Previous 199869 Revisions Next

r33797 Wednesday 10th December, 2014 at 10:25:15 UTC by Guru
viper.c: minor version correction of Police 911 2 from test mode and some notes (nw)

added version from test mode and also added some notes about the dongle protection and guesses about the NVRAM<->DS2430 marriage
[src/mame/drivers]viper.c

trunk/src/mame/drivers/viper.c
r242308r242309
1616G?A30    2002    Tsurugi
1717GMA41    2001    Thrill Drive 2
1818G?A45    2001    Boxing Mania
19GCB11    2001    Police 911 2 (USA) / Police 24/7 2 (World) / Keisatsukan Shinjuku 24ji 2 (Japan)
19G*B11    2001    Police 911 2 (USA) / Police 24/7 2 (World) / Keisatsukan Shinjuku 24ji 2 (Japan)
2020G?B33    2001    Mocap Golf
2121G?B41    2001    Jurassic Park 3
2222G?B4x    2002    Xtrial Racing
r242308r242309
7979      ADC0838 - National Semiconductor ADC0838 Serial I/O 8-Bit A/D Converters with Multiplexer Options (SOIC20 @ U13)
8080       DS2430 - Dallas DS2430 256-bits 1-Wire EEPROM. Has 256 bits x8 EEPROM (32 bytes), 64 bits x8 (8 bytes)
8181                one-time programmable application register and unique factory-lasered and tested 64-bit
82                registration number (8-bit family code + 48-bit serial number + 8-bit CRC tester) (TO-92 @ U37)
83                It appears the DS2430 is not protected from reading but the unique silicon serial number isn't
84                included in the 40 byte dump.
82                registration number (8-bit family code + 48-bit serial number + 8-bit CRC) (TO-92 @ U37)
83                The OTP application register on the common DS2430 and the Police 911 2 DS2430 are not programmed
84                (application register reads all 0xFF and the status register reads back 0xFF), so it's probably safe
85                to assume they're not used on any of them.
86                It appears the DS2430 is not protected from reading and the unique silicon serial number is
87                included in the 40 byte dump. In the Police 911 2 NVRAM dump the serial number is located at both 0x002A and 0x1026
88                so that means it is tied to the DS2430. If the serial number in the NVRAM and DS2430 match then they are
89                paired. The same serial number is likely present in the CF card image and a compare is done there too.
90                If they don't match the game requires an external DS2430 (i.e. dongle)
91                When the lasered ROM is read from the DS2430, it comes out from LSB to MSB (family code, LSB of
92                S/N->MSB of S/N, CRC)
93                For Police 911 2 that is 0x14 0xB2 0xB7 0x4A 0x00 0x00 0x00 0x83
94                Family code=0x14
95                S/N=0x0000004AB7B2
96                CRC=0x83
97                In a DS2430 dump, the first 32 bytes is the EEPROM and the lasered ROM is 8 bytes and starts at 0x20h
98                For Police 911 2 that is....
99                00000000h CB 9B 56 EC A0 4C 87 53 51 46 28 E7 00 00 00 74
100                00000010h 30 A9 C7 76 B9 85 A3 43 87 53 50 42 1A E7 FA CF
101                00000020h 14 B2 B7 4A 00 00 00 83
102                It may be possible to hand craft a DS2430 for a dongle-protected version of a game simply by using
103                one of the existing DS2430 dumps and adjusting the serial number found in a dump of the NVRAM to pair them
104                or adjusting the serial number in the NVRAM to match the serial number found in one of the dumped DS2430s.
85105      M48T58Y - ST Microelectronics M48T58Y Timekeeper RAM (DIP28 @ U39). When this dies (after 10 year lifespan)
86106                the game will complain with error RTC BAD then reset. The data inside the RTC can not be hand created
87107                (yet) so to revive the PCB the correct RTC data must be re-programmed to a new RTC and replaced
r242308r242309
22992319ROM_START(p9112) /* dongle-protected version */
23002320   VIPER_BIOS
23012321
2302   ROM_REGION(0x28, "ds2430", ROMREGION_ERASE00)       /* plug-in male DIN5 dongle containing a DS2430 */
2322   ROM_REGION(0x28, "ds2430", ROMREGION_ERASE00)       /* plug-in male DIN5 dongle containing a DS2430. The sticker on the dongle says 'GCB11-UA' */
23032323   ROM_LOAD("ds2430_p9112.u3", 0x00, 0x28, CRC(d745c6ee) SHA1(065C9D0DF1703B3BBB53A07F4923FDEE3B16F80E))
23042324
23052325   ROM_REGION(0x2000, "m48t58", ROMREGION_ERASE00)     /* M48T58 Timekeeper NVRAM */
r242308r242309
25642584GAME(2001, p911kc,    p911,      viper, viper, viper_state, vipercf,  ROT90,  "Konami", "Police 911 (ver KAC)", GAME_NOT_WORKING|GAME_NO_SOUND)
25652585GAME(2001, p911e,     p911,      viper, viper, viper_state, vipercf,  ROT90,  "Konami", "Police 24/7 (ver EAA)", GAME_NOT_WORKING|GAME_NO_SOUND)
25662586GAME(2001, p911j,     p911,      viper, viper, viper_state, vipercf,  ROT90,  "Konami", "Keisatsukan Shinjuku 24ji (ver JAC)", GAME_NOT_WORKING|GAME_NO_SOUND)
2567GAME(2001, p9112,     kviper,    viper, viper, viper_state, vipercf,  ROT90,  "Konami", "Police 911 2 (ver UAD)", GAME_NOT_WORKING|GAME_NO_SOUND)
2587GAME(2001, p9112,     kviper,    viper, viper, viper_state, vipercf,  ROT90,  "Konami", "Police 911 2 (VER. UAA:B)", GAME_NOT_WORKING|GAME_NO_SOUND)
25682588GAME(2003, popn9,     kviper,    viper, viper, viper_state, vipercf,  ROT0,  "Konami", "Pop'n Music 9 (ver JAB)", GAME_NOT_WORKING|GAME_NO_SOUND)
25692589GAME(2001, sscopex,   kviper,    viper, viper, viper_state, vipercf,  ROT0,  "Konami", "Silent Scope EX (ver UAA)", GAME_NOT_WORKING|GAME_NO_SOUND)
25702590GAME(2001, sogeki,    sscopex,   viper, viper, viper_state, vipercf,  ROT0,  "Konami", "Sogeki (ver JAA)", GAME_NOT_WORKING|GAME_NO_SOUND)


Previous 199869 Revisions Next


© 1997-2024 The MAME Team