From 620f455f6b795430d72ee5c4096639064db35525 Mon Sep 17 00:00:00 2001 From: David Haywood Date: Fri, 4 Oct 2013 16:10:20 +0000 Subject: [PATCH] Improvements to Dragon World 3 protection simulation, game seems mostly playable now although a DMA mode copying 68k code to RAM is still missing [iq_132] --- src/mame/drivers/pgm.c | 31 ++-- src/mame/includes/pgm.h | 19 +- src/mame/machine/pgmprot_igs025_igs022.c | 220 +++++++++-------------- 3 files changed, 108 insertions(+), 162 deletions(-) diff --git a/src/mame/drivers/pgm.c b/src/mame/drivers/pgm.c index 4b4a08d8fd3..d0fbb608e1b 100644 --- a/src/mame/drivers/pgm.c +++ b/src/mame/drivers/pgm.c @@ -977,7 +977,7 @@ ROM_START( drgw3 ) ROM_LOAD16_BYTE( "dw3_v106.u13", 0x100000, 0x080000, CRC(28284e22) SHA1(4643a69881ddb7383ca10f3eb2aa2cf41be39e9f) ) ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data - is it correct for this set? */ - ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) ) + ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) ) ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */ PGM_VIDEO_BIOS @@ -1003,7 +1003,7 @@ ROM_START( drgw3105 ) ROM_LOAD16_BYTE( "dw3_v105.u13", 0x100000, 0x080000, CRC(8d6c9d39) SHA1(cb79303ab551e91f07e11414db4254d5b161d415) ) ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data - is it correct for this set? */ - ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) ) + ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) ) ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */ PGM_VIDEO_BIOS @@ -1051,7 +1051,7 @@ ROM_START( drgw3100 ) ROM_LOAD16_BYTE( "dw3_v100.u13", 0x100000, 0x080000, CRC(b7cded21) SHA1(c1ae2af2e42227503c81bbcd2bd6862aa416bd78) ) ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */ - ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) ) + ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) ) ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */ PGM_VIDEO_BIOS @@ -1103,7 +1103,7 @@ ROM_START( dwex ) ROM_LOAD16_BYTE( "ex_v100.u13", 0x100000, 0x080000, CRC(7afe6322) SHA1(a52d71af1d6de16c5a3df23eacdab3466693ba8d) ) ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */ - ROM_LOAD16_WORD_SWAP( "ex_data.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) ) + ROM_LOAD( "ex_data.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) ) ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */ PGM_VIDEO_BIOS @@ -1861,7 +1861,7 @@ ROM_START( killbld ) ROM_LOAD16_WORD_SWAP( "p0300_v109.u9", 0x100000, 0x200000, CRC(2fcee215) SHA1(855281a9090bfdf3da9f4d50c121765131a13400) ) ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */ - ROM_LOAD16_WORD_SWAP( "kb_u2.rom", 0x000000, 0x010000, CRC(de3eae63) SHA1(03af767ef764055bda528b5cc6a24b9e1218cca8) ) + ROM_LOAD( "kb_u2.rom", 0x000000, 0x010000, CRC(de3eae63) SHA1(03af767ef764055bda528b5cc6a24b9e1218cca8) ) ROM_REGION( 0x800000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */ PGM_VIDEO_BIOS @@ -1897,7 +1897,7 @@ ROM_START( killbld104 ) ROM_LOAD16_BYTE( "kb_u5_v104.u5", 0x200000, 0x080000, CRC(a0bafc29) SHA1(b20db7c16353c6f87ed3c08c9d037b07336711f1) ) ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */ - ROM_LOAD16_WORD_SWAP( "kb_u2_v104.u2", 0x000000, 0x010000, CRC(c970f6d5) SHA1(399fc6f80262784c566363c847dc3fdc4fb37494) ) + ROM_LOAD( "kb_u2_v104.u2", 0x000000, 0x010000, CRC(c970f6d5) SHA1(399fc6f80262784c566363c847dc3fdc4fb37494) ) ROM_REGION( 0x800000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */ PGM_VIDEO_BIOS @@ -4014,8 +4014,15 @@ GAME( 1997, dw2v100x, drgw2, pgm_012_025_drgw2, pgm, pgm_012_025_sta GAME( 1997, drgw2j, drgw2, pgm_012_025_drgw2, pgm, pgm_012_025_state, drgw2j, ROT0, "IGS", "Chuugokuryuu II (ver. 100J, Japan)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) GAME( 1997, drgw2c, drgw2, pgm_012_025_drgw2, pgm, pgm_012_025_state, drgw2c, ROT0, "IGS", "Zhong Guo Long II (ver. 100C, China)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) -GAME( 1998, killbld, pgm, pgm_022_025_kb, killbld, pgm_022_025_state, killbld, ROT0, "IGS", "The Killing Blade (ver. 109, Chinese Board)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */ -GAME( 1998, killbld104, killbld, pgm_022_025_kb, killbld, pgm_022_025_state, killbld, ROT0, "IGS", "The Killing Blade (ver. 104)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */ +GAME( 1998, killbld, pgm, pgm_022_025, killbld, pgm_022_025_state, killbld, ROT0, "IGS", "The Killing Blade (ver. 109, Chinese Board)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */ +GAME( 1998, killbld104, killbld, pgm_022_025, killbld, pgm_022_025_state, killbld, ROT0, "IGS", "The Killing Blade (ver. 104)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */ + +// these seem playable but the DMA mode transfering 68k code to RAM is not emulated so there could still be problems +GAME( 1998, drgw3, pgm, pgm_022_025, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 106, Korean Board)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */ +GAME( 1998, drgw3105, drgw3, pgm_022_025, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 105)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */ +GAME( 1998, drgw3100, drgw3, pgm_022_025, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 100)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) // Japan Only? + +GAME( 1998, dwex, pgm, pgm_022_025, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 EX (ver. 100)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */ // region provided by internal ARM rom GAME( 1999, photoy2k, pgm, pgm_arm_type1, photoy2k, pgm_arm_type1_state, photoy2k, ROT0, "IGS", "Photo Y2K (ver. 105)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */ @@ -4134,14 +4141,6 @@ GAME( 1999, kovsgqyzb, kovplus, pgm_arm_type1_sim, sango_ch, pgm_arm_ty NOT Working (mostly due to needing internal protection roms dumped) -----------------------------------------------------------------------------------------------------------------------*/ -// should have DMA protection, like killbld, as well as the math / bitswap / memory manipulation stuff, but it never attempts to trigger the DMA? - we currently have a RAM dump to allow it to boot, but I think this stuff should be DMA copied into RAM, like killbld -GAME( 1998, drgw3, pgm, pgm_022_025_dw, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 106, Korean Board)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) -GAME( 1998, drgw3105, drgw3, pgm_022_025_dw, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 105)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) -GAME( 1998, drgw3100, drgw3, pgm_022_025_dw, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 (ver. 100)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) // Japan Only? - -GAME( 1998, dwex, pgm, pgm_022_025_dw, dw3, pgm_022_025_state, drgw3, ROT0, "IGS", "Dragon World 3 EX (ver. 100)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) - - GAME( 1999, puzlstar, pgm, pgm_arm_type1_sim, pstar, pgm_arm_type1_state, pstar, ROT0, "IGS", "Puzzle Star (ver. 100MG)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ GAME( 2001, py2k2, pgm, pgm_arm_type1_sim, py2k2, pgm_arm_type1_state, py2k2, ROT0, "IGS", "Photo Y2K 2", GAME_NOT_WORKING ) /* need internal rom of IGS027A */ diff --git a/src/mame/includes/pgm.h b/src/mame/includes/pgm.h index 6f0c7082e85..2a398858bc3 100644 --- a/src/mame/includes/pgm.h +++ b/src/mame/includes/pgm.h @@ -65,7 +65,6 @@ public: UINT8 m_cal_cnt; system_time m_systime; - DECLARE_READ16_MEMBER(pgm_videoram_r); DECLARE_WRITE16_MEMBER(pgm_videoram_w); DECLARE_WRITE16_MEMBER(pgm_coin_counter_w); @@ -148,12 +147,14 @@ public: UINT8 m_asic3_reg; UINT8 m_asic3_latch[3]; UINT8 m_asic3_x; - UINT8 m_asic3_y; - UINT8 m_asic3_z; - UINT8 m_asic3_h1; - UINT8 m_asic3_h2; + UINT8 m_asic3_y; + UINT8 m_asic3_z; + UINT16 m_asic3_h1; + UINT16 m_asic3_h2; UINT16 m_asic3_hold; + + DECLARE_DRIVER_INIT(orlegend); void asic3_compute_hold(); DECLARE_READ16_MEMBER( pgm_asic3_r ); @@ -279,7 +280,7 @@ public: UINT8 coverage[256]; // coverage is how much of the table we've managed to verify using known facts about the table structure int command_31_write_type; - + // the maximum level size returned or read by the device appears to be this size UINT16 level_structure[8][10]; @@ -399,14 +400,13 @@ public: int m_kb_reg; int m_kb_ptr; UINT8 m_kb_swap; - UINT32 m_kb_regs[0x10]; + UINT32 m_kb_regs[0x100]; required_shared_ptr m_sharedprotram; DECLARE_DRIVER_INIT(killbld); DECLARE_DRIVER_INIT(drgw3); DECLARE_MACHINE_RESET(killbld); - DECLARE_MACHINE_RESET(dw3); void pgm_dw3_decrypt(); void pgm_killbld_decrypt(); void killbld_protection_calculate_hilo(); @@ -555,8 +555,7 @@ MACHINE_CONFIG_EXTERN( pgm_arm_type3 ); /*----------- defined in machine/pgmprot4.c -----------*/ -MACHINE_CONFIG_EXTERN( pgm_022_025_kb ); -MACHINE_CONFIG_EXTERN( pgm_022_025_dw ); +MACHINE_CONFIG_EXTERN( pgm_022_025 ); INPUT_PORTS_EXTERN( killbld ); INPUT_PORTS_EXTERN( dw3 ); diff --git a/src/mame/machine/pgmprot_igs025_igs022.c b/src/mame/machine/pgmprot_igs025_igs022.c index 2ba98b89f0c..b4d4e9e3798 100644 --- a/src/mame/machine/pgmprot_igs025_igs022.c +++ b/src/mame/machine/pgmprot_igs025_igs022.c @@ -5,10 +5,8 @@ used on the following PGM games The Killing Blade - Dragon World 3* - Dragon World 3 EX* - - * preliminary, not working + Dragon World 3 + Dragon World 3 EX ---- @@ -26,10 +24,10 @@ /* The IGS022 is an MCU which performs encrypted DMA used by - The Killing Blade - Dragon World 3 + - Dragon World 3 Ex There is also an automatic transfer which happens on startup using params stored in the data ROM. This has been verified on real hardware running without any 68k game program. - */ void pgm_022_025_state::pgm_dw3_decrypt() @@ -187,8 +185,9 @@ static const UINT8 killbld_source_data[0x0c][0xec] = // offsets to these tables // all tables xored with data from $149c4c // tables are the same as olds and drgw2 -static const UINT8 dw3_source_data[0x07][0xec] = +static const UINT8 dw3_source_data[0x08][0xec] = { + { 0, }, { // region 1, $14c21a 0x67, 0x51, 0xf3, 0x19, 0xa0, 0x09, 0xb1, 0x21, 0xb0, 0xee, 0xe3, 0xf6, 0xbe, 0x81, 0x35, 0xe3, 0xfb, 0xe6, 0xef, 0xdf, 0x61, 0x01, 0xfa, 0x22, 0x5d, 0x43, 0x01, 0xa5, 0x3b, 0x17, 0xd4, 0x74, @@ -325,8 +324,6 @@ void pgm_022_025_state::IGS022_do_dma(UINT16 src, UINT16 dst, UINT16 size, UINT1 1,2,3 table based ops */ - //mame_printf_debug("src %04x dst %04x size %04x mode %04x\n", src, dst, size, mode); - param = mode >> 8; mode &=0xf; // what are the other bits? @@ -350,44 +347,41 @@ void pgm_022_025_state::IGS022_do_dma(UINT16 src, UINT16 dst, UINT16 size, UINT1 UINT16 dat2 = PROTROM[src + x]; UINT8 extraoffset = param&0xff; - UINT8* dectable = (UINT8*)memregion("igs022data")->base(); // the basic decryption table is at the start of the mcu data rom! at least in killbld + UINT8* dectable = (UINT8*)memregion("igs022data")->base(); // the basic decryption table is at the start of the mcu data rom! UINT8 taboff = ((x*2)+extraoffset) & 0xff; // must allow for overflow in instances of odd offsets - UINT16 extraxor = ((dectable[taboff+0]) << 8) | (dectable[taboff+1] << 0); - - dat2 = ((dat2 & 0x00ff)<<8) | ((dat2 & 0xff00)>>8); + UINT16 extraxor = ((dectable[taboff+1]) << 8) | (dectable[taboff+0] << 0); // mode==0 plain if (mode==3) dat2 ^= extraxor; if (mode==2) dat2 += extraxor; if (mode==1) dat2 -= extraxor; - //if (dat!=dat2) - // printf("Mode %04x Param %04x Mismatch %04x %04x\n", mode, param, dat, dat2); - m_sharedprotram[dst + x] = dat2; } - - /* Killing Blade: hack, patches out some additional security checks... we need to emulate them instead! */ - // different region IGS025 devices supply different sequences - we currently only have the china sequence for Killing Blade - //if ((mode==3) && (param==0x54) && (src*2==0x2120) && (dst*2==0x2600)) m_sharedprotram[0x2600 / 2] = 0x4e75; - } - if (mode == 4) + else if (mode == 4) { mame_printf_debug("unhandled copy mode %04x!\n", mode); + + int x; + for (x = 0; x < size; x++) + { + m_sharedprotram[dst + x] = 0x4e75; // Hack until algorithm for decoding this is figured out. + } + // not used by killing blade /* looks almost like a fixed value xor, but isn't */ } else if (mode == 5) { - /* mode 5 seems to be a straight copy */ + /* mode 5 seems to be a straight copy, byteswap */ int x; UINT16 *PROTROM = (UINT16*)memregion("igs022data")->base(); for (x = 0; x < size; x++) { UINT16 dat = PROTROM[src + x]; - m_sharedprotram[dst + x] = dat; + m_sharedprotram[dst + x] = (dat << 8) | (dat >> 8); } } else if (mode == 6) @@ -416,9 +410,9 @@ void pgm_022_025_state::IGS022_do_dma(UINT16 src, UINT16 dst, UINT16 size, UINT1 else { mame_printf_debug("unhandled copy mode %04x!\n", mode); + logerror ("DMA MODE: %d, src: %4.4x, dst: %4.4x, size: %4.4x, param: %2.2x\n", mode, src, dst, size, param); // not used by killing blade /* invalid? */ - } } @@ -428,16 +422,15 @@ void pgm_022_025_state::IGS022_reset() { int i; UINT16 *PROTROM = (UINT16*)memregion("igs022data")->base(); - UINT16 tmp; // fill ram with A5 patern for (i = 0; i < 0x4000/2; i++) m_sharedprotram[i] = 0xa55a; // the auto-dma - UINT16 src = PROTROM[0x100 / 2]; - UINT32 dst = PROTROM[0x102 / 2]; - UINT16 size = PROTROM[0x104/ 2]; + UINT16 src = PROTROM[0x100 / 2]; + UINT32 dst = PROTROM[0x102 / 2]; + UINT16 size = PROTROM[0x104 / 2]; UINT16 mode = PROTROM[0x106 / 2]; src = ((src & 0xff00) >> 8) | ((src & 0x00ff) << 8); @@ -447,23 +440,18 @@ void pgm_022_025_state::IGS022_reset() src >>= 1; -// printf("Auto-DMA %04x %04x %04x %04x\n",src,dst,size,mode); - IGS022_do_dma(src,dst,size,mode); // there is also a version ID? (or is it some kind of checksum) that is stored in the data rom, and gets copied.. // Dragon World 3 checks it - tmp = PROTROM[0x114/2]; - tmp = ((tmp & 0xff00) >> 8) | ((tmp & 0x00ff) << 8); - m_sharedprotram[0x2a2/2] = tmp; + // Setting $3002a0 to #3 causes Dragon World 3 to skip this check + m_sharedprotram[0x2a2/2] = PROTROM[0x114/2]; } void pgm_022_025_state::IGS022_handle_command() { UINT16 cmd = m_sharedprotram[0x200/2]; - //mame_printf_debug("command %04x\n", cmd); - if (cmd == 0x6d) // Store values to asic ram { UINT32 p1 = (m_sharedprotram[0x298/2] << 16) | m_sharedprotram[0x29a/2]; @@ -473,8 +461,9 @@ void pgm_022_025_state::IGS022_handle_command() { int reg = (p2 >> 16) & 0xffff; - if (reg & 0x200) + if (reg & 0x300) { // 300?? killbld expects 0x200, drgw3 expects 0x100? m_kb_regs[reg & 0xff] = p1; + } } if ((p2 & 0xffff) == 0x6) // Add value @@ -501,16 +490,34 @@ void pgm_022_025_state::IGS022_handle_command() m_sharedprotram[0x29c/2] = (m_kb_regs[reg] >> 16) & 0xffff; m_sharedprotram[0x29e/2] = m_kb_regs[reg] & 0xffff; } + + m_sharedprotram[0x202 / 2] = 0x7c; // this mode complete? } - if(cmd == 0x4f) //memcpy with encryption / scrambling + // Is this actually what this is suppose to do? Complete guess. + if (cmd == 0x12) // copy?? { - UINT16 src = m_sharedprotram[0x290 / 2] >> 1; // ? - UINT32 dst = m_sharedprotram[0x292 / 2]; + m_sharedprotram[0x28c / 2] = m_sharedprotram[0x288 / 2]; + m_sharedprotram[0x28e / 2] = m_sharedprotram[0x28a / 2]; + + m_sharedprotram[0x202 / 2] = 0x23; // this mode complete? + } + + // what do these do? write the completion byte for now... + if (cmd == 0x45) m_sharedprotram[0x202 / 2] = 0x56; + if (cmd == 0x5a) m_sharedprotram[0x202 / 2] = 0x4b; + if (cmd == 0x2d) m_sharedprotram[0x202 / 2] = 0x3c; + + if (cmd == 0x4f) // memcpy with encryption / scrambling + { + UINT16 src = m_sharedprotram[0x290 / 2] >> 1; // External mcu data is 8 bit and addressed as such + UINT32 dst = m_sharedprotram[0x292 / 2]; UINT16 size = m_sharedprotram[0x294 / 2]; UINT16 mode = m_sharedprotram[0x296 / 2]; IGS022_do_dma(src,dst,size,mode); + + m_sharedprotram[0x202 / 2] = 0x5e; // this mode complete? } } @@ -553,8 +560,6 @@ void pgm_022_025_state::killbld_protection_calculate_hilo() WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w ) { - offset &= 0xf; - if (offset == 0) { m_kb_cmd = data; @@ -567,12 +572,17 @@ WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w ) m_kb_reg = data; break; - //case 0x01: // ?? - //break; - - case 0x02: + case 0x01: // drgw3 { - if (data == 0x0001) { // Execute cmd + if (data == 0x0002) { // Execute command + IGS022_handle_command(); + } + } + break; + + case 0x02: // killbld + { + if (data == 0x0001) { // Execute command IGS022_handle_command(); m_kb_reg++; } @@ -584,7 +594,7 @@ WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w ) break; case 0x04: - m_kb_ptr = data; + // m_kb_ptr = data; // Suspect. Not good for drgw3 break; case 0x20: @@ -599,8 +609,8 @@ WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w ) killbld_protection_calculate_hold(m_kb_cmd & 0x0f, data & 0xff); break; - // default: - // logerror("%06X: ASIC25 W CMD %X VAL %X\n", space.device().safe_pc(), m_kb_cmd, data); + // default: + // logerror("%06X: ASIC25 W CMD %X VAL %X\n", space.device().safe_pc(), m_kb_cmd, data); } } } @@ -612,15 +622,13 @@ READ16_MEMBER(pgm_022_025_state::killbld_igs025_prot_r ) switch (m_kb_cmd) { case 0x00: - return BITSWAP8((m_kb_swap+1)&0xff, 0,1,2,3,4,5,6,7); // dw3 + return BITSWAP8((m_kb_swap+1) & 0x7f, 0,1,2,3,4,5,6,7); // drgw3 case 0x01: return m_kb_reg & 0x7f; case 0x05: { - logerror ("ptr: %d\n", m_kb_ptr); - switch (m_kb_ptr) { case 1: @@ -635,7 +643,6 @@ READ16_MEMBER(pgm_022_025_state::killbld_igs025_prot_r ) case 4: return 0x3f00 | ((m_kb_game_id >> 24) & 0xff); - case 5: default: // >= 5 return 0x3f00 | BITSWAP8(m_kb_prot_hold, 5,2,9,7,10,13,12,15); } @@ -645,10 +652,10 @@ READ16_MEMBER(pgm_022_025_state::killbld_igs025_prot_r ) case 0x40: killbld_protection_calculate_hilo(); - return 0; // is this used? + return 0; // Read and then discarded - //default: - // logerror("%06X: ASIC25 R CMD %X\n", space.device().safe_pc(), m_kb_cmd); + // default: + // logerror("%06X: ASIC25 R CMD %X\n", space.device().safe_pc(), m_kb_cmd); } } @@ -670,7 +677,7 @@ MACHINE_RESET_MEMBER(pgm_022_025_state,killbld) m_kb_ptr = 0; m_kb_swap = 0; - memset(m_kb_regs, 0, 0x10 * sizeof(UINT32)); + memset(m_kb_regs, 0, 0x100 * sizeof(UINT32)); } DRIVER_INIT_MEMBER(pgm_022_025_state,killbld) @@ -691,7 +698,7 @@ DRIVER_INIT_MEMBER(pgm_022_025_state,killbld) m_kb_reg = 0; m_kb_ptr = 0; m_kb_swap = 0; - memset(m_kb_regs, 0, 0x10 * sizeof(UINT32)); + memset(m_kb_regs, 0, 0x100 * sizeof(UINT32)); save_item(NAME(m_kb_prot_hold)); save_item(NAME(m_kb_prot_hilo)); @@ -702,69 +709,15 @@ DRIVER_INIT_MEMBER(pgm_022_025_state,killbld) save_item(NAME(m_kb_regs)); } -MACHINE_RESET_MEMBER(pgm_022_025_state,dw3) -{ - MACHINE_RESET_CALL_MEMBER(pgm); - /* fill the protection ram with a5 + auto dma */ - IGS022_reset(); - - /* game won't boot unless various values are in protection RAM - - these should almost certainly end up there as the result of executing the protection - commands are startup, but which, and how? */ - - m_sharedprotram[0x200/2] = 0x006d; - m_sharedprotram[0x202/2] = 0x007c; // it cares about this, operation status flag? - - m_sharedprotram[0x20c/2] = 0x0000; - m_sharedprotram[0x20e/2] = 0x0007; - m_sharedprotram[0x210/2] = 0x0000; - m_sharedprotram[0x212/2] = 0x0004; - m_sharedprotram[0x214/2] = 0x0000; - m_sharedprotram[0x216/2] = 0x0007; - m_sharedprotram[0x218/2] = 0x0000; - m_sharedprotram[0x21a/2] = 0x0004; - - m_sharedprotram[0x288/2] = 0x0000; - m_sharedprotram[0x28a/2] = 0x00c2; - m_sharedprotram[0x28c/2] = 0x0000; - m_sharedprotram[0x28e/2] = 0x00c2; - m_sharedprotram[0x290/2] = 0x0500; - m_sharedprotram[0x292/2] = 0x1000; - m_sharedprotram[0x294/2] = 0x00c3; - m_sharedprotram[0x296/2] = 0x7104; - m_sharedprotram[0x298/2] = 0x0000; - m_sharedprotram[0x29a/2] = 0x0003; - m_sharedprotram[0x29c/2] = 0x0108; - m_sharedprotram[0x29e/2] = 0x0009; - - m_sharedprotram[0x2a2/2] = 0x84f6; // it cares about this, it's the version number of the data rom, copied automatically! - - m_sharedprotram[0x2ac/2] = 0x006d; - m_sharedprotram[0x2ae/2] = 0x0000; - - m_sharedprotram[0x2b0/2] = 0xaf56; - - - // Reset IGS025 stuff - m_kb_prot_hold = 0; - m_kb_prot_hilo = 0; - m_kb_prot_hilo_select = 0; - m_kb_cmd = 0; - m_kb_reg = 0; - m_kb_ptr = 0; - m_kb_swap = 0; - memset(m_kb_regs, 0, 0x10 * sizeof(UINT32)); - -} - DRIVER_INIT_MEMBER(pgm_022_025_state,drgw3) { pgm_basic_init(); + pgm_dw3_decrypt(); - m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0xDA5610, 0xDA5613, read16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_r),this), write16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_w),this)); + m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0xda5610, 0xda5613, read16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_r),this), write16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_w),this)); m_kb_source_data = dw3_source_data; - m_kb_source_data_offset = 1; + m_kb_source_data_offset = 0; m_kb_game_id = 0x00060000; m_kb_prot_hold = 0; @@ -774,9 +727,15 @@ DRIVER_INIT_MEMBER(pgm_022_025_state,drgw3) m_kb_reg = 0; m_kb_ptr = 0; m_kb_swap = 0; - memset(m_kb_regs, 0, 0x10 * sizeof(UINT32)); + memset(m_kb_regs, 0, 0x100 * sizeof(UINT32)); - pgm_dw3_decrypt(); + save_item(NAME(m_kb_prot_hold)); + save_item(NAME(m_kb_prot_hilo)); + save_item(NAME(m_kb_prot_hilo_select)); + save_item(NAME(m_kb_cmd)); + save_item(NAME(m_kb_reg)); + save_item(NAME(m_kb_ptr)); + save_item(NAME(m_kb_regs)); } @@ -787,8 +746,7 @@ static ADDRESS_MAP_START( killbld_mem, AS_PROGRAM, 16, pgm_022_025_state ) ADDRESS_MAP_END - -MACHINE_CONFIG_START( pgm_022_025_kb, pgm_022_025_state ) +MACHINE_CONFIG_START( pgm_022_025, pgm_022_025_state ) MCFG_FRAGMENT_ADD(pgmbase) MCFG_CPU_MODIFY("maincpu") @@ -798,16 +756,6 @@ MACHINE_CONFIG_START( pgm_022_025_kb, pgm_022_025_state ) MACHINE_CONFIG_END -MACHINE_CONFIG_START( pgm_022_025_dw, pgm_022_025_state ) - MCFG_FRAGMENT_ADD(pgmbase) - - MCFG_CPU_MODIFY("maincpu") - MCFG_CPU_PROGRAM_MAP(killbld_mem) - - MCFG_MACHINE_RESET_OVERRIDE(pgm_022_025_state,dw3) -MACHINE_CONFIG_END - - INPUT_PORTS_START( killbld ) PORT_INCLUDE ( pgm ) @@ -817,12 +765,12 @@ INPUT_PORTS_START( killbld ) PORT_DIPSETTING( 0x0017, DEF_STR( China ) ) PORT_DIPSETTING( 0x0018, DEF_STR( Hong_Kong ) ) PORT_DIPSETTING( 0x0019, DEF_STR( Japan ) ) -// PORT_DIPSETTING( 0x001a, "1a" ) // invalid -// PORT_DIPSETTING( 0x001b, "1b" ) // invalid -// PORT_DIPSETTING( 0x001c, "1c" ) // invalid -// PORT_DIPSETTING( 0x001d, "1d" ) // invalid -// PORT_DIPSETTING( 0x001e, "1e" ) // invalid -// PORT_DIPSETTING( 0x001f, "1f" ) // invalid +// PORT_DIPSETTING( 0x001a, "1a" ) // invalid +// PORT_DIPSETTING( 0x001b, "1b" ) // invalid +// PORT_DIPSETTING( 0x001c, "1c" ) // invalid +// PORT_DIPSETTING( 0x001d, "1d" ) // invalid +// PORT_DIPSETTING( 0x001e, "1e" ) // invalid +// PORT_DIPSETTING( 0x001f, "1f" ) // invalid PORT_DIPSETTING( 0x0020, DEF_STR( Korea ) ) PORT_DIPSETTING( 0x0021, DEF_STR( World ) ) INPUT_PORTS_END @@ -832,7 +780,7 @@ INPUT_PORTS_START( dw3 ) PORT_MODIFY("Region") /* Region - supplied by protection device */ PORT_CONFNAME( 0x000f, 0x0006, DEF_STR( Region ) ) -// PORT_CONFSETTING( 0x0000, "0" ) +// PORT_CONFSETTING( 0x0000, "0" ) PORT_CONFSETTING( 0x0001, "1" ) PORT_CONFSETTING( 0x0002, "2" ) PORT_CONFSETTING( 0x0003, "3" )