trunk/src/mame/drivers/pgm.c
| r26200 | r26201 | |
|---|
| 3676 | 3676 | |
| 3677 | 3677 | ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */ |
| 3678 | 3678 | // data before 0x188 is read-protected and cannot be read even with a trojan (as with most 2001/2+ IGS titles) |
| 3679 | | ROM_LOAD( "happy6_igs027a.bin", 0x000000, 0x04000, NO_DUMP ) |
| 3679 | // ROM_LOAD( "happy6_igs027a.bin", 0x000000, 0x04000, NO_DUMP ) |
| 3680 | // for testing only, this is from the gladiator and wrong for this game. |
| 3681 | ROM_LOAD( "happy6_igs027a_execute_only_area", 0x0000, 0x00188, NO_DUMP ) |
| 3682 | ROM_LOAD( "happy6_igs027a_v100_japan.bin", 0x0188, 0x3e78, BAD_DUMP CRC(d7f06e2d) SHA1(9c3aca7a487f5329d84731e2c63d5ed591bf9d24) ) // from 'thegladpcb set' |
| 3680 | 3683 | |
| 3684 | |
| 3681 | 3685 | ROM_REGION( 0x800000, "user1", 0 ) /* Protection Data (encrypted external ARM data) */ |
| 3682 | 3686 | ROM_LOAD( "happy6in1_v101cn.u26", 0x000000, 0x400000, CRC(4a48ca1c) SHA1(3bebc091787903d45cb84c7302046602a903f59c) ) |
| 3683 | 3687 | |
trunk/src/mame/machine/pgmprot_igs027a_type3.c
| r26200 | r26201 | |
|---|
| 7 | 7 | used by |
| 8 | 8 | |
| 9 | 9 | Demon Front (dmnfrnt) *1 |
| 10 | | The Gladiator (theglad) |
| 10 | The Gladiator (theglad) *2 |
| 11 | 11 | Spectral vs. Generation (svg) |
| 12 | 12 | Happy 6-in-1 (happy6) |
| 13 | 13 | The Killing Blade Plus (killbldp) *2 |
| r26200 | r26201 | |
|---|
| 15 | 15 | None of these work at all, with the following exception. |
| 16 | 16 | |
| 17 | 17 | *1 - We bypass the internal ROM entirely! Game doesn't jump back |
| 18 | | *2 - Partial dump of the internal ROM is used, but 'Execute Only' region is missing |
| 18 | *2 - Partial dump of internal ROM is used (currently only dumped from a Japan PCB, patched for other types) The missing code from the EO area is replaced with our own fake code with the same function |
| 19 | *2 - Complete dump of IGS027A ROM sourced from a bootleg, looks to be legitimate. |
| 19 | 20 | |
| 20 | 21 | ---- |
| 21 | 22 | |
| r26200 | r26201 | |
|---|
| 34 | 35 | 55857G is also used on the Cave single board PGM systems, but in those |
| 35 | 36 | cases it behaves like the 55857E (pgmprot1.c) |
| 36 | 37 | |
| 38 | Most of these games run almost entirely on the ARM, simply passing display lists back to the 68k to process and reading inputs from the 68k into the shared RAM. |
| 39 | |
| 37 | 40 | ***********************************************************************/ |
| 38 | 41 | |
| 39 | 42 | #include "emu.h" |
| r26200 | r26201 | |
|---|
| 230 | 233 | temp16[(0x0092)/2] = 0x1000; |
| 231 | 234 | } |
| 232 | 235 | |
| 233 | | |
| 234 | | |
| 235 | 236 | void pgm_arm_type3_state::svg_latch_init() |
| 236 | 237 | { |
| 237 | 238 | m_svg_latchdata_68k_w = 0; |
| r26200 | r26201 | |
|---|
| 250 | 251 | } |
| 251 | 252 | |
| 252 | 253 | |
| 253 | | DRIVER_INIT_MEMBER(pgm_arm_type3_state,theglad) |
| 254 | void pgm_arm_type3_state::pgm_create_dummy_internal_arm_region_theglad(void) |
| 254 | 255 | { |
| 255 | | svg_basic_init(); |
| 256 | | pgm_theglad_decrypt(machine()); |
| 257 | | svg_latch_init(); |
| 258 | | // pgm_create_dummy_internal_arm_region(0x188); |
| 259 | | |
| 260 | 256 | UINT16 *temp16 = (UINT16 *)memregion("prot")->base(); |
| 261 | 257 | |
| 262 | 258 | int i; |
| r26200 | r26201 | |
|---|
| 267 | 263 | |
| 268 | 264 | } |
| 269 | 265 | |
| 270 | | |
| 271 | | |
| 272 | | |
| 273 | | |
| 274 | | |
| 275 | 266 | // the interrupt code appears to be at 0x08000010 |
| 276 | 267 | // so point the FIQ vector to jump there, the actual internal EO area code |
| 277 | 268 | // would not look like this because this reads from the EO area to get the jump address which is verified |
| r26200 | r26201 | |
|---|
| 470 | 461 | base = 0x184; |
| 471 | 462 | temp16[(base) /2] = 0x105c; base += 2; |
| 472 | 463 | temp16[(base) /2] = 0xE59F; base += 2; |
| 464 | } |
| 473 | 465 | |
| 466 | DRIVER_INIT_MEMBER(pgm_arm_type3_state,theglad) |
| 467 | { |
| 468 | svg_basic_init(); |
| 469 | pgm_theglad_decrypt(machine()); |
| 470 | svg_latch_init(); |
| 471 | // pgm_create_dummy_internal_arm_region(0x188); |
| 474 | 472 | |
| 475 | | |
| 473 | pgm_create_dummy_internal_arm_region_theglad(); |
| 476 | 474 | |
| 477 | 475 | |
| 478 | 476 | machine().device("prot")->memory().space(AS_PROGRAM).install_read_handler(0x1000000c, 0x1000000f, read32_delegate(FUNC(pgm_arm_type3_state::theglad_speedup_r),this)); |
| 479 | 477 | } |
| 480 | 478 | |
| 481 | | DRIVER_INIT_MEMBER(pgm_arm_type3_state, theglada) |
| 479 | void pgm_arm_type3_state::pgm_patch_external_arm_rom_jumptable_theglada(int base) |
| 482 | 480 | { |
| 483 | | DRIVER_INIT_CALL(theglad); |
| 484 | | |
| 485 | 481 | // we don't have the correct internal ROM for this version, so insead we use the one we have and patch the jump table in the external ROM |
| 486 | 482 | UINT32 subroutine_addresses[] = |
| 487 | 483 | { |
| r26200 | r26201 | |
|---|
| 504 | 500 | 0x2BF4, 0x2CD8, 0x2E2C |
| 505 | 501 | }; |
| 506 | 502 | UINT16 *extprot = (UINT16 *)memregion("user1")->base(); |
| 507 | | int base = 0x82078; |
| 508 | 503 | /* |
| 509 | 504 | 0x00C8,0x00B4,0x00DC,0x011C,0x0160,0x02DC,0x0330,0x033C, |
| 510 | 505 | 0x0348,0x0354,0x0398,0x03A8,0x0410,0x0454,0x0480,0x059C, |
| r26200 | r26201 | |
|---|
| 534 | 529 | base += 4; |
| 535 | 530 | // printf("%04x (%08x)\n", subroutine_addresses[i], addr ); |
| 536 | 531 | } |
| 532 | } |
| 537 | 533 | |
| 534 | DRIVER_INIT_MEMBER(pgm_arm_type3_state, theglada) |
| 535 | { |
| 536 | DRIVER_INIT_CALL(theglad); |
| 537 | |
| 538 | pgm_patch_external_arm_rom_jumptable_theglada(0x82078); |
| 538 | 539 | |
| 539 | 540 | } |
| 540 | 541 | |
| r26200 | r26201 | |
|---|
| 647 | 648 | svg_basic_init(); |
| 648 | 649 | pgm_happy6_decrypt(machine()); |
| 649 | 650 | svg_latch_init(); |
| 650 | | pgm_create_dummy_internal_arm_region(0x4000); |
| 651 | pgm_create_dummy_internal_arm_region_theglad(); |
| 652 | pgm_patch_external_arm_rom_jumptable_theglada(0x5f1c0); |
| 653 | |
| 651 | 654 | } |