trunk/src/mame/drivers/viper.c
| r242327 | r242328 | |
|---|
| 84 | 84 | (application register reads all 0xFF and the status register reads back 0xFF), so it's probably safe |
| 85 | 85 | to assume they're not used on any of them. |
| 86 | 86 | It appears the DS2430 is not protected from reading and the unique silicon serial number is |
| 87 | | included in the 40 byte dump. In the Police 911 2 NVRAM dump the serial number is located at both 0x002A and 0x1026 |
| 88 | | so that means it is tied to the DS2430. If the serial number in the NVRAM and DS2430 match then they are |
| 89 | | paired. The same serial number is likely present in the CF card image and a compare is done there too. |
| 90 | | If they don't match the game requires an external DS2430 (i.e. dongle) |
| 87 | included in the 40 byte dump. This serial number is used as a check to verify the NVRAM and DS2430. |
| 88 | In the Police 911 2 NVRAM dump the serial number of the DS2430 is located at 0x002A and 0x1026 |
| 89 | If the serial number in the NVRAM and DS2430 match then they are paired and the game accepts the NVRAM. |
| 90 | If they don't match the game requires an external DS2430 (i.e. dongle) and flags the NVRAM as 'BAD' |
| 91 | The serial number is not present in the CF card (2 different Police 911 2 cards of the same version |
| 92 | were dumped and matched). |
| 91 | 93 | When the lasered ROM is read from the DS2430, it comes out from LSB to MSB (family code, LSB of |
| 92 | 94 | S/N->MSB of S/N, CRC) |
| 93 | 95 | For Police 911 2 that is 0x14 0xB2 0xB7 0x4A 0x00 0x00 0x00 0x83 |
| r242327 | r242328 | |
|---|
| 102 | 104 | It may be possible to hand craft a DS2430 for a dongle-protected version of a game simply by using |
| 103 | 105 | one of the existing DS2430 dumps and adjusting the serial number found in a dump of the NVRAM to pair them |
| 104 | 106 | or adjusting the serial number in the NVRAM to match the serial number found in one of the dumped DS2430s. |
| 107 | This Police 911 2 board was upgraded from Police 911 by plugging in the dongle and changing the CF card. |
| 108 | The NVRAM had previously died and the board was dead. Normally for a Viper game that is fatal. Using |
| 109 | the NVRAM from Police 911 allowed it to boot and then the NVRAM upgraded itself with some additional |
| 110 | data (the original data remained untouched). This means the dongle does more than just protect the game. |
| 111 | Another interesting fact about this upgrade is it has been discovered that the PCB can write to the |
| 112 | external DS2430 in the dongle. This has been proven because the serial number of the DS2430 soldered |
| 113 | on the PCB is present in the EEPROM area of the Police 911 2 DS2430. |
| 114 | Here is a dump of the DS2430 from Police 911. Note the EEPROM area is empty and the serial number (from 0x20 onwards) |
| 115 | is present in the above Police 911 2 DS2430 dump at locations 0x11, 0x10 and 0x0F |
| 116 | 00000000h FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |
| 117 | 00000010h FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |
| 118 | 00000020h 14 A9 30 74 00 00 00 E7 |
| 119 | This proves that the EEPROM area in the DS2430 is unused by an unprotected game and in fact the on-board |
| 120 | DS2430 is completely unused by an unprotected game. That is why any unprotected game will work on any |
| 121 | Viper PCB regardless of the on-board DS2430 serial number. |
| 122 | The existing DS2430 'common' dump used in the unprotected games was actually from a (dongle-protected) |
| 123 | Mahjong Fight Club PCB but that PCB was used to test and run all of the unprotected Viper games. |
| 105 | 124 | M48T58Y - ST Microelectronics M48T58Y Timekeeper RAM (DIP28 @ U39). When this dies (after 10 year lifespan) |
| 106 | 125 | the game will complain with error RTC BAD then reset. The data inside the RTC can not be hand created |
| 107 | 126 | (yet) so to revive the PCB the correct RTC data must be re-programmed to a new RTC and replaced |
| r242327 | r242328 | |
|---|
| 114 | 133 | required and plugged in it overrides the DS2430 on the main board. Without the (on-board) |
| 115 | 134 | DS2430 the PCB will complain after the CF check with HARDWARE ERROR. If the DS2430 is not |
| 116 | 135 | correct for the game the error given is RTC BAD even if the RTC is correct. Most games don't require |
| 117 | | a dongle and use the factory DS2430 on the main board. |
| 136 | a dongle and accept any DS2430 on the main board. |
| 118 | 137 | CN12 - 4 pin connector (possibly stereo audio output?) |
| 119 | 138 | CN13 - Power connector for plug-in daughterboard |
| 120 | 139 | CN15/CN16 - Multi-pin IDC connectors for plug-in daughterboard (see detail below) |