Previous 199869 Revisions Next

r21773 Saturday 9th March, 2013 at 18:39:33 UTC by David Haywood
bit of rearranging of the stvprot.c code with a view to easier dumping out encrypted / non-encrypted streams.
[src/mame/machine]stvprot.c

trunk/src/mame/machine/stvprot.c
r21772r21773
102102#include "stvprot.h"
103103#include "includes/stv.h"
104104
105// these should become member variables!
106UINT32 m_abus_protenable;
107UINT32 m_abus_prot_addr;
108UINT32 m_abus_protkey;
109
105110static UINT32 a_bus[4];
106111static UINT32 ctrl_index;
107112static UINT32 internal_counter;
108113static UINT8 char_offset; //helper to jump the decoding of the NULL chars.
109114
115
116
110117/************************
111118*
112119* Tecmo World Cup '98
r21772r21773
123130 with 0x60651f8
124131 */
125132
133
134//MAIN : 12120000  DATA : 0ad20069 Tecmo logo
135//MAIN : 12120000  DATA : e332006b title screen
136// TODO: encrypted / compressed data.
137// Both points to a section that has a string ("TECMO" / "TITLE")
138
126139static UINT32 twcup_prot_data[8] =
127140{
128141   0x23232323, 0x23232323, 0x4c4c4c4c, 0x4c156301
r21772r21773
132145{
133146   UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
134147
135   if(a_bus[0] & 0x00010000)//protection calculation is activated
148   if(m_abus_protenable & 0x00010000)
136149   {
137150      if(offset == 3)
138151      {
139152         UINT32 res;
140         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),a_bus[3]);
153         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),m_abus_protkey);
141154         #ifdef MAME_DEBUG
142         popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),a_bus[3]);
155         popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),m_abus_protkey);
143156         #endif
144         switch(a_bus[3] >> 16)
157         switch(m_abus_protkey >> 16)
145158         {
146159            case 0x1212:
147160               if(ctrl_index & 2)
r21772r21773
172185   }
173186}
174187
175static WRITE32_HANDLER ( twcup98_prot_w )
176{
177   COMBINE_DATA(&a_bus[offset]);
178   logerror("A-Bus control protection write at %06x: [%02x] <- %08x\n",space.device().safe_pc(),offset,data);
179188
180   if(offset == 3)
181   {
182      int a_bus_vector;
183189
184      a_bus_vector = a_bus[2] >> 16;
185      a_bus_vector|= (a_bus[2] & 0xffff) << 16;
186      a_bus_vector<<= 1;
187
188      //MAIN : 12120000  DATA : 0ad20069 Tecmo logo
189      //MAIN : 12120000  DATA : e332006b title screen
190
191      /* TODO: encrypted / compressed data.
192         Both points to a section that has a string ("TECMO" / "TITLE") */
193
194      //printf("MAIN : %08x  DATA : %08x %08x\n",a_bus[3],a_bus[2],a_bus_vector);
195
196      switch(a_bus[3] >> 16)
197      {
198         case 0x1212:
199            ctrl_index = a_bus_vector;
200            break;
201      }
202
203   }
204   //popmessage("%04x %04x",data,offset/4);
205}
206
207void install_twcup98_protection(running_machine &machine)
208{
209   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(twcup98_prot_r), FUNC(twcup98_prot_w));
210}
211
212190/**************************
213191*
214192* Steep Slope Sliders
r21772r21773
219197{
220198   UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
221199
222   if(a_bus[0] & 0x00010000)//protection calculation is activated
200   if(m_abus_protenable & 0x00010000)//protection calculation is activated
223201   {
224202      if(offset == 3)
225203      {
226204         UINT32 res;
227205
228         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),a_bus[3]);
206         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),m_abus_protkey);
229207         #ifdef MAME_DEBUG
230         popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),a_bus[3]);
208         popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),m_abus_protkey);
231209         #endif
232         switch(a_bus[3]>>16)
210         int read_offset_hack = 0;
211         
212         /*
213            MAIN : 2c5b0000  DATA : 000000a6 014c0000
214            MAIN : 47f10000  DATA : 0f9800a6 014c1f30
215            MAIN : fcda0000  DATA : 1d4800a6 014c3a90
216            MAIN : b5e60000  DATA : 29e300a6 014c53c6
217            MAIN : 392c0000  DATA : 38e900a6 014c71d2
218            MAIN : 77c30000  DATA : 462500a6 014c8c4a
219            MAIN : 8a620000  DATA : 555c00a6 014caab8
220         */
221
222         // I have a feeling rather than the offsets being scrambled they were lazy
223         // and left unencrypted copies in the ROM... but this still needs verification
224         switch(m_abus_protkey>>16)
233225         {
234            case 0x2c5b:
235            case 0x47f1:
236            case 0xfcda:
237            case 0xb5e6:
238            case 0x392c:
239            case 0x77c3:
240            case 0x8a62:
226            case 0x2c5b: read_offset_hack = 0x60054; break;
227            case 0x47f1: read_offset_hack = 0x56498; break;
228            case 0xfcda: read_offset_hack = 0x50b0c; break;
229            case 0xb5e6: read_offset_hack = 0x4af56; break;
230            case 0x392c: read_offset_hack = 0x45876; break;
231            case 0x77c3: read_offset_hack = 0x3fe02; break;
232            case 0x8a62: read_offset_hack = 0x3a784; break;
233         }
234
235         switch(m_abus_protkey>>16)
236         {
237            default:
241238               if(ctrl_index & 2)
242239               {
243                  res = (ROM[ctrl_index / 4] & 0xffff) << 16;
244                  res |= (ROM[(ctrl_index+4) / 4] & 0xffff0000) >> 16;
240                  res = (ROM[(ctrl_index-read_offset_hack) / 4] & 0xffff) << 16;
241                  res |= (ROM[((ctrl_index-read_offset_hack)+4) / 4] & 0xffff0000) >> 16;
245242               }
246243               else
247244               {
248                  res = ROM[ctrl_index / 4] & 0xffff0000;
249                  res |= ROM[ctrl_index / 4] & 0xffff;
245                  res = ROM[(ctrl_index-read_offset_hack) / 4] & 0xffff0000;
246                  res |= ROM[(ctrl_index-read_offset_hack) / 4] & 0xffff;
250247               }
251248               ctrl_index+=4;
252249               return res;
r21772r21773
261258   }
262259}
263260
264static WRITE32_HANDLER ( sss_prot_w )
265{
266   COMBINE_DATA(&a_bus[offset]);
267   logerror("A-Bus control protection write at %06x: [%02x] <- %08x\n",space.device().safe_pc(),offset,data);
268   if(offset == 3)
269   {
270      int a_bus_vector;
271261
272      a_bus_vector = a_bus[2] >> 16;
273      a_bus_vector|= (a_bus[2] & 0xffff) << 16;
274      a_bus_vector<<= 1;
275262
276      /*
277MAIN : 2c5b0000  DATA : 000000a6 014c0000
278MAIN : 47f10000  DATA : 0f9800a6 014c1f30
279MAIN : fcda0000  DATA : 1d4800a6 014c3a90
280MAIN : b5e60000  DATA : 29e300a6 014c53c6
281MAIN : 392c0000  DATA : 38e900a6 014c71d2
282MAIN : 77c30000  DATA : 462500a6 014c8c4a
283MAIN : 8a620000  DATA : 555c00a6 014caab8
284      */
285263
286//      printf("MAIN : %08x  DATA : %08x %08x\n",a_bus[3],a_bus[2],a_bus_vector);
287      switch(a_bus[3] >> 16)
288      {
289         /* Note: only the first value is TRUSTED (because it's tested in the code).
290            Others are hand-tuned by checking if there isn't any garbage during display. */
291         case 0x2c5b: ctrl_index = (a_bus_vector-0x60054); break;
292         case 0x47f1: ctrl_index = (a_bus_vector-0x56498); break;
293         case 0xfcda: ctrl_index = (a_bus_vector-0x50b0c); break;
294         case 0xb5e6: ctrl_index = (a_bus_vector-0x4af56); break;
295         case 0x392c: ctrl_index = (a_bus_vector-0x45876); break;
296         case 0x77c3: ctrl_index = (a_bus_vector-0x3fe02); break;
297         case 0x8a62: ctrl_index = (a_bus_vector-0x3a784); break;
298         default:
299            ctrl_index = 0;
300            popmessage("Unknown SSS seed %04x, contact MAMEdev",a_bus[3] >> 16);
301            break;
302      }
303
304//      printf("%08x\n",ctrl_index);
305   }
306}
307
308void install_sss_protection(running_machine &machine)
309{
310   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(sss_prot_r), FUNC(sss_prot_w));
311}
312
313264/*************************************
314265*
315266* Radiant Silvergun
r21772r21773
320271{
321272   UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
322273
323   if(a_bus[0] & 0x00010000)//protection calculation is activated
274   if(m_abus_protenable & 0x00010000)//protection calculation is activated
324275   {
325276      if(offset == 3)
326277      {
327         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),a_bus[3]);
278         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),m_abus_protkey);
328279         #ifdef MAME_DEBUG
329         popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),a_bus[3]);
280         popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),m_abus_protkey);
330281         #endif
331         switch(a_bus[3])
282         switch(m_abus_protkey)
332283         {
333284            case 0x77770000: {//rsgun
334285               UINT32 val =
r21772r21773
359310{
360311   COMBINE_DATA(&a_bus[offset]);
361312   logerror("A-Bus control protection write at %06x: [%02x] <- %08x\n",space.device().safe_pc(),offset,data);
362   if(offset == 3)
313
314   if (offset == 0)
363315   {
316      COMBINE_DATA(&m_abus_protenable);
317   }
318   else if(offset == 2)
319   {
320      COMBINE_DATA(&m_abus_prot_addr);
321   }
322   else if(offset == 3)
323   {
324      COMBINE_DATA(&m_abus_protkey);
364325//      int a_bus_vector;
365326
366//      a_bus_vector = a_bus[2] >> 16;
367//      a_bus_vector|= (a_bus[2] & 0xffff) << 16;
327//      a_bus_vector = m_abus_prot_addr >> 16;
328//      a_bus_vector|= (m_abus_prot_addr & 0xffff) << 16;
368329//      a_bus_vector<<= 1;
369//      printf("MAIN : %08x  DATA : %08x %08x\n",a_bus[3],a_bus[2],a_bus_vector);
370      switch(a_bus[3])
330//      printf("MAIN : %08x  DATA : %08x %08x\n",m_abus_protkey,m_abus_prot_addr,a_bus_vector);
331      switch(m_abus_protkey)
371332      {
372333         case 0x77770000: ctrl_index = 0; break;
373334      }
r21772r21773
375336   //popmessage("%04x %04x",data,offset/4);
376337}
377338
378void install_rsgun_protection(running_machine &machine)
379{
380   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(rsgun_prot_r), FUNC(rsgun_prot_w));
381}
382339
340
341
383342/*************************
384343*
385344* Elandoree
r21772r21773
390349{
391350   UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
392351
393   if(a_bus[0] & 0x00010000)//protection calculation is activated
352   if(m_abus_protenable & 0x00010000)//protection calculation is activated
394353   {
395354      if(offset == 3)
396355      {
397356         UINT32 res;
398         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),a_bus[3]);
357         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),m_abus_protkey);
399358         #ifdef MAME_DEBUG
400         popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),a_bus[3]);
359         popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),m_abus_protkey);
401360         #endif
402         switch(a_bus[3] >> 16)
361         switch(m_abus_protkey >> 16)
403362         {
404363            default:
405364               if(ctrl_index & 2)
r21772r21773
425384   }
426385}
427386
428static WRITE32_HANDLER ( elandore_prot_w )
429{
430   COMBINE_DATA(&a_bus[offset]);
431   logerror("A-Bus control protection write at %06x: [%02x] <- %08x\n",space.device().safe_pc(),offset,data);
432   if(offset == 3)
433   {
434      int a_bus_vector;
435387
436      a_bus_vector = a_bus[2] >> 16;
437      a_bus_vector|= (a_bus[2] & 0xffff) << 16;
438      a_bus_vector<<= 1;
439388
440      //printf("MAIN : %08x  DATA : %08x %08x\n",a_bus[3],a_bus[2],a_bus_vector);
441      switch(a_bus[3] >> 16)
442      {
443         default:
444            ctrl_index = a_bus_vector;
445            break;
446      }
447   }
448   //popmessage("%04x %04x",data,offset/4);
449}
450
451void install_elandore_protection(running_machine &machine)
452{
453   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(elandore_prot_r), FUNC(elandore_prot_w));
454}
455
456389/*************************
457390*
458391* Final Fight Revenge
r21772r21773
724657{
725658   UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
726659
727   if(a_bus[0] & 0x00010000)//protection calculation is activated
660   if(m_abus_protenable & 0x00010000)//protection calculation is activated
728661   {
729662      if(offset == 3)
730663      {
731664         #if 0
732665         UINT32 res;
733666         #endif
734         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),a_bus[3]);
735         switch(a_bus[3] >> 16)
667         logerror("A-Bus control protection read at %06x with data = %08x\n",space.device().safe_pc(),m_abus_protkey);
668         switch(m_abus_protkey >> 16)
736669         {
737670            case 0x10da://ffreveng, boot vectors at $6080000,test mode
738671            case 0x10d7://ffreveng, boot vectors at $6080000,attract mode
r21772r21773
761694   }
762695}
763696
764static WRITE32_HANDLER ( ffreveng_prot_w )
765{
766   COMBINE_DATA(&a_bus[offset]);
767   logerror("A-Bus control protection write at %06x: [%02x] <- %08x\n",space.device().safe_pc(),offset,data);
768   if(offset == 3)
769   {
770      int a_bus_vector;
771697
772      a_bus_vector = a_bus[2] >> 16;
773      a_bus_vector|= (a_bus[2] & 0xffff) << 16;
774      a_bus_vector<<= 1;
775698
776      printf("MAIN : %08x  DATA : %08x %08x\n",a_bus[3],a_bus[2],a_bus_vector);
777      switch(a_bus[3] >> 16)
778      {
779         case 0x10d7: ctrl_index = a_bus_vector; break;
780         case 0x10da: ctrl_index = a_bus_vector; break;
781         default:
782            ctrl_index = 0;
783      }
784   }
785   //popmessage("%04x %04x",data,offset/4);
786}
787
788void install_ffreveng_protection(running_machine &machine)
789{
790   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(ffreveng_prot_r), FUNC(ffreveng_prot_w));
791}
792
793699/************************
794700*
795701* Astra Super Stars
r21772r21773
798704
799705static READ32_HANDLER(astrass_prot_r)
800706{
801   if ( offset == 3 && ctrl_index != -1 )
707   if(m_abus_protenable & 0x00010000)
802708   {
803      UINT32 data = 0;
804      UINT32 *prot_data = (UINT32 *)space.machine().root_device().memregion("user2")->base();
709      if(offset == 3)
710      {
805711
806      data = prot_data[ctrl_index++];
712         /* we're reading from a custom region, NOT the rom address, so we're based at 0, the real data likely exists at this address */
713         int read_offset_hack = 0x4ec260;
807714
808      if ( ctrl_index >= space.machine().root_device().memregion("user2")->bytes()/4 )
809      {
810         ctrl_index = -1;
811      }
715         UINT32 data = 0;
716         UINT32 *prot_data = (UINT32 *)space.machine().root_device().memregion("user2")->base();
812717
813      return data;
718         data = prot_data[(ctrl_index-read_offset_hack)];
719         ctrl_index++;
720
721         if ( (ctrl_index-read_offset_hack) >= space.machine().root_device().memregion("user2")->bytes()/4 )
722         {
723            ctrl_index = -1;
724         }
725
726         return data;
727      }
728     
814729   }
815730   return a_bus[offset];
816731}
817732
818static WRITE32_HANDLER(astrass_prot_w)
733
734
735static WRITE32_HANDLER ( common_prot_w )
819736{
820   COMBINE_DATA(&a_bus[0 + offset]);
821   if ( offset == 3 )
737   COMBINE_DATA(&a_bus[offset]);
738   //printf("A-Bus control protection write at %06x: [%02x] <- %08x\n",space.device().safe_pc(),offset,data);
739   
740   if (offset == 0)
822741   {
823      ctrl_index = 0;
742      COMBINE_DATA(&m_abus_protenable);
824743   }
744   else if(offset == 2)
745   {
746      COMBINE_DATA(&m_abus_prot_addr);
747   }
748   else if(offset == 3)
749   {
750      COMBINE_DATA(&m_abus_protkey);
751      int a_bus_vector;
752      a_bus_vector = m_abus_prot_addr >> 16;
753      a_bus_vector|= (m_abus_prot_addr & 0xffff) << 16;
754      a_bus_vector<<= 1;
755      //printf("MAIN : %08x  DATA : %08x %08x\n",m_abus_protkey,m_abus_prot_addr,a_bus_vector);
756     
757      // if you look at the first transfer in ffreveng this is clearly a ROM address from a table |  MAIN : 10d70000  DATA : 0b780013 002616f0
758      // (opr21872.7, offset 0x616f0, which happens to be 0x2616f0 in the ROM region "game0")
759      // the values sent by the CPU are plucked from a table above where the data is, located at 0x60000
760      // Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
761      // 00060000   00 00 16 F0 00 00 2F A0  00 00 46 90 00 00 4D 04
762      // this is the first entry in the table, 0x16f0 is the address, 0x2fa0 is the length.
763      // the next entry is address 0x4690, length 0x4d04.  0x16f0 + 0x2fa0 == 0x4690 so that entry is located straight after the first one
764      // the game reads the number of bytes specified in the length via the protection device, writing them to RAM.  This suggests there
765      // is no compression going on, only some form of encryption.
766
767      ctrl_index = a_bus_vector;
768   }
825769}
826770
771
772
773
774void install_sss_protection(running_machine &machine)
775{
776   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(sss_prot_r), FUNC(common_prot_w));
777}
778
827779void install_astrass_protection(running_machine &machine)
828780{
829781   ctrl_index = -1;
830   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(astrass_prot_r), FUNC(astrass_prot_w));
782   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(astrass_prot_r), FUNC(common_prot_w));
831783}
832784
785void install_ffreveng_protection(running_machine &machine)
786{
787   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(ffreveng_prot_r), FUNC(common_prot_w));
788}
789
790void install_elandore_protection(running_machine &machine)
791{
792   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(elandore_prot_r), FUNC(common_prot_w));
793}
794
795void install_rsgun_protection(running_machine &machine)
796{
797   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(rsgun_prot_r), FUNC(rsgun_prot_w));
798}
799
800void install_twcup98_protection(running_machine &machine)
801{
802   machine.device("maincpu")->memory().space(AS_PROGRAM).install_legacy_readwrite_handler(0x4fffff0, 0x4ffffff, FUNC(twcup98_prot_r), FUNC(common_prot_w));
803}
804
805
806
833807void stv_register_protection_savestates(running_machine &machine)
834808{
835809   state_save_register_global_array(machine, a_bus);

Previous 199869 Revisions Next

© 1997-2024 The MAME Team