Previous 199869 Revisions Next

r26573 Tuesday 10th December, 2013 at 04:50:47 UTC by David Haywood
kludged parent svg set to boot using svgpcb internal rom, don't consider this working due to various issues, but it will help with extracting the real rom later. (nw)
[src/mame/drivers]pgm.c
[src/mame/includes]pgm.h
[src/mame/machine]pgmprot_igs027a_type3.c

trunk/src/mame/drivers/pgm.c
r26572r26573
35813581
35823582   ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
35833583   /* the first 0x268 bytes of this are EXECUTE ONLY in the original chip, attempting to read them even via the original CPU just returns what is on the bus */
3584   ROM_LOAD( "killbldp_igs027a.bin", 0x000000, 0x04000, CRC(c7868d90) SHA1(335c99933a38b77fcfc3f8004063f35124364f3e) ) // this is the original rom with the first 0x268 bytes from the bootleg - but it doesn't work?
3584//   ROM_LOAD( "killbldp_igs027a.bin", 0x000000, 0x04000, CRC(c7868d90) SHA1(335c99933a38b77fcfc3f8004063f35124364f3e) ) // this is the original rom with the first 0x268 bytes from the bootleg - but it doesn't work?
35853585   /* there are some differences around 0x2e80, investigate - maybe above is badly dumped?, padding at 0x3ac0 is also different */
35863586   ROM_LOAD( "killbldp_igs027a_alt.bin", 0x000000, 0x04000, CRC(98316b06) SHA1(09be9fad24d68980a0a5beae60ced48012286216) ) // from a bootleg
35873587
r26572r26573
36143614   ROM_LOAD16_WORD_SWAP( "u30.bin",      0x100000, 0x080000, CRC(34c18f3f) SHA1(42d1edd0dcfaa5e44861c6a1d4cb24f51ba23de8) )
36153615
36163616   ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
3617   ROM_LOAD( "svg_igs027a.bin", 0x000000, 0x04000, NO_DUMP ) // different from PCB version..
3617//   ROM_LOAD( "svg_igs027a.bin", 0x000000, 0x04000, NO_DUMP ) // different from PCB version..
3618   ROM_LOAD( "svg_igs027a_execute_only_area", 0x0000, 0x00188, NO_DUMP )
3619   ROM_LOAD( "svg_igs027a.bin", 0x0188, 0x3e78, BAD_DUMP CRC(7a59da5d) SHA1(d67ba465db40ca716b4b901b1c8e762716fb954e) ) // taken from svgpcb
36183620
36193621   ROM_REGION( 0x800000, "user1", 0 ) /* Protection Data (encrypted external ARM data) */
36203622   ROM_LOAD( "u26.bin", 0x000000, 0x400000, CRC(46826ec8) SHA1(ad1daf6f615fb8d748ce7f98f19dd3bf22f79fba) )
r26572r26573
42374239
42384240GAME( 2004, happy6,       pgm,       pgm_arm_type3,     happy6, pgm_arm_type3_state,    happy6,     ROT0,   "IGS", "Happy 6-in-1 (ver. 101CN)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
42394241
4240GAME( 2005, svg,          pgm,       pgm_arm_type3,     svg, pgm_arm_type3_state,    svg,        ROT0,   "IGS / Idea Factory", "S.V.G. - Spectral vs Generation (M68k label V200) (ARM label V200, ROM 10/11/05 S.V.G V201)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // label was 200, but it's code rev 201? // ARM time: 10:07:20
4242// this is kludged to boot but isn't really going to work properly without the real internal ROM
4243GAME( 2005, svg,          pgm,       pgm_arm_type3,     pgm, pgm_arm_type3_state,    svg,        ROT0,   "IGS / Idea Factory", "S.V.G. - Spectral vs Generation (M68k label V200) (ARM label V200, ROM 10/11/05 S.V.G V201)", GAME_IMPERFECT_SOUND | GAME_UNEMULATED_PROTECTION | GAME_NOT_WORKING | GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // label was 200, but it's code rev 201? // ARM time: 10:07:20
trunk/src/mame/machine/pgmprot_igs027a_type3.c
r26572r26573
265265}
266266
267267
268void pgm_arm_type3_state::pgm_create_dummy_internal_arm_region_theglad(void)
268void pgm_arm_type3_state::pgm_create_dummy_internal_arm_region_theglad(int is_svg)
269269{
270270   UINT16 *temp16 = (UINT16 *)memregion("prot")->base();
271271   int i;
r26572r26573
283283   int base = 0x1c;
284284   temp16[(base) /2] = 0xf000; base += 2;
285285   temp16[(base) /2] = 0xe59f; base += 2;
286   temp16[(base) /2] = 0x0010; base += 2;
287   temp16[(base) /2] = 0x0800; base += 2;
288   temp16[(base) /2] = 0x0010; base += 2;
289   temp16[(base) /2] = 0x0800; base += 2;
290   
291286
287   if (is_svg == 0)
288   {
289      temp16[(base) / 2] = 0x0010; base += 2;
290      temp16[(base) / 2] = 0x0800; base += 2;
291      temp16[(base) / 2] = 0x0010; base += 2;
292      temp16[(base) / 2] = 0x0800; base += 2;
293   }
294   else
295   {
296      temp16[(base) / 2] = 0x0038; base += 2;
297      temp16[(base) / 2] = 0x0800; base += 2;
298      temp16[(base) / 2] = 0x0038; base += 2;
299      temp16[(base) / 2] = 0x0800; base += 2;
300   }
301
292302   // some startup code to set up the stacks etc. we're assuming
293303   // behavior is basically the same as killing blade plus here, this code
294304   // could be very wrong
r26572r26573
387397   temp16[(base) /2] = 0xE121; base += 2;
388398
389399
400   if (is_svg == 0)
401   {
402      temp16[(base) / 2] = 0x0028; base += 2; // jump to 0x184
403      temp16[(base) / 2] = 0xEA00; base += 2;
404   }
405   else
406   {
407      temp16[(base) / 2] = 0x001c; base += 2; // jump to 0x154
408      temp16[(base) / 2] = 0xEA00; base += 2;
390409
391   temp16[(base) /2] = 0x0028; base += 2; // jump to 0x184
392   temp16[(base) /2] = 0xEA00; base += 2;
410      base = 0x154;
393411
412      // this actually makes matters worse here
413//      temp16[(base) / 2] = 0x1010; base += 2;
414//      temp16[(base) / 2] = 0xe59f; base += 2;
415//      temp16[(base) / 2] = 0x0001; base += 2;
416//      temp16[(base) / 2] = 0xe3a0; base += 2;
417//      temp16[(base) / 2] = 0x0000; base += 2;
418//      temp16[(base) / 2] = 0xe581; base += 2;
394419
420      temp16[(base) / 2] = 0xf000; base += 2;
421      temp16[(base) / 2] = 0xe59f; base += 2;
422      temp16[(base) / 2] = 0x0028; base += 2;
423      temp16[(base) / 2] = 0x0800; base += 2;
424      temp16[(base) / 2] = 0x0028; base += 2;
425      temp16[(base) / 2] = 0x0800; base += 2;
426
427//      temp16[(base) / 2] = 0x003c; base += 2;
428//      temp16[(base) / 2] = 0x1000; base += 2;
429
430   }
431
395432   
396433   base = 0;
397434   temp16[(base) /2] = 0x000a; base += 2;
r26572r26573
468505   temp16[(base) /2] = 0xff1e; base += 2;
469506   temp16[(base) /2] = 0xe12f; base += 2;
470507
471   // the non-EO area starts in the middle of a function that seems similar to those  at 000037E4 / 000037D4 in killbldp.. by setting this up we allow the intro to run, but can no longer can get in game..
508   // the non-EO area starts in the middle of a function that seems similar to those  at 000037E4 / 000037D4 in killbldp.. by setting this up we allow the intro to run
472509   // it sets '0x10000038' to a value ot 1
473   // maybe this flag needs to be flipped on interrupts or similar??
474510   base = 0x184;
475511   temp16[(base) /2] = 0x105c; base += 2;
476512   temp16[(base) /2] = 0xE59F; base += 2;
r26572r26573
483519   svg_latch_init();
484520//   pgm_create_dummy_internal_arm_region(0x188);
485521
486   pgm_create_dummy_internal_arm_region_theglad();
522   pgm_create_dummy_internal_arm_region_theglad(0);
487523   
488524
489525   machine().device("prot")->memory().space(AS_PROGRAM).install_read_handler(0x1000000c, 0x1000000f, read32_delegate(FUNC(pgm_arm_type3_state::theglad_speedup_r),this));
490526}
491527
528void pgm_arm_type3_state::pgm_patch_external_arm_rom_jumptable_svg(int base)
529{
530   // we don't have the correct internal ROM for this version, so insead we use the one we have and patch the jump table in the external ROM
531   int subroutine_addresses[] =
532   {
533      0,0,0,0,0,0x1B0,0x1B0,0x1B0,
534      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
535      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
536      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
537      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
538      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
539      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
540      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
541      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
542      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
543      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
544      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
545      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
546      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
547      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
548      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,
549      0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0,0x1B0
550   };
551   UINT16 *extprot = (UINT16 *)memregion("user1")->base();
492552
553   for (int i = 0; i < 135; i++)
554   {
555      UINT32 addr = extprot[(base/2)] | (extprot[(base/2) + 1] << 16);
556      extprot[(base / 2)] = addr - subroutine_addresses[i];
557
558      base += 4;
559   }
560}
561
493562void pgm_arm_type3_state::pgm_patch_external_arm_rom_jumptable_theglada(int base)
494563{
495564   // we don't have the correct internal ROM for this version, so insead we use the one we have and patch the jump table in the external ROM
r26572r26573
588657   svg_basic_init();
589658   pgm_svg_decrypt(machine());
590659   svg_latch_init();
591   pgm_create_dummy_internal_arm_region_theglad();
660   pgm_create_dummy_internal_arm_region_theglad(1);
661   pgm_patch_external_arm_rom_jumptable_svg(0x53f10);
662   m_armrom = (UINT32 *)memregion("prot")->base();
663   machine().device("prot")->memory().space(AS_PROGRAM).install_read_handler(0x9e0, 0x9e3, read32_delegate(FUNC(pgm_arm_type3_state::svg_speedup_r),this));
592664
593665}
594666
r26572r26573
597669   svg_basic_init();
598670   pgm_svgpcb_decrypt(machine());
599671   svg_latch_init();
600   pgm_create_dummy_internal_arm_region_theglad();
672   pgm_create_dummy_internal_arm_region_theglad(0);
601673   m_armrom = (UINT32 *)memregion("prot")->base();
602674   machine().device("prot")->memory().space(AS_PROGRAM).install_read_handler(0x9e0, 0x9e3, read32_delegate(FUNC(pgm_arm_type3_state::svg_speedup_r),this));
603675
r26572r26573
759831   svg_basic_init();
760832   pgm_happy6_decrypt(machine());
761833   svg_latch_init();
762   pgm_create_dummy_internal_arm_region_theglad();
834   pgm_create_dummy_internal_arm_region_theglad(0);
763835   pgm_patch_external_arm_rom_jumptable_theglada(0x5f1c0);
764836
765837   machine().device("prot")->memory().space(AS_PROGRAM).install_read_handler(0x1000000c, 0x1000000f, read32_delegate(FUNC(pgm_arm_type3_state::theglad_speedup_r),this));
trunk/src/mame/includes/pgm.h
r26572r26573
344344   void svg_basic_init();
345345   void pgm_create_dummy_internal_arm_region(int size);
346346   void pgm_patch_external_arm_rom_jumptable_theglada(int base);
347   void pgm_create_dummy_internal_arm_region_theglad(void);
347   void pgm_patch_external_arm_rom_jumptable_svg(int base);
348   void pgm_create_dummy_internal_arm_region_theglad(int is_svg);
348349   void pgm_descramble_happy6(UINT8* src);
349350   void pgm_descramble_happy6_2(UINT8* src);
350351   void svg_latch_init();

Previous 199869 Revisions Next

© 1997-2024 The MAME Team