trunk/src/mame/drivers/viper.c
| r242370 | r242371 | |
|---|
| 125 | 125 | the game will complain with error RTC BAD then reset. The data inside the RTC can not be hand created |
| 126 | 126 | (yet) so to revive the PCB the correct RTC data must be re-programmed to a new RTC and replaced |
| 127 | 127 | on the PCB. |
| 128 | Regarding the RTC and protection-related checks.... |
| 129 | "RTC OK" checks 0x0000->0x0945 (i.e. I can clear the contents after 0x0945 and the game will still |
| 130 | happily boot). The NVRAM contents are split into chunks, each of which are checksummed. It is a 16-bit checksum, |
| 131 | computed by summing two consecutive bytes as a 16-bit integer, where the final sum must add up to 0xFFFF (mod |
| 132 | 65536). The last two bytes in the chunk are used to make the value 0xFFFF. There doesn't appear to be a |
| 133 | complete checksum over all the chunks (I can pick and choose chunks from various NVRAMs, as long as each chunk |
| 134 | checksum checks out). The important chunks for booting are the first two. |
| 135 | The first chunk goes from 0x0000-0x000F. This seems to be a game/region identifier, and doesn't like its |
| 136 | contents changed (I didn't try changing every byte, but several of the bytes would throw RTC errors, even with a |
| 137 | fixed checksum). I'd guess that the CF verifies this value, since it's different for every game (i.e. Mocap |
| 138 | Boxing NVRAM would have a correct checksum, but shouldn't pass Police 911 checks). |
| 139 | The second chunk goes from 0x0010-0x0079. This seems to be a board identifier. This has (optionally) |
| 140 | several fields, each of which are 20 bytes long. I'm unsure of the first 6 bytes, the following 6 |
| 141 | bytes are the DS2430A S/N, and the last 8 bytes are a game/region/dongle identifier. If running |
| 142 | without a dongle, only the first 20 byte field is present. With a dongle, a second 20 byte field will |
| 143 | be present. Moving this second field into the place of the first field (and fixing the checksum) |
| 144 | doesn't work, and the second field will be ignored if the first field is valid for the game (and in |
| 145 | which case the dongle will be ignored). For example, Police 911 will boot with a valid first field, |
| 146 | with or without the second field, and with or without the dongle plugged in. If you have both fields, |
| 147 | and leave the dongle plugged in, you can switch between Police 911 and Police 911/2 by simply swapping |
| 148 | CF cards. |
| 128 | 149 | 29F002 - Fujitsu 29F002 256k x8 EEPROM stamped '941B01' (PLCC44 @ U25). Earlier revision stamped '941A01' |
| 129 | 150 | CN4/CN5 - RCA-type network connection jacks |
| 130 | 151 | CN7 - 80 pin connector (unused in all games?) |