Previous 199869 Revisions Next

r34539 Thursday 22nd January, 2015 at 15:46:09 UTC by David Haywood
dynamcop (model 2) now returns the same values with the key + decryption code as the previous hardcoded returns
(strangely I have to return a dummy value of 0x0000 before the start of the stream tho, the old sim did this too, cpu bug??)
[src/mame/drivers]model2.c
[src/mame/includes]model2.h

trunk/src/mame/drivers/model2.c
r243050r243051
12341234   0xE4,0x66,0xD0,0x4A,0x7D,0x4A,0x13,0xDE,0xD7,0x9F,0x38,0xAA,0x00,0x56,0x85,0x0A
12351235};
12361236
1237static const UINT8 DCOPKey1326[]=
1238{
1239   0x43,0x66,0x54,0x11,0x99,0xfe,0xcc,0x8e,0xdd,0x87,0x11,0x89,0x22,0xdf,0x44,0x09
1240};
12411237
12421238READ32_MEMBER(model2_state::model2_prot_r)
12431239{
r243050r243051
12501246   }
12511247   else if (offset == 0x1000e/4)
12521248   {
1253      retval = m_protram[m_protstate+1] | m_protram[m_protstate]<<8;
1249      retval = m_protram[m_protstate+1] | m_protram[m_protstate+0]<<8;
12541250      retval <<= 16;
12551251      m_protstate+=2;
12561252   }
1257   else if (offset == 0x7ff8/4)
1258   {
1259      retval = m_protram[m_protstate+1] | m_protram[m_protstate]<<8;
1260      m_protstate+=2;
1261   }
1262   else if (offset == 0x400c/4)
1263   {
1264      m_prot_a = !m_prot_a;
1265      if (m_prot_a)
1266         retval = 0xffff;
1267      else
1268         retval = 0xfff0;
1269   }
12701253   else logerror("Unhandled Protection READ @ %x mask %x (PC=%x)\n", offset, mem_mask, space.device().safe_pc());
12711254
12721255   printf("model2_prot_r %08x: %08x (%08x)\n", offset*4, retval, mem_mask);
r243050r243051
12911274   {
12921275      switch (data)
12931276      {
1294         // dynamcop
1295         case 0x7700:
1296            strcpy((char *)m_protram+2, "UCHIDA MOMOKA   ");
1297            break;
1298
1299         // dynamcop
1300         case 0x1326:
1301            m_protstate = 0;
1302            memcpy(m_protram+2, DCOPKey1326, sizeof(DCOPKey1326));
1303            break;
1304
13051277         // zerogun
13061278         case 0xA1BC:
13071279         case 0xAD23:
r243050r243051
13371309
13381310}
13391311
1312
1313READ32_MEMBER(model2_state::model2_5881prot_r)
1314{
1315   UINT32 retval = 0;
1316
1317   if (offset == 0x0000/4)
1318   {
1319      // status: bit 0 = 1 for busy, 0 for ready
1320      retval = 0;   // we're always ready
1321   }
1322   else if (offset == 0x000e/4)
1323   {
1324      if (first_read == 1)
1325      {
1326         // is there a CPU core bug or similar?
1327         // the only way to return the same stream as the previous simulation (for dynamite cop) is to return a
1328         // 0x0000 as the first return value before returning the actual sequence.
1329         // note that even with our simulation code pilot kids crashes in the way it would if the protection failed, so something seems wrong.
1330         first_read = 0;
1331         retval = 0;
1332      }
1333      else
1334      {
1335         UINT8* base;
1336         retval = m_cryptdevice->do_decrypt(base);
1337         retval = ((retval & 0xff00) >> 8) | ((retval & 0x00ff) << 8);
1338         retval <<= 16;
1339      }
1340   }
1341   else logerror("Unhandled Protection READ @ %x mask %x (PC=%x)\n", offset, mem_mask, space.device().safe_pc());
1342
1343   logerror("model2_5881prot_r %08x: %08x (%08x)\n", offset*4, retval, mem_mask);
1344
1345   return retval;
1346}
1347
1348WRITE32_MEMBER(model2_state::model2_5881prot_w)
1349{
1350   logerror("model2_5881prot_w %08x: %08x (%08x)\n", offset*4, data, mem_mask);
1351
1352
1353   if (offset == 0x0008/4)
1354   {
1355      // code is copied to RAM first, so base address is always 0
1356      m_cryptdevice->set_addr_low(0);
1357      m_cryptdevice->set_addr_high(0);
1358
1359      if (data != 0)
1360         printf("model2_5881prot_w address isn't 0?\n");
1361
1362      first_read = 1;
1363   }
1364   else if (offset == 0x000c/4)
1365   {
1366      printf("subkey %08x (%08x)\n", data, mem_mask);
1367      m_cryptdevice->set_subkey(data&0xffff);
1368   }
1369   else printf("Unhandled Protection WRITE %x @ %x mask %x (PC=%x)\n", data, offset, mem_mask, space.device().safe_pc());
1370
1371}
1372
1373
1374READ32_MEMBER(model2_state::doa_prot_r)
1375{
1376   UINT32 retval = 0;
1377
1378   if (offset == 0x7ff8/4)
1379   {
1380      retval = m_protram[m_protstate+1] | m_protram[m_protstate]<<8;
1381      m_protstate+=2;
1382   }
1383   else if (offset == 0x400c/4)
1384   {
1385      m_prot_a = !m_prot_a;
1386      if (m_prot_a)
1387         retval = 0xffff;
1388      else
1389         retval = 0xfff0;
1390   }
1391   else logerror("Unhandled Protection READ @ %x mask %x (PC=%x)\n", offset, mem_mask, space.device().safe_pc());
1392
1393   return retval;
1394}
1395
1396
13401397WRITE32_MEMBER(model2_state::doa_prot_w)
13411398{
13421399   if (offset == 0x7ff2 / 4)
r243050r243051
59115968
59125969DRIVER_INIT_MEMBER(model2_state,genprot)
59135970{
5914   m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x01d80000, 0x01dfffff, read32_delegate(FUNC(model2_state::model2_prot_r),this), write32_delegate(FUNC(model2_state::model2_prot_w),this));
5915   m_protstate = m_protpos = 0;
5971   
5972   INT64 key = get_315_5881_key(machine());
5973
5974   if (key != -1)
5975   {
5976      m_maincpu->space(AS_PROGRAM).install_ram(0x01d80000, 0x01d8ffff);
5977      m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x01d90000, 0x01d9ffff, read32_delegate(FUNC(model2_state::model2_5881prot_r), this), write32_delegate(FUNC(model2_state::model2_5881prot_w), this));
5978      m_cryptdevice->set_key(key);
5979   }
5980   else
5981   {
5982      m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x01d80000, 0x01dfffff, read32_delegate(FUNC(model2_state::model2_prot_r), this), write32_delegate(FUNC(model2_state::model2_prot_w), this));                   
5983      m_protstate = m_protpos = 0;
5984   }
59165985}
59175986
59185987DRIVER_INIT_MEMBER(model2_state,pltkids)
r243050r243051
59836052
59846053DRIVER_INIT_MEMBER(model2_state,doa)
59856054{
5986   m_maincpu->space(AS_PROGRAM).install_write_handler(0x01d80000, 0x01dfffff, write32_delegate(FUNC(model2_state::doa_prot_w),this));
6055   m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x01d80000, 0x01dfffff, read32_delegate(FUNC(model2_state::doa_prot_r),this), write32_delegate(FUNC(model2_state::doa_prot_w),this));
59876056   m_protstate = m_protpos = 0;
59886057
59896058   
trunk/src/mame/includes/model2.h
r243050r243051
160160   DECLARE_WRITE32_MEMBER(model2_serial_w);
161161   DECLARE_READ32_MEMBER(model2_prot_r);
162162   DECLARE_WRITE32_MEMBER(model2_prot_w);
163   DECLARE_READ32_MEMBER(doa_prot_r);
163164   DECLARE_WRITE32_MEMBER(doa_prot_w);
165   DECLARE_READ32_MEMBER(model2_5881prot_r);
166   DECLARE_WRITE32_MEMBER(model2_5881prot_w);
167   int first_read;
168
164169   DECLARE_READ32_MEMBER(maxx_r);
165170   DECLARE_READ32_MEMBER(network_r);
166171   DECLARE_WRITE32_MEMBER(network_w);

https://github.com/mamedev/mame/commit/5cfdf1333e57624b7418d65186125db0d4baed03

Previous 199869 Revisions Next

© 1997-2024 The MAME Team