trunk/src/mame/drivers/cps3.c
| r25381 | r25382 | |
|---|
| 151 | 151 | BIOS and code and running it on the PCB. It is known that neither of these CPU's will run standard |
| 152 | 152 | (i.e. unencrypted) SH2 code. |
| 153 | 153 | |
| 154 | | The security cart is thought to work like this: the flashROM in the cart contains a program BIOS which is |
| 154 | The security cart works like this: the flashROM in the cart contains a program BIOS which is |
| 155 | 155 | decrypted by the CPU in the cart (the CPU has built-in decryption) then executed by that CPU to boot the |
| 156 | 156 | BIOS code. Even though the code in the flashROM is encrypted, the cart can run it even if it is dead/suicided |
| 157 | 157 | because it has been discovered that the BIOS contains a hidden security menu allowing the cart to be loaded |
| 158 | 158 | with the security data. This proves the cart runs the BIOS even if it is dead. The special security menu is |
| 159 | | not normally available but is likely accessed with a special key/button combination which is unknown ATM. |
| 160 | | The cart contains a FM1208S NVRAM which appears to either be unused or holds game settings. Because the CPU |
| 161 | | in the cart is always powered by a battery, it has stealth capability that allows it to continually monitor |
| 162 | | the situation. If the custom CPU detects any tampering (generally things such as voltage fluctuation or |
| 163 | | voltage dropping or even removal of the cart with the power on), it immediately erases the SRAM inside the |
| 164 | | CPU (and thus the key) which effectively kills the security cart dead. This also suggests that the custom |
| 165 | | Capcom CPU contains some additional internal code to initiate the boot process which is battery-backed as |
| 166 | | well. It is known (from decapping it) that the CPU in the security cart does contain an amount of static |
| 167 | | RAM for data storage and a SH2 core. |
| 159 | not normally available but is likely accessed with a special key/button combination which is unknown ATM. |
| 160 | The cart contains a FM1208S NVRAM which appears to either be unused or holds game settings. |
| 161 | |
| 162 | There are 4 types of CPS3 carts. They have a label on the custom CPU that can be either A,B,C or D. |
| 163 | Cartidge types A and B are identical and both have extra space on the back side to solder a 29F400 in PSOP-44 |
| 164 | package, which is much easier to assemble as compared to the default TSOP-48 package. |
| 165 | A and B cartridges also contain a FM1208S NVRAM which appears to be used or holds game settings. |
| 166 | C and D cartridges lack the extra space to solder a PSOP-44 Flash Rom and instead of the FM1208 |
| 167 | it has a MACH111 which is a EE CMOS CPLD. C and D cartridge still have a space to solder a FM1208. |
| 168 | |
| 169 | Because the CPU in the cart is always powered by a battery, it has stealth capability that allows it to |
| 170 | continually monitor the situation. If the custom CPU detects any tampering (generally things such as voltage |
| 171 | fluctuation or voltage dropping or even removal of the cart with the power on), it immediately erases the SRAM |
| 172 | inside the CPU (and thus the key) which effectively kills the security cart dead. When a cartridge goes dead, |
| 173 | it will set the decryption keys identical to the ones of SFIII-2nd Impact, so removing the battery and changing |
| 174 | the content of the BIOS (if it's not a 2nd Impact) will make it run as a normal SFIII-2nd Impact cartridge. |
| 175 | It is known (from decapping it) that the CPU in the security cart does contain an amount of static RAM |
| 176 | for data storage and a SH2 core. |
| 168 | 177 | |
| 169 | 178 | The main board uses the familiar Capcom SIMM modules to hold the data from the CDROM so that the life of |
| 170 | 179 | the CD drive is maximized. The SIMMs don't contain RAM, but instead TSOP48 surface mounted flashROMs that |