Subject: Shogun Warriors / BRAP Boys
Aaron / Kale,
I got a private request to take a look at these, and made a few
discoveries about the external protection data rom.
Basically it's a 'linked list' of encrypted tables and command types /
modes. The encryption is pretty straightforward, although working out
the tables could be tricky. It also has an 'inline table' mode, but
it's only used for a few tables. There is a large 0x1000 block at the
end of all the data which could be related to the normal tables.
I've added some rather verbose code to process the rom, and dump out
some data, so that if somebody wants to look at it further they can.
Understanding how it works properly before decapping it would help to
verify and implement the proper emulation of the device later. (the
actual protection device is a completely unemulated cpu type, so could
prove tricky even with results)
I don't fully understand all the parameters at the moment, although I
suspect that with this newfound knowledge getting the game(s) up and
running would only take a few trojans to figure out the behaviors that
aren't understood, and get the decryption tables (which could be time
consuming otherwise)
The previous implementation of the protection simulation was also wrong,
it copies the first 'block' of data (worked out at the time with a
trojan) upon the first mcu command (0xff) but infact, it shouldn't be
transfered at that point, as the command containing the number of the
table to transfer (0x19 in the list) comes later. The game seems to
provide lists of transfer operations to perform, I suspect some are
direct, and some are indirect. I've also added code to calculate the
CRC of the protection rom, rather than hard coding it.
I haven't yet moved the decrypted startup code out of the driver, which
should be possible as we can correctly copy that from the external rom
using the command system at this point.
I know Andreas was looking at this in the past, so this new information
might be of interest to him, as it provides clearer blocks of encrypted
data, and the 0x1000 block at the end might be of interest to him if it
relates in some way to the smaller 0x40 byte tables used for decrypting
the data.
- Added beatmania IIDX
- SPU board emulation improvements (memory map, IRQ controller, IDE, RF5c400)
- Change 4th mix to use real dumped security dongle data
New games added:
- beatmania IIDX [Guru]
New security key data is uploaded to roms/unemulated/Konami/Twinkle, disc
images are uploading to roms/harddisks/Konami/qg863.
Full sizes are:
863jaa01: 7911684
863jaa04: 333324658
c44jaa03: 4716442606
also included are correctly dumped proms. This does however down-grade the driver to "GAME_WRONG_COLORS" as the old version used "made up" color prom.
New Clone Added
---------------------------
Dambusters (US, set2) [N. Garnier,
D. Beneke, J. Leyda, A. Costin, W. Belk and Smitdogg]
------------------------------------
Sports Shooting USA (Guru)
Ranger Mission (Guru)
We need decryption keys for these - could whoever broke the other AW games
have a look?
Also, in case someone's bored, the AW BIOS is hanging because it wants actual
flash ROMs that respond to flash commands at 0x10000.
----------------
Give us a Break (3rd edition alt?)
Give us a Break (4th edition)
Give us a Break (6th edition alt?)
Give us a Break (7th edition)
Give us a Break (21st edition)
Give us a Break (43rd edition)
[Anonymous, alien_mame]
