Previous 199869 Revisions Next

r25520 Friday 4th October, 2013 at 16:10:20 UTC by David Haywood
Improvements to Dragon World 3 protection simulation, game seems mostly playable now although a DMA mode copying 68k code to RAM is still missing [iq_132]
[src/mame/drivers]pgm.c
[src/mame/includes]pgm.h
[src/mame/machine]pgmprot_igs025_igs022.c

trunk/src/mame/drivers/pgm.c
r25519r25520
977977   ROM_LOAD16_BYTE( "dw3_v106.u13",     0x100000, 0x080000,  CRC(28284e22) SHA1(4643a69881ddb7383ca10f3eb2aa2cf41be39e9f) )
978978
979979   ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data - is it correct for this set? */
980   ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
980   ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
981981
982982   ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
983983   PGM_VIDEO_BIOS
r25519r25520
10031003   ROM_LOAD16_BYTE( "dw3_v105.u13",     0x100000, 0x080000,  CRC(8d6c9d39) SHA1(cb79303ab551e91f07e11414db4254d5b161d415) )
10041004
10051005   ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data - is it correct for this set? */
1006   ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
1006   ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
10071007
10081008   ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
10091009   PGM_VIDEO_BIOS
r25519r25520
10511051   ROM_LOAD16_BYTE( "dw3_v100.u13",     0x100000, 0x080000,  CRC(b7cded21) SHA1(c1ae2af2e42227503c81bbcd2bd6862aa416bd78) )
10521052
10531053   ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */
1054   ROM_LOAD16_WORD_SWAP( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
1054   ROM_LOAD( "dw3_v100.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
10551055
10561056   ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
10571057   PGM_VIDEO_BIOS
r25519r25520
11031103   ROM_LOAD16_BYTE( "ex_v100.u13",     0x100000, 0x080000, CRC(7afe6322) SHA1(a52d71af1d6de16c5a3df23eacdab3466693ba8d) )
11041104
11051105   ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */
1106   ROM_LOAD16_WORD_SWAP( "ex_data.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
1106   ROM_LOAD( "ex_data.u15", 0x000000, 0x010000, CRC(03dc4fdf) SHA1(b329b04325d4f725231b1bb7862eedef2319b652) )
11071107
11081108   ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
11091109   PGM_VIDEO_BIOS
r25519r25520
18611861   ROM_LOAD16_WORD_SWAP( "p0300_v109.u9", 0x100000, 0x200000, CRC(2fcee215) SHA1(855281a9090bfdf3da9f4d50c121765131a13400) )
18621862
18631863   ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */
1864   ROM_LOAD16_WORD_SWAP( "kb_u2.rom", 0x000000, 0x010000,  CRC(de3eae63) SHA1(03af767ef764055bda528b5cc6a24b9e1218cca8) )
1864   ROM_LOAD( "kb_u2.rom", 0x000000, 0x010000,  CRC(de3eae63) SHA1(03af767ef764055bda528b5cc6a24b9e1218cca8) )
18651865
18661866   ROM_REGION( 0x800000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
18671867   PGM_VIDEO_BIOS
r25519r25520
18971897   ROM_LOAD16_BYTE( "kb_u5_v104.u5",     0x200000, 0x080000, CRC(a0bafc29) SHA1(b20db7c16353c6f87ed3c08c9d037b07336711f1) )
18981898
18991899   ROM_REGION( 0x010000, "igs022data", 0 ) /* Protection Data */
1900   ROM_LOAD16_WORD_SWAP( "kb_u2_v104.u2", 0x000000, 0x010000,  CRC(c970f6d5) SHA1(399fc6f80262784c566363c847dc3fdc4fb37494) )
1900   ROM_LOAD( "kb_u2_v104.u2", 0x000000, 0x010000,  CRC(c970f6d5) SHA1(399fc6f80262784c566363c847dc3fdc4fb37494) )
19011901
19021902   ROM_REGION( 0x800000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
19031903   PGM_VIDEO_BIOS
r25519r25520
40144014GAME( 1997, drgw2j,       drgw2,     pgm_012_025_drgw2,     pgm, pgm_012_025_state,      drgw2j,     ROT0,   "IGS", "Chuugokuryuu II (ver. 100J, Japan)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE )
40154015GAME( 1997, drgw2c,       drgw2,     pgm_012_025_drgw2,     pgm, pgm_012_025_state,      drgw2c,     ROT0,   "IGS", "Zhong Guo Long II (ver. 100C, China)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE )
40164016
4017GAME( 1998, killbld,      pgm,       pgm_022_025_kb, killbld, pgm_022_025_state,  killbld,    ROT0,   "IGS", "The Killing Blade (ver. 109, Chinese Board)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
4018GAME( 1998, killbld104,   killbld,   pgm_022_025_kb, killbld, pgm_022_025_state,  killbld,    ROT0,   "IGS", "The Killing Blade (ver. 104)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
4017GAME( 1998, killbld,      pgm,       pgm_022_025, killbld, pgm_022_025_state,  killbld,    ROT0,   "IGS", "The Killing Blade (ver. 109, Chinese Board)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
4018GAME( 1998, killbld104,   killbld,   pgm_022_025, killbld, pgm_022_025_state,  killbld,    ROT0,   "IGS", "The Killing Blade (ver. 104)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
40194019
4020// these seem playable but the DMA mode transfering 68k code to RAM is not emulated so there could still be problems
4021GAME( 1998, drgw3,        pgm,       pgm_022_025,     dw3, pgm_022_025_state,      drgw3,      ROT0,   "IGS", "Dragon World 3 (ver. 106, Korean Board)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
4022GAME( 1998, drgw3105,     drgw3,     pgm_022_025,     dw3, pgm_022_025_state,      drgw3,      ROT0,   "IGS", "Dragon World 3 (ver. 105)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
4023GAME( 1998, drgw3100,     drgw3,     pgm_022_025,     dw3, pgm_022_025_state,      drgw3,      ROT0,   "IGS", "Dragon World 3 (ver. 100)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) // Japan Only?
4024
4025GAME( 1998, dwex,         pgm,       pgm_022_025,     dw3, pgm_022_025_state,      drgw3,      ROT0,   "IGS", "Dragon World 3 EX (ver. 100)", GAME_UNEMULATED_PROTECTION | GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
4026
40204027// region provided by internal ARM rom
40214028GAME( 1999, photoy2k,     pgm,       pgm_arm_type1,     photoy2k, pgm_arm_type1_state, photoy2k,   ROT0,   "IGS", "Photo Y2K (ver. 105)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
40224029GAME( 1999, photoy2k104,  photoy2k,  pgm_arm_type1,     photoy2k, pgm_arm_type1_state, photoy2k,   ROT0,   "IGS", "Photo Y2K (ver. 104)", GAME_IMPERFECT_SOUND | GAME_SUPPORTS_SAVE ) /* region provided by protection device */
r25519r25520
41344141   NOT Working (mostly due to needing internal protection roms dumped)
41354142   -----------------------------------------------------------------------------------------------------------------------*/
41364143
4137// should have DMA protection, like killbld, as well as the math / bitswap / memory manipulation stuff, but it never attempts to trigger the DMA? - we currently have a RAM dump to allow it to boot, but I think this stuff should be DMA copied into RAM, like killbld
4138GAME( 1998, drgw3,        pgm,       pgm_022_025_dw,     dw3, pgm_022_025_state,      drgw3,      ROT0,   "IGS", "Dragon World 3 (ver. 106, Korean Board)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE )
4139GAME( 1998, drgw3105,     drgw3,     pgm_022_025_dw,     dw3, pgm_022_025_state,      drgw3,      ROT0,   "IGS", "Dragon World 3 (ver. 105)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE )
4140GAME( 1998, drgw3100,     drgw3,     pgm_022_025_dw,     dw3, pgm_022_025_state,      drgw3,      ROT0,   "IGS", "Dragon World 3 (ver. 100)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) // Japan Only?
4141
4142GAME( 1998, dwex,         pgm,       pgm_022_025_dw,     dw3, pgm_022_025_state,      drgw3,      ROT0,   "IGS", "Dragon World 3 EX (ver. 100)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE )
4143
4144
41454144GAME( 1999, puzlstar,     pgm,       pgm_arm_type1_sim,    pstar, pgm_arm_type1_state,    pstar,      ROT0,   "IGS", "Puzzle Star (ver. 100MG)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
41464145
41474146GAME( 2001, py2k2,        pgm,       pgm_arm_type1_sim,    py2k2, pgm_arm_type1_state,    py2k2,      ROT0,   "IGS", "Photo Y2K 2", GAME_NOT_WORKING )  /* need internal rom of IGS027A */
trunk/src/mame/machine/pgmprot_igs025_igs022.c
r25519r25520
55 used on the following PGM games
66
77 The Killing Blade
8 Dragon World 3*
9 Dragon World 3 EX*
8 Dragon World 3
9 Dragon World 3 EX
1010
11 * preliminary, not working
12
1311 ----
1412
1513 IGS022 is an encrypted DMA device, most likely an MCU of some sort
r25519r25520
2624/* The IGS022 is an MCU which performs encrypted DMA used by
2725 - The Killing Blade
2826 - Dragon World 3
27 - Dragon World 3 Ex
2928
3029 There is also an automatic transfer which happens on startup using params stored in the data ROM.
3130 This has been verified on real hardware running without any 68k game program.
32
3331*/
3432
3533void pgm_022_025_state::pgm_dw3_decrypt()
r25519r25520
187185
188186// all tables xored with data from $149c4c
189187// tables are the same as olds and drgw2
190static const UINT8 dw3_source_data[0x07][0xec] =
188static const UINT8 dw3_source_data[0x08][0xec] =
191189{
190   { 0, },
192191   { // region 1, $14c21a
193192      0x67, 0x51, 0xf3, 0x19, 0xa0, 0x09, 0xb1, 0x21, 0xb0, 0xee, 0xe3, 0xf6, 0xbe, 0x81, 0x35, 0xe3,
194193      0xfb, 0xe6, 0xef, 0xdf, 0x61, 0x01, 0xfa, 0x22, 0x5d, 0x43, 0x01, 0xa5, 0x3b, 0x17, 0xd4, 0x74,
r25519r25520
325324   1,2,3 table based ops
326325   */
327326
328   //mame_printf_debug("src %04x dst %04x size %04x mode %04x\n", src, dst, size, mode);
329
330327   param = mode >> 8;
331328   mode &=0xf;  // what are the other bits?
332329
r25519r25520
350347         UINT16 dat2 = PROTROM[src + x];
351348
352349         UINT8 extraoffset = param&0xff;
353         UINT8* dectable = (UINT8*)memregion("igs022data")->base(); // the basic decryption table is at the start of the mcu data rom! at least in killbld
350         UINT8* dectable = (UINT8*)memregion("igs022data")->base(); // the basic decryption table is at the start of the mcu data rom!
354351         UINT8 taboff = ((x*2)+extraoffset) & 0xff; // must allow for overflow in instances of odd offsets
355         UINT16 extraxor = ((dectable[taboff+0]) << 8) | (dectable[taboff+1] << 0);
352         UINT16 extraxor = ((dectable[taboff+1]) << 8) | (dectable[taboff+0] << 0);
356353
357         dat2 = ((dat2 & 0x00ff)<<8) | ((dat2 & 0xff00)>>8);
358
359354         //  mode==0 plain
360355         if (mode==3) dat2 ^= extraxor;
361356         if (mode==2) dat2 += extraxor;
362357         if (mode==1) dat2 -= extraxor;
363358
364         //if (dat!=dat2)
365         //  printf("Mode %04x Param %04x Mismatch %04x %04x\n", mode, param, dat, dat2);
366
367359         m_sharedprotram[dst + x] = dat2;
368360      }
369
370      /* Killing Blade: hack, patches out some additional security checks... we need to emulate them instead! */
371      // different region IGS025 devices supply different sequences - we currently only have the china sequence for Killing Blade
372      //if ((mode==3) && (param==0x54) && (src*2==0x2120) && (dst*2==0x2600)) m_sharedprotram[0x2600 / 2] = 0x4e75;
373
374361   }
375   if (mode == 4)
362   else if (mode == 4)
376363   {
377364      mame_printf_debug("unhandled copy mode %04x!\n", mode);
365
366      int x;
367      for (x = 0; x < size; x++)
368      {
369         m_sharedprotram[dst + x] = 0x4e75; // Hack until algorithm for decoding this is figured out.
370      }
371
378372      // not used by killing blade
379373      /* looks almost like a fixed value xor, but isn't */
380374   }
381375   else if (mode == 5)
382376   {
383      /* mode 5 seems to be a straight copy */
377      /* mode 5 seems to be a straight copy, byteswap */
384378      int x;
385379      UINT16 *PROTROM = (UINT16*)memregion("igs022data")->base();
386380      for (x = 0; x < size; x++)
387381      {
388382         UINT16 dat = PROTROM[src + x];
389383
390         m_sharedprotram[dst + x] = dat;
384         m_sharedprotram[dst + x] = (dat << 8) | (dat >> 8);
391385      }
392386   }
393387   else if (mode == 6)
r25519r25520
416410   else
417411   {
418412      mame_printf_debug("unhandled copy mode %04x!\n", mode);
413      logerror ("DMA MODE: %d, src: %4.4x, dst: %4.4x, size: %4.4x, param: %2.2x\n", mode, src, dst, size, param);
419414      // not used by killing blade
420415      /* invalid? */
421
422416   }
423417}
424418
r25519r25520
428422{
429423   int i;
430424   UINT16 *PROTROM = (UINT16*)memregion("igs022data")->base();
431   UINT16 tmp;
432425
433426   // fill ram with A5 patern
434427   for (i = 0; i < 0x4000/2; i++)
435428      m_sharedprotram[i] = 0xa55a;
436429
437430   // the auto-dma
438   UINT16 src = PROTROM[0x100 / 2];
439   UINT32 dst = PROTROM[0x102 / 2];
440   UINT16 size = PROTROM[0x104/ 2];
431   UINT16 src  = PROTROM[0x100 / 2];
432   UINT32 dst  = PROTROM[0x102 / 2];
433   UINT16 size = PROTROM[0x104 / 2];
441434   UINT16 mode = PROTROM[0x106 / 2];
442435
443436   src = ((src & 0xff00) >> 8) | ((src & 0x00ff) << 8);
r25519r25520
447440
448441   src >>= 1;
449442
450//  printf("Auto-DMA %04x %04x %04x %04x\n",src,dst,size,mode);
451
452443   IGS022_do_dma(src,dst,size,mode);
453444
454445   // there is also a version ID? (or is it some kind of checksum) that is stored in the data rom, and gets copied..
455446   // Dragon World 3 checks it
456   tmp = PROTROM[0x114/2];
457   tmp = ((tmp & 0xff00) >> 8) | ((tmp & 0x00ff) << 8);
458   m_sharedprotram[0x2a2/2] = tmp;
447   // Setting $3002a0 to #3 causes Dragon World 3 to skip this check
448   m_sharedprotram[0x2a2/2] = PROTROM[0x114/2];
459449}
460450
461451void pgm_022_025_state::IGS022_handle_command()
462452{
463453   UINT16 cmd = m_sharedprotram[0x200/2];
464454
465   //mame_printf_debug("command %04x\n", cmd);
466
467455   if (cmd == 0x6d)    // Store values to asic ram
468456   {
469457      UINT32 p1 = (m_sharedprotram[0x298/2] << 16) | m_sharedprotram[0x29a/2];
r25519r25520
473461      {
474462         int reg = (p2 >> 16) & 0xffff;
475463
476         if (reg & 0x200)
464         if (reg & 0x300) { // 300?? killbld expects 0x200, drgw3 expects 0x100?
477465            m_kb_regs[reg & 0xff] = p1;
466         }
478467      }
479468
480469      if ((p2 & 0xffff) == 0x6)   // Add value
r25519r25520
501490         m_sharedprotram[0x29c/2] = (m_kb_regs[reg] >> 16) & 0xffff;
502491         m_sharedprotram[0x29e/2] = m_kb_regs[reg] & 0xffff;
503492      }
493
494      m_sharedprotram[0x202 / 2] = 0x7c;   // this mode complete?
504495   }
505496
506   if(cmd == 0x4f) //memcpy with encryption / scrambling
497   // Is this actually what this is suppose to do? Complete guess.
498   if (cmd == 0x12) // copy??
507499   {
508      UINT16 src = m_sharedprotram[0x290 / 2] >> 1; // ?
509      UINT32 dst = m_sharedprotram[0x292 / 2];
500      m_sharedprotram[0x28c / 2] = m_sharedprotram[0x288 / 2];
501      m_sharedprotram[0x28e / 2] = m_sharedprotram[0x28a / 2];
502
503      m_sharedprotram[0x202 / 2] = 0x23;    // this mode complete?
504   }
505
506   // what do these do? write the completion byte for now...
507   if (cmd == 0x45) m_sharedprotram[0x202 / 2] = 0x56;
508   if (cmd == 0x5a) m_sharedprotram[0x202 / 2] = 0x4b;
509   if (cmd == 0x2d) m_sharedprotram[0x202 / 2] = 0x3c;
510
511   if (cmd == 0x4f) // memcpy with encryption / scrambling
512   {
513      UINT16 src  = m_sharedprotram[0x290 / 2] >> 1; // External mcu data is 8 bit and addressed as such
514      UINT32 dst  = m_sharedprotram[0x292 / 2];
510515      UINT16 size = m_sharedprotram[0x294 / 2];
511516      UINT16 mode = m_sharedprotram[0x296 / 2];
512517
513518      IGS022_do_dma(src,dst,size,mode);
519
520      m_sharedprotram[0x202 / 2] = 0x5e;   // this mode complete?
514521   }
515522}
516523
r25519r25520
553560
554561WRITE16_MEMBER(pgm_022_025_state::killbld_igs025_prot_w )
555562{
556   offset &= 0xf;
557
558563   if (offset == 0)
559564   {
560565      m_kb_cmd = data;
r25519r25520
567572            m_kb_reg = data;
568573         break;
569574
570         //case 0x01: // ??
571         //break;
575         case 0x01: // drgw3
576         {
577            if (data == 0x0002) { // Execute command
578               IGS022_handle_command();     
579            }
580         }
581         break;
572582
573         case 0x02:
583         case 0x02: // killbld
574584         {
575            if (data == 0x0001) { // Execute cmd
585            if (data == 0x0001) { // Execute command
576586               IGS022_handle_command();
577587               m_kb_reg++;
578588            }
r25519r25520
584594         break;
585595
586596         case 0x04:
587            m_kb_ptr = data;
597      //      m_kb_ptr = data; // Suspect. Not good for drgw3
588598         break;
589599
590600         case 0x20:
r25519r25520
599609            killbld_protection_calculate_hold(m_kb_cmd & 0x0f, data & 0xff);
600610         break;
601611
602      //  default:
603      //      logerror("%06X: ASIC25 W CMD %X  VAL %X\n", space.device().safe_pc(), m_kb_cmd, data);
612      //   default:
613      //      logerror("%06X: ASIC25 W CMD %X  VAL %X\n", space.device().safe_pc(), m_kb_cmd, data);
604614      }
605615   }
606616}
r25519r25520
612622      switch (m_kb_cmd)
613623      {
614624         case 0x00:
615            return BITSWAP8((m_kb_swap+1)&0xff, 0,1,2,3,4,5,6,7); // dw3
625            return BITSWAP8((m_kb_swap+1) & 0x7f, 0,1,2,3,4,5,6,7); // drgw3
616626
617627         case 0x01:
618628            return m_kb_reg & 0x7f;
619629
620630         case 0x05:
621631         {
622            logerror ("ptr: %d\n", m_kb_ptr);
623
624632            switch (m_kb_ptr)
625633            {
626634               case 1:
r25519r25520
635643               case 4:
636644                  return 0x3f00 | ((m_kb_game_id >> 24) & 0xff);
637645
638               case 5:
639646               default: // >= 5
640647                  return 0x3f00 | BITSWAP8(m_kb_prot_hold, 5,2,9,7,10,13,12,15);
641648            }
r25519r25520
645652
646653         case 0x40:
647654            killbld_protection_calculate_hilo();
648            return 0; // is this used?
655            return 0; // Read and then discarded
649656
650         //default:
651         //  logerror("%06X: ASIC25 R CMD %X\n", space.device().safe_pc(), m_kb_cmd);
657      //   default:
658      //      logerror("%06X: ASIC25 R CMD %X\n", space.device().safe_pc(), m_kb_cmd);
652659      }
653660   }
654661
r25519r25520
670677   m_kb_ptr = 0;
671678   m_kb_swap = 0;
672679
673   memset(m_kb_regs, 0, 0x10 * sizeof(UINT32));
680   memset(m_kb_regs, 0, 0x100 * sizeof(UINT32));
674681}
675682
676683DRIVER_INIT_MEMBER(pgm_022_025_state,killbld)
r25519r25520
691698   m_kb_reg = 0;
692699   m_kb_ptr = 0;
693700   m_kb_swap = 0;
694   memset(m_kb_regs, 0, 0x10 * sizeof(UINT32));
701   memset(m_kb_regs, 0, 0x100 * sizeof(UINT32));
695702
696703   save_item(NAME(m_kb_prot_hold));
697704   save_item(NAME(m_kb_prot_hilo));
r25519r25520
702709   save_item(NAME(m_kb_regs));
703710}
704711
705MACHINE_RESET_MEMBER(pgm_022_025_state,dw3)
706{
707   MACHINE_RESET_CALL_MEMBER(pgm);
708   /* fill the protection ram with a5 + auto dma */
709   IGS022_reset();
710
711   /* game won't boot unless various values are in protection RAM
712    - these should almost certainly end up there as the result of executing the protection
713      commands are startup, but which, and how? */
714
715   m_sharedprotram[0x200/2] = 0x006d;
716   m_sharedprotram[0x202/2] = 0x007c; // it cares about this, operation status flag?
717
718   m_sharedprotram[0x20c/2] = 0x0000;
719   m_sharedprotram[0x20e/2] = 0x0007;
720   m_sharedprotram[0x210/2] = 0x0000;
721   m_sharedprotram[0x212/2] = 0x0004;
722   m_sharedprotram[0x214/2] = 0x0000;
723   m_sharedprotram[0x216/2] = 0x0007;
724   m_sharedprotram[0x218/2] = 0x0000;
725   m_sharedprotram[0x21a/2] = 0x0004;
726
727   m_sharedprotram[0x288/2] = 0x0000;
728   m_sharedprotram[0x28a/2] = 0x00c2;
729   m_sharedprotram[0x28c/2] = 0x0000;
730   m_sharedprotram[0x28e/2] = 0x00c2;
731   m_sharedprotram[0x290/2] = 0x0500;
732   m_sharedprotram[0x292/2] = 0x1000;
733   m_sharedprotram[0x294/2] = 0x00c3;
734   m_sharedprotram[0x296/2] = 0x7104;
735   m_sharedprotram[0x298/2] = 0x0000;
736   m_sharedprotram[0x29a/2] = 0x0003;
737   m_sharedprotram[0x29c/2] = 0x0108;
738   m_sharedprotram[0x29e/2] = 0x0009;
739
740   m_sharedprotram[0x2a2/2] = 0x84f6; // it cares about this, it's the version number of the data rom, copied automatically!
741
742   m_sharedprotram[0x2ac/2] = 0x006d;
743   m_sharedprotram[0x2ae/2] = 0x0000;
744
745   m_sharedprotram[0x2b0/2] = 0xaf56;
746
747
748   // Reset IGS025 stuff
749   m_kb_prot_hold = 0;
750   m_kb_prot_hilo = 0;
751   m_kb_prot_hilo_select = 0;
752   m_kb_cmd = 0;
753   m_kb_reg = 0;
754   m_kb_ptr = 0;
755   m_kb_swap = 0;
756   memset(m_kb_regs, 0, 0x10 * sizeof(UINT32));
757
758}
759
760712DRIVER_INIT_MEMBER(pgm_022_025_state,drgw3)
761713{
762714   pgm_basic_init();
715   pgm_dw3_decrypt();
763716
764   m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0xDA5610, 0xDA5613, read16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_r),this), write16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_w),this));
717   m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0xda5610, 0xda5613, read16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_r),this), write16_delegate(FUNC(pgm_022_025_state::killbld_igs025_prot_w),this));
765718
766719   m_kb_source_data = dw3_source_data;
767   m_kb_source_data_offset = 1;
720   m_kb_source_data_offset = 0;
768721   m_kb_game_id = 0x00060000;
769722
770723   m_kb_prot_hold = 0;
r25519r25520
774727   m_kb_reg = 0;
775728   m_kb_ptr = 0;
776729   m_kb_swap = 0;
777   memset(m_kb_regs, 0, 0x10 * sizeof(UINT32));
730   memset(m_kb_regs, 0, 0x100 * sizeof(UINT32));
778731
779   pgm_dw3_decrypt();
732   save_item(NAME(m_kb_prot_hold));
733   save_item(NAME(m_kb_prot_hilo));
734   save_item(NAME(m_kb_prot_hilo_select));
735   save_item(NAME(m_kb_cmd));
736   save_item(NAME(m_kb_reg));
737   save_item(NAME(m_kb_ptr));
738   save_item(NAME(m_kb_regs));
780739}
781740
782741
r25519r25520
787746ADDRESS_MAP_END
788747
789748
790
791MACHINE_CONFIG_START( pgm_022_025_kb, pgm_022_025_state )
749MACHINE_CONFIG_START( pgm_022_025, pgm_022_025_state )
792750   MCFG_FRAGMENT_ADD(pgmbase)
793751
794752   MCFG_CPU_MODIFY("maincpu")
r25519r25520
798756MACHINE_CONFIG_END
799757
800758
801MACHINE_CONFIG_START( pgm_022_025_dw, pgm_022_025_state )
802   MCFG_FRAGMENT_ADD(pgmbase)
803
804   MCFG_CPU_MODIFY("maincpu")
805   MCFG_CPU_PROGRAM_MAP(killbld_mem)
806
807   MCFG_MACHINE_RESET_OVERRIDE(pgm_022_025_state,dw3)
808MACHINE_CONFIG_END
809
810
811759INPUT_PORTS_START( killbld )
812760   PORT_INCLUDE ( pgm )
813761
r25519r25520
817765   PORT_DIPSETTING(      0x0017, DEF_STR( China ) )
818766   PORT_DIPSETTING(      0x0018, DEF_STR( Hong_Kong ) )
819767   PORT_DIPSETTING(      0x0019, DEF_STR( Japan ) )
820//  PORT_DIPSETTING(      0x001a, "1a" ) // invalid
821//  PORT_DIPSETTING(      0x001b, "1b" ) // invalid
822//  PORT_DIPSETTING(      0x001c, "1c" ) // invalid
823//  PORT_DIPSETTING(      0x001d, "1d" ) // invalid
824//  PORT_DIPSETTING(      0x001e, "1e" ) // invalid
825//  PORT_DIPSETTING(      0x001f, "1f" ) // invalid
768//   PORT_DIPSETTING(      0x001a, "1a" ) // invalid
769//   PORT_DIPSETTING(      0x001b, "1b" ) // invalid
770//   PORT_DIPSETTING(      0x001c, "1c" ) // invalid
771//   PORT_DIPSETTING(      0x001d, "1d" ) // invalid
772//   PORT_DIPSETTING(      0x001e, "1e" ) // invalid
773//   PORT_DIPSETTING(      0x001f, "1f" ) // invalid
826774   PORT_DIPSETTING(      0x0020, DEF_STR( Korea ) )
827775   PORT_DIPSETTING(      0x0021, DEF_STR( World ) )
828776INPUT_PORTS_END
r25519r25520
832780
833781   PORT_MODIFY("Region")   /* Region - supplied by protection device */
834782   PORT_CONFNAME( 0x000f, 0x0006, DEF_STR( Region ) )
835//  PORT_CONFSETTING(      0x0000, "0" )
783//   PORT_CONFSETTING(      0x0000, "0" )
836784   PORT_CONFSETTING(      0x0001, "1" )
837785   PORT_CONFSETTING(      0x0002, "2" )
838786   PORT_CONFSETTING(      0x0003, "3" )
trunk/src/mame/includes/pgm.h
r25519r25520
6565   UINT8        m_cal_cnt;
6666   system_time  m_systime;
6767
68
6968   DECLARE_READ16_MEMBER(pgm_videoram_r);
7069   DECLARE_WRITE16_MEMBER(pgm_videoram_w);
7170   DECLARE_WRITE16_MEMBER(pgm_coin_counter_w);
r25519r25520
148147   UINT8         m_asic3_reg;
149148   UINT8         m_asic3_latch[3];
150149   UINT8         m_asic3_x;
151   UINT8         m_asic3_y;
152   UINT8         m_asic3_z;
153   UINT8         m_asic3_h1;
154   UINT8         m_asic3_h2;
150   UINT8        m_asic3_y;
151   UINT8        m_asic3_z;
152   UINT16        m_asic3_h1;
153   UINT16        m_asic3_h2;
155154   UINT16        m_asic3_hold;
156155
156   
157
157158   DECLARE_DRIVER_INIT(orlegend);
158159   void asic3_compute_hold();
159160   DECLARE_READ16_MEMBER( pgm_asic3_r );
r25519r25520
279280   UINT8 coverage[256]; // coverage is how much of the table we've managed to verify using known facts about the table structure
280281
281282   int command_31_write_type;
283   
282284
283
284285   // the maximum level size returned or read by the device appears to be this size
285286   UINT16 level_structure[8][10];
286287
r25519r25520
399400   int           m_kb_reg;
400401   int           m_kb_ptr;
401402   UINT8         m_kb_swap;
402   UINT32        m_kb_regs[0x10];
403   UINT32        m_kb_regs[0x100];
403404
404405   required_shared_ptr<UINT16> m_sharedprotram;
405406
406407   DECLARE_DRIVER_INIT(killbld);
407408   DECLARE_DRIVER_INIT(drgw3);
408409   DECLARE_MACHINE_RESET(killbld);
409   DECLARE_MACHINE_RESET(dw3);
410410   void pgm_dw3_decrypt();
411411   void pgm_killbld_decrypt();
412412   void killbld_protection_calculate_hilo();
r25519r25520
555555
556556/*----------- defined in machine/pgmprot4.c -----------*/
557557
558MACHINE_CONFIG_EXTERN( pgm_022_025_kb );
559MACHINE_CONFIG_EXTERN( pgm_022_025_dw );
558MACHINE_CONFIG_EXTERN( pgm_022_025 );
560559
561560INPUT_PORTS_EXTERN( killbld );
562561INPUT_PORTS_EXTERN( dw3 );

Previous 199869 Revisions Next

© 1997-2024 The MAME Team