From a39b4f2265d4b4c109773b8b32ea005fbf77d2f1 Mon Sep 17 00:00:00 2001 From: Angelo Salese Date: Mon, 26 Apr 2010 16:00:48 +0000 Subject: [PATCH] Improved Killing Blade encrypted DMA mode 3 [XingXing, David Haywood] --- src/mame/drivers/pgm.c | 157 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 154 insertions(+), 3 deletions(-) diff --git a/src/mame/drivers/pgm.c b/src/mame/drivers/pgm.c index 1e6d5b5f554..a4702a23f91 100644 --- a/src/mame/drivers/pgm.c +++ b/src/mame/drivers/pgm.c @@ -4168,7 +4168,8 @@ static WRITE16_HANDLER( killbld_prot_w ) UINT16 size = state->sharedprotram[0x294 / 2]; UINT16 mode = state->sharedprotram[0x296 / 2]; - + UINT16 param; + // int a=1; // if(src==0x580) // int a=1; @@ -4187,10 +4188,11 @@ static WRITE16_HANDLER( killbld_prot_w ) //mame_printf_debug("src %04x dst %04x size %04x mode %04x\n", src, dst, size, mode); //if (src&1) mame_printf_debug("odd offset\n"); - + + param = mode >> 8; mode &=0xf; // what are the other bits? - if (mode == 1 || mode == 2 || mode == 3) + if (mode == 1 || mode == 2) { /* for now, cheat -- the scramble isn't understood, it might be state based */ @@ -4203,6 +4205,155 @@ static WRITE16_HANDLER( killbld_prot_w ) dat = RAMDUMP[dst + x]; state->sharedprotram[dst + x] = dat; } + } + else if (mode == 3) + { + int x; + UINT16 *RAMDUMP = (UINT16*)memory_region(space->machine, "user2"); + UINT16 *PROTROM = (UINT16*)memory_region(space->machine, "user1"); + + unsigned char rawDataEven[256] = { + 0xA8, 0x6A, 0x5D, 0xB6, 0x5D, 0xB1, 0xC1, 0x2C, + 0x39, 0x4F, 0xB7, 0xCF, 0x85, 0x3A, 0xEE, 0x65, + 0x7B, 0xD9, 0x81, 0xDB, 0x6D, 0x5F, 0x07, 0x03, + 0xB5, 0xEB, 0x59, 0x0F, 0x60, 0x61, 0x21, 0xCD, + 0x99, 0x06, 0x27, 0xA0, 0xD7, 0xDD, 0x5B, 0x42, + 0xC6, 0xC5, 0xA2, 0x3B, 0xF6, 0x4F, 0x61, 0x20, + 0x46, 0x61, 0xCA, 0x8C, 0x0E, 0x8C, 0xE9, 0xE0, + 0x0F, 0x2C, 0x6D, 0xBA, 0x1C, 0x45, 0x37, 0x36, + 0x85, 0x18, 0xA4, 0xE7, 0x46, 0x89, 0x9B, 0x94, + 0xF4, 0x30, 0x55, 0xB2, 0x63, 0x41, 0xEF, 0xA5, + 0x18, 0x1C, 0xB1, 0xB7, 0x72, 0xB3, 0x1C, 0xD4, + 0x97, 0xA0, 0xB6, 0x0B, 0x1F, 0x02, 0x94, 0xC5, + 0x83, 0x1B, 0xAC, 0xC3, 0x44, 0xAA, 0xD7, 0xD9, + 0xDB, 0x09, 0xA9, 0x6C, 0x64, 0x07, 0xF1, 0xAD, + 0x09, 0x83, 0x0E, 0x92, 0x2F, 0xCD, 0xF8, 0x99, + 0x63, 0xBC, 0x0A, 0x3C, 0x03, 0x8F, 0x91, 0x33, + 0xAC, 0x84, 0x15, 0x6C, 0x67, 0x3A, 0x69, 0xCB, + 0x92, 0xC7, 0x74, 0xA1, 0x90, 0x99, 0xBE, 0xEE, + 0x30, 0x0D, 0xBA, 0x57, 0xDE, 0xD1, 0xD6, 0xE5, + 0x8C, 0xFA, 0x43, 0x83, 0x5E, 0xE4, 0x84, 0x36, + 0x18, 0xCD, 0xB9, 0x1A, 0x48, 0x31, 0xA8, 0x20, + 0x32, 0xE3, 0x90, 0x89, 0x80, 0xF0, 0xAE, 0x21, + 0xA6, 0x33, 0x8C, 0x3C, 0x17, 0xB8, 0x0C, 0x72, + 0x29, 0xD1, 0x38, 0x1A, 0xC9, 0xFA, 0xC7, 0x87, + 0xDE, 0x6E, 0x6E, 0x05, 0x7E, 0x85, 0xED, 0x92, + 0xD3, 0xD4, 0xD4, 0x5C, 0xCB, 0x03, 0x19, 0xFE, + 0x83, 0x6C, 0x5B, 0x7A, 0x71, 0x79, 0xF4, 0xF6, + 0x53, 0xBA, 0xC1, 0x37, 0xDB, 0xC9, 0xB1, 0xDE, + 0x17, 0xDE, 0x0E, 0x64, 0xA2, 0x31, 0x8E, 0xD7, + 0x8D, 0x13, 0x19, 0x52, 0x0B, 0xCB, 0x58, 0x3D, + 0xDE, 0x31, 0x01, 0x4A, 0x85, 0x0C, 0xE5, 0x2B, + 0x22, 0x2D, 0xB6, 0x13, 0x2D, 0x48, 0x9A, 0xF3 + }; + + /* + unsigned char rawDataOdd[256] = { + 0xB6, 0xA8, 0xB1, 0x5D, 0x2C, 0x5D, 0x4F, 0xC1, + 0xCF, 0x39, 0x3A, 0xB7, 0x65, 0x85, 0xD9, 0xEE, + 0xDB, 0x7B, 0x5F, 0x81, 0x03, 0x6D, 0xEB, 0x07, + 0x0F, 0xB5, 0x61, 0x59, 0xCD, 0x60, 0x06, 0x21, + 0xA0, 0x99, 0xDD, 0x27, 0x42, 0xD7, 0xC5, 0x5B, + 0x3B, 0xC6, 0x4F, 0xA2, 0x20, 0xF6, 0x61, 0x61, + 0x8C, 0x46, 0x8C, 0xCA, 0xE0, 0x0E, 0x2C, 0xE9, + 0xBA, 0x0F, 0x45, 0x6D, 0x36, 0x1C, 0x18, 0x37, + 0xE7, 0x85, 0x89, 0xA4, 0x94, 0x46, 0x30, 0x9B, + 0xB2, 0xF4, 0x41, 0x55, 0xA5, 0x63, 0x1C, 0xEF, + 0xB7, 0x18, 0xB3, 0xB1, 0xD4, 0x72, 0xA0, 0x1C, + 0x0B, 0x97, 0x02, 0xB6, 0xC5, 0x1F, 0x1B, 0x94, + 0xC3, 0x83, 0xAA, 0xAC, 0xD9, 0x44, 0x09, 0xD7, + 0x6C, 0xDB, 0x07, 0xA9, 0xAD, 0x64, 0x83, 0xF1, + 0x92, 0x09, 0xCD, 0x0E, 0x99, 0x2F, 0xBC, 0xF8, + 0x3C, 0x63, 0x8F, 0x0A, 0x33, 0x03, 0x84, 0x91, + 0x6C, 0xAC, 0x3A, 0x15, 0xCB, 0x67, 0xC7, 0x69, + 0xA1, 0x92, 0x99, 0x74, 0xEE, 0x90, 0x0D, 0xBE, + 0x57, 0x30, 0xD1, 0xBA, 0xE5, 0xDE, 0xFA, 0xD6, + 0x83, 0x8C, 0xE4, 0x43, 0x36, 0x5E, 0xCD, 0x84, + 0x1A, 0x18, 0x31, 0xB9, 0x20, 0x48, 0xE3, 0xA8, + 0x89, 0x32, 0xF0, 0x90, 0x21, 0x80, 0x33, 0xAE, + 0x3C, 0xA6, 0xB8, 0x8C, 0x72, 0x17, 0xD1, 0x0C, + 0x1A, 0x29, 0xFA, 0x38, 0x87, 0xC9, 0x6E, 0xC7, + 0x05, 0xDE, 0x85, 0x6E, 0x92, 0x7E, 0xD4, 0xED, + 0x5C, 0xD3, 0x03, 0xD4, 0xFE, 0xCB, 0x6C, 0x19, + 0x7A, 0x83, 0x79, 0x5B, 0xF6, 0x71, 0xBA, 0xF4, + 0x37, 0x53, 0xC9, 0xC1, 0xDE, 0xDB, 0xDE, 0xB1, + 0x64, 0x17, 0x31, 0x0E, 0xD7, 0xA2, 0x13, 0x8E, + 0x52, 0x8D, 0xCB, 0x19, 0x3D, 0x0B, 0x31, 0x58, + 0x4A, 0xDE, 0x0C, 0x01, 0x2B, 0x85, 0x2D, 0xE5, + 0x13, 0x22, 0x48, 0xB6, 0xF3, 0x2D, 0x00, 0x9A + }; + */ + + for (x = 0; x < size; x++) + { + UINT16 dat; + UINT16 dat2 = PROTROM[src + x]; + UINT8 extraoffset = param&0xfe; // the lowest bit changed the table addressing in tests, see 'rawDataOdd' table instead.. it's still related to the main one, not identical + + UINT16 extraxor = ((rawDataEven[((x*2)+0+extraoffset)&0xff]) << 8) | (rawDataEven[((x*2)+1+extraoffset)&0xff] << 0); + + + dat2 = ((dat2 & 0x00ff)<<8) | ((dat2 & 0xff00)>>8); + + dat2 ^= extraxor; + + dat = RAMDUMP[dst + x]; + + + + if (dat2 != dat) + { + + printf("Mode 3 Param %04x | %04x %04x %04x Mismatch! %04x %04x %04x\n", param, src*2+x*2, dst*2+x*2, x*2, dat2, dat, extraxor); + /* is this stuff wrong in the ram dump due to it being overwritten, or is there some other behavior of this mode, that's incorrect + + Mode 3 Param 0054 | 2120 2600 0000 Mismatch! 48e7 b461 72b3 + Mode 3 Param 0054 | 2122 2602 0002 Mismatch! 3000 ba77 1cd4 + Mode 3 Param 0054 | 2124 2604 0004 Mismatch! 4eb9 6cd6 97a0 + Mode 3 Param 0054 | 2126 2606 0006 Mismatch! 0015 c691 b60b + Mode 3 Param 0054 | 2128 2608 0008 Mismatch! 92e0 4338 1f02 + Mode 3 Param 0054 | 212a 260a 000a Mismatch! 23f9 4095 94c5 + Mode 3 Param 0054 | 212c 260c 000c Mismatch! 0081 aae9 831b + Mode 3 Param 0054 | 212e 260e 000e Mismatch! 3664 6adc acc3 + Mode 3 Param 0054 | 2130 2610 0010 Mismatch! 0080 1079 44aa + Mode 3 Param 0054 | 2132 2612 0012 Mismatch! cbb0 c59c d7d9 + Mode 3 Param 0054 | 2134 2614 0014 Mismatch! 23f9 b8be db09 + Mode 3 Param 0054 | 2136 2616 0016 Mismatch! 0081 e1ba a96c + Mode 3 Param 0054 | 2138 2618 0018 Mismatch! 3654 9fdf 6407 + Mode 3 Param 0054 | 213a 261a 001a Mismatch! 0081 28ea f1ad + Mode 3 Param 0054 | 213c 261c 001c Mismatch! 2294 330a 0983 + Mode 3 Param 0054 | 213e 261e 001e Mismatch! 23f9 f506 0e92 + Mode 3 Param 0054 | 2140 2620 0020 Mismatch! 0080 9ffd 2fcd + Mode 3 Param 0054 | 2142 2622 0022 Mismatch! cbb0 ac6b f899 + Mode 3 Param 0054 | 2144 2624 0024 Mismatch! 0080 02bd 63bc + Mode 3 Param 0054 | 2146 2626 0026 Mismatch! cbc4 e6b9 0a3c + Mode 3 Param 0054 | 2148 2628 0028 Mismatch! 23f9 1873 038f + Mode 3 Param 0054 | 214a 262a 002a Mismatch! 0081 1b6a 9133 + Mode 3 Param 0054 | 214c 262c 002c Mismatch! 2294 89c2 ac84 + Mode 3 Param 0054 | 214e 262e 002e Mismatch! 0081 6643 156c + Mode 3 Param 0054 | 2150 2630 0030 Mismatch! 3890 f4bb 673a + Mode 3 Param 0054 | 2152 2632 0032 Mismatch! 4eb9 b49a 69cb + Mode 3 Param 0054 | 2154 2634 0034 Mismatch! 0015 db70 92c7 + Mode 3 Param 0054 | 2156 2636 0036 Mismatch! 92d6 a655 74a1 + Mode 3 Param 0054 | 2158 2638 0038 Mismatch! 4eb9 262f 9099 + Mode 3 Param 0054 | 215a 263a 003a Mismatch! 0010 3704 beee + Mode 3 Param 0054 | 215c 263c 003c Mismatch! ad5c 6002 300d + Mode 3 Param 0054 | 215e 263e 003e Mismatch! 2079 6d8e ba57 + */ + + } + else + { + + // printf("Mode 3 Param %04x | %04x %04x %04x Good! %04x %04x %04x\n", param, src*2+x*2, dst*2+x*2, x*2, dat2, dat, extraxor); + + } + + //state->sharedprotram[dst + x] = dat; + state->sharedprotram[dst + x] = dat2; + } + + } else if (mode == 5) {