|
||||
// PORT_CONFSETTING( 0x0000, "0" )
|
||||
PORT_CONFSETTING( 0x0001, "1" )
|
||||
PORT_CONFSETTING( 0x0002, "2" )
|
||||
PORT_CONFSETTING( 0x0003, "3" )
|
||||
|
||||
Loading…
Reference in New Issue
Block a user