Previous

199869 Revisions

Next

r34550 Thursday 22nd January, 2015 at 21:40:10 UTC by David Haywood
kill off old ST-V protection simulation code, all games now use the 315-5881 emulation (except decathlete of course, because that's a completely different chip)

[src/mame/drivers]	stv.c
[src/mame/includes]	stv.h
[src/mame/machine]	stvprot.c

trunk/src/mame/drivers/stv.c

r243061	r243062
672	672	m_maincpu->sh2drc_add_pcflush(0x60011ba);
673	673	m_maincpu->sh2drc_add_pcflush(0x605b9da);
674	674
675		install_astrass_protection();
	675	install_common_protection();
676	676
677	677	DRIVER_INIT_CALL(stv);
678	678	}
r243061	r243062
766	766	m_maincpu->sh2drc_add_pcflush(0x6026398);
767	767	m_slave->sh2drc_add_pcflush(0x6028cd6);
768	768
769		install_sss_protection();
	769	install_common_protection();
770	770
771	771	DRIVER_INIT_CALL(stv);
772	772
r243061	r243062
829	829	m_slave->sh2drc_add_pcflush(0x6062bca);
830	830
831	831	DRIVER_INIT_CALL(stv);
832		install_twcup98_protection();
	832	install_common_protection();
833	833
834	834	m_minit_boost_timeslice = m_sinit_boost_timeslice = attotime::from_usec(5);
835	835	}
r243061	r243062
886	886	m_maincpu->sh2drc_add_pcflush(0x604eac0);
887	887	m_slave->sh2drc_add_pcflush(0x605340a);
888	888
889		install_elandore_protection();
	889	install_common_protection();
890	890
891	891	DRIVER_INIT_CALL(stv);
892	892	m_minit_boost_timeslice = m_sinit_boost_timeslice = attotime::from_usec(0);
r243061	r243062
897	897	m_maincpu->sh2drc_add_pcflush(0x6034d04);
898	898	m_slave->sh2drc_add_pcflush(0x6036152);
899	899
900		install_rsgun_protection();
	900	install_common_protection();
901	901
902	902	DRIVER_INIT_CALL(stv);
903	903
r243061	r243062
906	906
907	907	DRIVER_INIT_MEMBER(stv_state,ffreveng)
908	908	{
909		install_ffreveng_protection();
	909	install_common_protection();
910	910	DRIVER_INIT_CALL(stv);
911	911	}
912	912

trunk/src/mame/includes/stv.h

r243061	r243062
701	701	: saturn_state(mconfig, type, tag),
702	702	m_adsp(*this, "adsp"),
703	703	m_adsp_pram(*this, "adsp_pram"),
704		m_cryptdevice(*this, "315_5881"),
705		m_using_crypt_device(0)
	704	m_cryptdevice(*this, "315_5881")
706	705	{
707	706	}
708	707
r243061	r243062
799	798
800	799	// protection specific variables and functions (see machine/stvprot.c)
801	800	UINT32 m_abus_protenable;
802		UINT32 m_abus_prot_addr;
803	801	UINT32 m_abus_protkey;
804	802
805	803	UINT32 m_a_bus[4];
806		UINT32 m_ctrl_index;
807		UINT32 m_internal_counter;
808		UINT8 m_char_offset; //helper to jump the decoding of the NULL chars.
809	804
810		UINT32 (*m_prot_readback)(address_space&,int,UINT32);
811
812	805	DECLARE_READ32_MEMBER( common_prot_r );
813	806	DECLARE_WRITE32_MEMBER( common_prot_w );
814	807
815	808	void install_common_protection();
816
817		void install_twcup98_protection();
818		void install_sss_protection();
819		void install_astrass_protection();
820		void install_rsgun_protection();
821		void install_elandore_protection();
822		void install_ffreveng_protection();
823
824	809	void stv_register_protection_savestates();
825	810
826	811	// Decathlete specific variables and functions (see machine/decathlt.c)
r243061	r243062
840	825
841	826	optional_device<sega_315_5881_crypt_device> m_cryptdevice;
842	827	UINT16 crypt_read_callback(UINT32 addr);
843		int m_using_crypt_device;
844	828	};
845	829
846	830

trunk/src/mame/machine/stvprot.c

r243061	r243062
1		/* ST-V protection stuff */
	1	/* ST-V hookup for 315-5881 encryption/compression chip */
2	2
3	3	/*
4	4
r243061	r243062
11	11	Steep Slope Sliders (gfx transfer of character portraits)
12	12	Tecmo World Cup '98 (tecmo logo, player movement)
13	13
14		I think this is an encryption device.  Decathlete is also protected, but uses a different device
15		see machine/decathlt.c for details of that one, unlike this that appears to perform decompression
16		operations.
17
18
19		Astra Superstars data were extracted from Saturn version of the game. It is not known if
20		protection device has data stored inside, or they are read from roms (using decryption/decompression)
21
22	14	*/
23	15
24		/****************************************************************************************
25
26		Protection & cartridge handling
27
28		*****************************************************************************************
29
30		These are the known ST-V games that uses this area as a valid protection,I have written
31		the data used by the games in the various circumstances for reference:
32		-Astra Super Stars [astrass]
33		[0]        [1]        [2]        [3]
34		0x000y0000 0x00000000 0x06130027 0x01230000 test mode,char transfer (3)
35		0x???????? 0x???????? 0x???????? 0x???????? attract mode
36		0x000y0000 0x00000000 0x06130027 0x01230000 gameplay,char transfer (3)
37
38		-Elan Doree : Legend of Dragon [elandore]
39		[0]        [1]        [2]        [3]
40		No protection                               test mode
41		No protection                               attract mode
42		0x000y0000 0x00000000 0x****00** 0xff7f0000 gameplay,VDP-1 write (textures on humans)
43		0x000y0000 0x00000000 0x****00** 0xffbf0000 gameplay,VDP-1 write (textures on humans)
44
45		0x000y0000 0x00000000 0x****00** 0xf9ff0000 gameplay,VDP-1 write (textures on dragons)
46		0x000y0000 0x00000000 0x****00** 0xfbff0000 gameplay,VDP-1 write (textures on dragons)
47		0x000y0000 0x00000000 0x****00** 0xfe7f0000 gameplay,VDP-1 write (textures on dragons)
48		0x000y0000 0x00000000 0x****00** 0xfd7f0000 gameplay,VDP-1 write (textures on dragons)
49		0x000y0000 0x00000000 0x****00** 0xfeff0000 gameplay,VDP-1 write (textures on dragons)
50		0x000y0000 0x00000000 0x****00** 0xf9bf0000 gameplay,VDP-1 write (textures on dragons)
51
52		-Final Fight Revenge [ffreveng]
53		[0]        [1]        [2]        [3]
54		0x000y0000 0x00000000 0x4bcc0013 0x10da0000 test mode,boot vectors at $06080000
55		0x000y0000 0x00000000 0x0b780013 0x10d70000 attract mode,boot vectors at $06080000
56		0x???????? 0x???????? 0x???????? 0x???????? gameplay
57
58		-Radiant Silvergun [rsgun]
59		[0]        [1]        [2]        [3]
60		No protection                               test mode
61		0x000y0000 0x00000000 0x08000010 0x77770000 attract mode,work ram-h $60ff1ec and so on (1)
62		0x???????? 0x???????? 0x???????? 0x???????? gameplay
63
64		-Steep Slope Sliders [sss]
65		[0]        [1]        [2]        [3]
66		No protection                               test mode
67		*0x000y0000 0x00000000 0x000000a6 0x2c5b0000 attract mode,VDP-1 write
68		*0x000y0000 0x00000000 0x000000a6 0x2c5b0000 gameplay,VDP-1 write character 1 (2)
69		*0x000y0000 0x00000000 0x0f9800a6 0x47f10000 gameplay,VDP-1 write character 2
70		*0x000y0000 0x00000000 0x1d4800a6 0xfcda0000 gameplay,VDP-1 write character 3
71		*0x000y0000 0x00000000 0x29e300a6 0xb5e60000 gameplay,VDP-1 write character 4
72		*0x000y0000 0x00000000 0x38e900a6 0x392c0000 gameplay,VDP-1 write character 5
73		*0x000y0000 0x00000000 0x462500a6 0x77c30000 gameplay,VDP-1 write character 6
74		*0x000y0000 0x00000000 0x555c00a6 0x8a620000 gameplay,VDP-1 write character 7
75
76		=========================================================================================
77		y = setted as a 0,then after the ctrl data is moved is toggled to 1 then again toggled
78		to 0 after the reading,this bit is likely to be a "calculate protection values"
79		if 1,use normal ram if 0.
80		* = working checks
81		[3,low word]AFAIK this is the cartridge area and it's read-only.
82		(1)That area is usually (but not always) used as system registers.
83		(2)Same as P.O.S.T. check,it was really simple to look-up because of that.
84		(3)Wrong offset,or it requires something else like a bitswap?
85		=========================================================================================
86		Protection works as a sort of data transfer,it could also be that it uses
87		encryption on the data used...
88
89		For now I'm writing this function with a command basis so I can work better with it.
90		****************************************************************************************/
91
92	16	#include "emu.h"
93	17	#include "includes/stv.h"
94	18
95		//FILE *fp;
96		//FILE *fp2;
97	19
98	20
99		/************************
100		*
101		* Tecmo World Cup '98
102		*
103		************************/
104	21
105		/*
106		0x200214
107		0x20de94
108		wpset 0x200214,0x20de94-0x200214,r
109		dump twcup98.dmp,0x200214,0x20de94-0x200214,4,0,0
110		protection tests the data 0x201220 at
111		bp 0x6009a9e
112		with 0x60651f8
113		*/
114	22
115
116		//MAIN : 12120000  DATA : 0ad20069 Tecmo logo
117		//MAIN : 12120000  DATA : e332006b title screen
118		// TODO: encrypted / compressed data.
119		// Both points to a section that has a string ("TECMO" / "TITLE")
120
121
122		/*************************
123		*
124		* Final Fight Revenge
125		*
126		*************************/
127
128		/*
129		ffreveng protection notes
130		Global:
131		R2 is the vector read (where to jump to)
132		R3 is the vector pointer
133
134		Directory listing for Final Fight Revenge (Saturn Version):
135
136		In the ST-V version, most of these file names could be found at relative address 0x346a0 (0x22346a0)
137		Also, there's a table at 0x260000 (0x2260000), this points to offsets to the ROM (and are sent to the protection device),
138		and the size of it
139
140		fad      size     file name   date
141		000000aa 00003000  2000/2/8
142		000000aa 00003000 ? 2000/2/8
143		000000b0 00076080 0;1 2000/2/8
144		0001799e 014b2000 ALY.RED;1 1999/11/9
145		00002350 00001900 ALYHRAM.BIN;1 2000/2/8
146		0000040e 00005204 ANDEND.BIN;1 1999/11/9
147		000001a0 0000c700 ANDORE.BIN;1 2000/2/8
148		000003c8 00016938 ANDORE.CRT;1 1999/11/9
149		000001b9 000f3528 ANDOREM.BIN;1 2000/2/8
150		00003525 012db000 ATN.RED;1 1999/11/9
151		000024e6 00001900 ATNHRAM.BIN;1 2000/2/8
152		00013291 0120d000 ATO.RED;1 1999/11/9
153		000024a0 00001100 ATOHRAM.BIN;1 2000/2/8
154		00000419 0000f000 BELGER.BIN;1 2000/2/8
155		000005f0 00013bdc BELGER.CRT;1 1999/11/9
156		00000437 000ce990 BELGERM.BIN;1 2000/2/8
157		00002611 00000894 BURGR.BIN;1 2000/2/8
158		00002605 00000638 CAFFE.BIN;1 2000/2/8
159		0000273b 000022e0 CAPCOM.BIN;1 1999/11/9
160		00001d9a 00012100 CAPHRAM.BIN;1 2000/2/8
161		00000834 00004cec CDYEND.BIN;1 1999/11/9
162		0000218a 00005900 CHSHRAM.BIN;1 2000/2/8
163		0000061a 0000b900 CODY.BIN;1 2000/2/8
164		00000809 00014e00 CODY.CRT;1 1999/11/9
165		00002857 000ff412 CODYANIM.BIN;1 1999/11/9
166		00002a56 00011dbc CODYAPAL.BIN;1 1999/11/9
167		00000632 000d31cc CODYM.BIN;1 2000/2/8
168		00002619 0000046c CURRY.BIN;1 2000/2/8
169		00000b36 00005110 DAMEND.BIN;1 1999/11/9
170		0000083e 0000b300 DAMND.BIN;1 2000/2/8
171		00000aa6 000181ae DAMND.CRT;1 1999/11/9
172		00000855 0010c674 DAMNDM.BIN;1 2000/2/8
173		00000ad9 000063c0 DDAD.BIN;1 1999/11/9
174		00000b2c 00004a30 DDBL.BIN;1 1999/11/9
175		00000b25 000034b4 DDCD.BIN;1 1999/11/9
176		00000ae6 00004c6c DDDM.BIN;1 1999/11/9
177		00000b1c 00004660 DDED.BIN;1 1999/11/9
178		00000b15 00003770 DDEL.BIN;1 1999/11/9
179		00000b0e 00003268 DDGY.BIN;1 1999/11/9
180		00000b06 00003c74 DDHG.BIN;1 1999/11/9
181		00000b00 000029a8 DDPS.BIN;1 1999/11/9
182		00000af9 000035e4 DDRL.BIN;1 1999/11/9
183		00000af0 000044a8 DDSD.BIN;1 1999/11/9
184		0000217a 00007d00 DEMHRAM.BIN;1 2000/2/8
185		0000278e 00064396 DLOOP.CRT;1 1999/11/9
186		00000b41 0000e200 EDDIE.BIN;1 2000/2/8
187		00000d25 00019a44 EDDIE.CRT;1 1999/11/9
188		00000b5e 000c7758 EDDIEM.BIN;1 2000/2/8
189		00000d5a 00005204 EDIEND.BIN;1 1999/11/9
190		00000d65 0000d700 ELGADO.BIN;1 2000/2/8
191		00001010 00018b2e ELGADO.CRT;1 1999/11/9
192		00000d80 0012ec64 ELGADOM.BIN;1 2000/2/8
193		00001043 00005204 ELGEND.BIN;1 1999/11/9
194		00001d79 0000e5ec ENDING.BIN;1 1999/11/9
195		00002bc3 0002e8f4 ENDING.CRT;1 1999/11/9
196		0000019e 0000005d FFEXABS.TXT;1 1999/11/9
197		0000019f 00000060 FFEXBIB.TXT;1 1999/11/9
198		0000019d 00000032 FFEXCPY.TXT;1 1999/11/9
199		00002615 0000062c FRIES.BIN;1 2000/2/8
200		00001ce1 0004b8b4 GAMEL.BIN;1 1999/11/9
201		000003f6 000011fc GANDRE.BIN;1 1999/11/9
202		0000040b 00001246 GBEL.BIN;1 1999/11/9
203		000003f9 00000af3 GCODY.BIN;1 1999/11/9
204		000003fb 00000cc4 GDAM.BIN;1 1999/11/9
205		000003fd 00000f6a GEDDIE.BIN;1 1999/11/9
206		000003ff 00000c85 GGADO.BIN;1 1999/11/9
207		00000401 00000d4c GGUY.BIN;1 1999/11/9
208		00000403 00000f16 GHAG.BIN;1 1999/11/9
209		00000405 00000a63 GPOISON.BIN;1 1999/11/9
210		00000407 00000a85 GROL.BIN;1 1999/11/9
211		00005b71 01156000 GRV.RED;1 1999/11/9
212		0000243b 00001600 GRVHRAM.BIN;1 2000/2/8
213		00000409 00000dad GSODOM.BIN;1 1999/11/9
214		0000104e 0000c300 GUY.BIN;1 2000/2/8
215		0000123a 00014844 GUY.CRT;1 1999/11/9
216		00001266 00005204 GUYEND.BIN;1 1999/11/9
217		00001067 000d14aa GUYM.BIN;1 2000/2/8
218		00001271 0000c600 HAGGAR.BIN;1 2000/2/8
219		00001489 00017ad8 HAGGAR.CRT;1 1999/11/9
220		0000128a 000e46fc HAGGARM.BIN;1 2000/2/8
221		000014bb 00005204 HGREND.BIN;1 1999/11/9
222		00002740 0001b468 HISCORE.BIN;1 1999/11/9
223		00002777 00000a00 HISCP.BIN;1 1999/11/9
224		00002779 000086c0 HISCTEX.BIN;1 1999/11/9
225		0000278b 00001680 HSFACE_T.BIN;1 1999/11/9
226		00002607 00000618 HTDOG.BIN;1 2000/2/8
227		00015741 010e3800 JNK.RED;1 1999/11/9
228		000023cd 00001900 JNKHRAM.BIN;1 2000/2/8
229		00002d0b 0003dfc0 KANJI.FON;1 1999/11/9
230		00001d98 00000d44 LOAD.BIN;1 1999/11/9
231		00001dbf 001dd5a8 LOGO.CPK;1 1999/11/9
232		00002d0a 00000400 LVLHRAM.BIN;1 2000/2/8
233		0000260a 000005e8 MEAT.BIN;1 2000/2/8
234		00007eb3 01253800 MLK.RED;1 1999/11/9
235		00002196 00000d00 MLKHRAM.BIN;1 2000/2/8
236		0000278a 00000400 NAMEP.BIN;1 1999/11/9
237		0000a3f0 011b8000 NPK.RED;1 1999/11/9
238		000022d0 00002700 NPKHRAM.BIN;1 2000/2/8
239		00010dc0 0121d800 NUK.RED;1 1999/11/9
240		00002555 00001100 NUKHRAM.BIN;1 2000/2/8
241		00002c21 00036f94 OVER.CRT;1 1999/11/9
242		000014c6 0000ab00 POISON.BIN;1 2000/2/8
243		000017f1 00018880 POISON.CRT;1 1999/11/9
244		000014dc 0017617c POISONM.BIN;1 2000/2/8
245		0000c7f6 01166000 PRK.RED;1 1999/11/9
246		00002268 00001100 PRKHRAM.BIN;1 2000/2/8
247		00002a82 00003940 PSCBCHR.BIN;1 1999/11/9
248		00002a8a 00002000 PSCBMAP.BIN;1 1999/11/9
249		00002a92 00000ac0 PSCRTEX.BIN;1 1999/11/9
250		00002a7b 000033c0 PSFCCHR.BIN;1 1999/11/9
251		00001824 000049d4 PSNEND.BIN;1 1999/11/9
252		00002a8e 00001e54 PSNMCHR.BIN;1 1999/11/9
253		00002a94 000037c0 PSSBCHR.BIN;1 1999/11/9
254		00002a9b 00002000 PSSBMAP.BIN;1 1999/11/9
255		00002a9f 00000200 PSSBPAL.BIN;1 1999/11/9
256		00002a7a 00000600 PS_PAL.BIN;1 1999/11/9
257		00002c8f 0003d4c0 RESIDENT.CRT;1 1999/11/9
258		00001c68 0003ae40 RESTEXT.BIN;1 1999/11/9
259		00001cde 00001220 RESTEXTB.BIN;1 1999/11/9
260		00001d97 00000200 RETIMEPA.BIN;1 1999/11/9
261		0000261b 000004e8 REVNG.BIN;1 1999/11/9
262		00001a5b 00005204 ROLEND.BIN;1 1999/11/9
263		0000182e 0000e700 ROLENTO.BIN;1 2000/2/8
264		00001a2d 00016bfc ROLENTO.CRT;1 1999/11/9
265		0000184b 000d6bf0 ROLENTOM.BIN;1 2000/2/8
266		000025c5 000062e4 SDDRVS.TSK;1 1999/11/9
267		00002eb3 002ee000 SEGA_WRN.DA;1 1998/4/30
268		00002b82 00020492 SELECT.CRT;1 1999/11/9
269		00002aa0 00070e04 SODBTEX.BIN;1 1999/11/9
270		00001c5d 00005154 SODEND.BIN;1 1999/11/9
271		00001a66 0000b100 SODOM.BIN;1 2000/2/8
272		00001c29 0001943a SODOM.CRT;1 1999/11/9
273		00001a7d 000b9e2f SODOMM.BIN;1 2000/2/8
274		0000260d 000004cc SUSHI.BIN;1 2000/2/8
275		0000261c 0008f204 TITLE.BIN;1 1999/11/9
276		0000eb58 010e9000 WHS.RED;1 1999/11/9
277		000021ff 00001100 WHSHRAM.BIN;1 2000/2/8
278		000003a0 00009b90 _ADCL00.BIN;1 1999/11/9
279		000003b4 00009b90 _ADCL01.BIN;1 1999/11/9
280		000023cb 00000c54 _ALYBMAP.BIN;1 1999/11/9
281		0000239b 00017ec0 _ALYFCHR.BIN;1 1999/11/9
282		00002399 00000c1a _ALYFMAP.BIN;1 1999/11/9
283		00002354 00000600 _ALYPAL.BIN;1 1999/11/9
284		0000235a 0001f400 _ALYRCHR.BIN;1 1999/11/9
285		00002355 0000205c _ALYRMAP.BIN;1 1999/11/9
286		0000252a 00015800 _ATNBCHR.BIN;1 1999/11/9
287		00002526 00001882 _ATNBMAP.BIN;1 1999/11/9
288		00002525 00000416 _ATNFMAP.BIN;1 1999/11/9
289		000024ea 00000600 _ATNPAL.BIN;1 1999/11/9
290		000024ef 0001af00 _ATNRCHR.BIN;1 1999/11/9
291		000024eb 00001d10 _ATNRMAP.BIN;1 1999/11/9
292		000024e3 000017fa _ATOBMAP.BIN;1 1999/11/9
293		000024e2 00000040 _ATOFCHR.BIN;1 1999/11/9
294		000024e1 00000006 _ATOFMAP.BIN;1 1999/11/9
295		000024a3 00000600 _ATOPAL.BIN;1 1999/11/9
296		000024a9 0001bbc0 _ATORCHR.BIN;1 1999/11/9
297		000024a4 00002004 _ATORMAP.BIN;1 1999/11/9
298		00000618 00000a20 _BGUNTX.BIN;1 1999/11/9
299		000005d5 0000d688 _BLTXURE.BIN;1 1999/11/9
300		00002613 00000a80 _BURGRTX.BIN;1 1999/11/9
301		00002606 000006c0 _CAFFETX.BIN;1 1999/11/9
302		000007d9 0000bdb0 _CDCL00.BIN;1 1999/11/9
303		000007f1 0000bdb0 _CDCL01.BIN;1 1999/11/9
304		00000ad7 000008a0 _CHSAWTX.BIN;1 1999/11/9
305		000025e3 00003500 _CRAT2TX.BIN;1 1999/11/9
306		000025ea 00002200 _CRAT3TX.BIN;1 1999/11/9
307		000025d5 00003300 _CRATDTX.BIN;1 1999/11/9
308		000025dc 00003300 _CRATNTX.BIN;1 1999/11/9
309		0000261a 00000500 _CURRYTX.BIN;1 1999/11/9
310		00000a6e 0000d918 _DMCL00.BIN;1 1999/11/9
311		00000a8a 0000d918 _DMCL01.BIN;1 1999/11/9
312		000025ef 00001b60 _DRUMTX.BIN;1 1999/11/9
313		00000ced 0000da3c _EDCL00.BIN;1 1999/11/9
314		00000d09 0000da3c _EDCL01.BIN;1 1999/11/9
315		00000fde 0000c404 _ELCL00.BIN;1 1999/11/9
316		00000ff7 0000c404 _ELCL01.BIN;1 1999/11/9
317		00002616 000011a0 _FRIESTX.BIN;1 1999/11/9
318		00001d96 00000660 _GFNTCHR.BIN;1 1999/11/9
319		00001264 00000880 _GKATATX.BIN;1 1999/11/9
320		00002488 0000bcc0 _GRVBCHR.BIN;1 1999/11/9
321		00002486 00000d76 _GRVBMAP.BIN;1 1999/11/9
322		00002483 000010fc _GRVFMAP.BIN;1 1999/11/9
323		0000243e 00000600 _GRVPAL.BIN;1 1999/11/9
324		00002444 0001f4c0 _GRVRCHR.BIN;1 1999/11/9
325		0000243f 00002004 _GRVRMAP.BIN;1 1999/11/9
326		0000120a 0000bf44 _GYCL00.BIN;1 1999/11/9
327		00001222 0000bf44 _GYCL01.BIN;1 1999/11/9
328		00001453 0000d614 _HGCL00.BIN;1 1999/11/9
329		0000146e 0000d614 _HGCL01.BIN;1 1999/11/9
330		00002608 00000880 _HTDOGTX.BIN;1 1999/11/9
331		000025f3 00002b60 _ICEBTX.BIN;1 1999/11/9
332		00001042 00000560 _JKNFTX.BIN;1 1999/11/9
333		00002419 00010940 _JNKBCHR.BIN;1 1999/11/9
334		00002417 00000982 _JNKBMAP.BIN;1 1999/11/9
335		00002414 0000113a _JNKFMAP.BIN;1 1999/11/9
336		000023d1 00000600 _JNKPAL.BIN;1 1999/11/9
337		000023d6 0001ee80 _JNKRCHR.BIN;1 1999/11/9
338		000023d2 00001bde _JNKRMAP.BIN;1 1999/11/9
339		000025d4 000006c0 _KATA2TX.BIN;1 1999/11/9
340		00001c5c 00000780 _KATANTX.BIN;1 1999/11/9
341		0000260b 00000cc0 _MEATTX.BIN;1 1999/11/9
342		000021dd 00010e80 _MLKBCHR.BIN;1 1999/11/9
343		000021db 00000be6 _MLKBMAP.BIN;1 1999/11/9
344		000021d9 00000f70 _MLKFMAP.BIN;1 1999/11/9
345		00002198 00000600 _MLKPAL.BIN;1 1999/11/9
346		0000219c 0001e440 _MLKRCHR.BIN;1 1999/11/9
347		00002199 000013de _MLKRMAP.BIN;1 1999/11/9
348		0000234d 00001416 _NPKBMAP.BIN;1 1999/11/9
349		0000231d 00017dc0 _NPKFCHR.BIN;1 1999/11/9
350		0000231a 00001406 _NPKFMAP.BIN;1 1999/11/9
351		000022d5 00000600 _NPKPAL.BIN;1 1999/11/9
352		000022db 0001f640 _NPKRCHR.BIN;1 1999/11/9
353		000022d6 00002202 _NPKRMAP.BIN;1 1999/11/9
354		0000259a 000153c0 _NUKBCHR.BIN;1 1999/11/9
355		00002596 00001924 _NUKBMAP.BIN;1 1999/11/9
356		00002594 00000f6e _NUKFMAP.BIN;1 1999/11/9
357		00002558 00000600 _NUKPAL.BIN;1 1999/11/9
358		0000255e 0001adc0 _NUKRCHR.BIN;1 1999/11/9
359		00002559 00002004 _NUKRMAP.BIN;1 1999/11/9
360		000025d3 000005a0 _NYOIBTX.BIN;1 1999/11/9
361		000025f9 000039e0 _OILCTX.BIN;1 1999/11/9
362		000014b9 00000b40 _PIPETX.BIN;1 1999/11/9
363		00001823 00000600 _POISNTX.BIN;1 1999/11/9
364		000022cc 000018fc _PRKBMAP.BIN;1 1999/11/9
365		000022ac 0000fd00 _PRKFCHR.BIN;1 1999/11/9
366		000022a8 00001d4a _PRKFMAP.BIN;1 1999/11/9
367		0000226b 00000600 _PRKPAL.BIN;1 1999/11/9
368		00002271 0001b0c0 _PRKRCHR.BIN;1 1999/11/9
369		0000226c 00002202 _PRKRMAP.BIN;1 1999/11/9
370		000017c9 00009874 _PSCL00.BIN;1 1999/11/9
371		000017dd 00009874 _PSCL01.BIN;1 1999/11/9
372		00000d59 00000180 _PSTKTX.BIN;1 1999/11/9
373		000019f9 0000cb2c _RLCL00.BIN;1 1999/11/9
374		00001a13 0000cb2c _RLCL01.BIN;1 1999/11/9
375		00001bf1 0000dd0c _SDCL00.BIN;1 1999/11/9
376		00001c0d 0000dd0c _SDCL01.BIN;1 1999/11/9
377		00000833 00000660 _SKNFTX.BIN;1 1999/11/9
378		000025d2 00000240 _SPIKETX.BIN;1 1999/11/9
379		0000260e 000011e0 _SUSHITX.BIN;1 1999/11/9
380		00002601 00001ba0 _TOMBTX.BIN;1 1999/11/9
381		0000224b 0000e2c0 _WHSBCHR.BIN;1 1999/11/9
382		00002249 00000a36 _WHSBMAP.BIN;1 1999/11/9
383		00002245 00001bb8 _WHSFMAP.BIN;1 1999/11/9
384		00002202 00000600 _WHSPAL.BIN;1 1999/11/9
385		00002207 0001efc0 _WHSRCHR.BIN;1 1999/11/9
386		00002203 00001cf4 _WHSRMAP.BIN;1 1999/11/9
387		*/
388
389
390
391
392
393
394
395		UINT32 rsgun_prot_read_callback( address_space &space, int protaddr, UINT32 key )
396		{
397		int tempctrl = protaddr - 0x0201000; // technically it doesn't seem to care, but...
398
399		switch(key)
400		{
401		case 0x77770000:
402		{
403		UINT32 val =
404		((tempctrl & 0xff)<<24) |
405		(((tempctrl+1) & 0xff)<<16) |
406		(((tempctrl+2) & 0xff)<<8) |
407		((tempctrl+3) & 0xff);
408		if(tempctrl & 0x100)
409		val &= 0x0f0f0f0f;
410		else
411		val &= 0xf0f0f0f0;
412
413		return val;
414		}
415		}
416
417		return 0;
418		}
419
420		UINT32 twcup98_prot_read_callback( address_space &space, int protaddr, UINT32 key )
421		{
422		UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
423		UINT32 res = 0;
424
425		UINT32 twcup_prot_data[8] =
426		{
427		0x23232323, 0x23232323, 0x4c4c4c4c, 0x4c156301
428		};
429
430		switch(key >> 16)
431		{
432		case 0x1212:
433		if(protaddr & 2)
434		{
435		res = (ROM[protaddr / 4] & 0xffff) << 16;
436		res |= (ROM[(protaddr+4) / 4] & 0xffff0000) >> 16;
437		}
438		else
439		{
440		res = ROM[protaddr / 4] & 0xffff0000;
441		res |= ROM[protaddr / 4] & 0xffff;
442		}
443
444		if(protaddr >= 0xD215A4+0x100c && protaddr < 0xD215A4+0x100c+8*4)
445		res = twcup_prot_data[(protaddr-(0xD215A4+0x100c))/4];
446
447		return res;
448		}
449
450		return 0;
451		}
452
453		UINT32 sss_prot_read_callback( address_space &space, int protaddr, UINT32 key )
454		{
455		UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
456		int read_offset_hack = 0;
457		UINT32 res;
458
459		/*
460		MAIN : 2c5b0000  DATA : 000000a6 014c0000
461		MAIN : 47f10000  DATA : 0f9800a6 014c1f30
462		MAIN : fcda0000  DATA : 1d4800a6 014c3a90
463		MAIN : b5e60000  DATA : 29e300a6 014c53c6
464		MAIN : 392c0000  DATA : 38e900a6 014c71d2
465		MAIN : 77c30000  DATA : 462500a6 014c8c4a
466		MAIN : 8a620000  DATA : 555c00a6 014caab8
467		*/
468
469		// I have a feeling rather than the offsets being scrambled they were lazy
470		// and left unencrypted copies in the ROM... but this still needs verification
471		switch(key>>16)
472		{
473		case 0x2c5b: read_offset_hack = 0x60054; break;
474		case 0x47f1: read_offset_hack = 0x56498; break;
475		case 0xfcda: read_offset_hack = 0x50b0c; break;
476		case 0xb5e6: read_offset_hack = 0x4af56; break;
477		case 0x392c: read_offset_hack = 0x45876; break;
478		case 0x77c3: read_offset_hack = 0x3fe02; break;
479		case 0x8a62: read_offset_hack = 0x3a784; break;
480		}
481
482		switch(key>>16)
483		{
484		default:
485		if(protaddr & 2)
486		{
487		res = (ROM[(protaddr-read_offset_hack) / 4] & 0xffff) << 16;
488		res |= (ROM[((protaddr-read_offset_hack)+4) / 4] & 0xffff0000) >> 16;
489		}
490		else
491		{
492		res = ROM[(protaddr-read_offset_hack) / 4] & 0xffff0000;
493		res |= ROM[(protaddr-read_offset_hack) / 4] & 0xffff;
494		}
495		return res;
496		}
497		}
498
499
500
501		UINT32 elandore_prot_read_callback( address_space &space, int protaddr, UINT32 key )
502		{
503		UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
504		UINT32 res = 0;
505
506		switch(key >> 16)
507		{
508		default:
509		if(protaddr & 2)
510		{
511		res = (ROM[protaddr / 4] & 0xffff) << 16;
512		res |= (ROM[(protaddr+4) / 4] & 0xffff0000) >> 16;
513		}
514		else
515		{
516		res = ROM[protaddr / 4] & 0xffff0000;
517		res |= ROM[protaddr / 4] & 0xffff;
518		}
519		return res;
520		}
521
522		// never executed
523		//return 0;
524		}
525
526		UINT32 ffreveng_prot_read_callback( address_space &space, int protaddr, UINT32 key )
527		{
528		//UINT32 res = 0;
529
530		switch(key >> 16)
531		{
532		case 0x10da://ffreveng, boot vectors at $6080000,test mode
533		case 0x10d7://ffreveng, boot vectors at $6080000,attract mode
534		#if 0
535		if(protaddr & 2)
536		{
537		res = (ROM[protaddr / 4] & 0xffff) << 16;
538		res |= (ROM[(protaddr+4) / 4] & 0xffff0000) >> 16;
539		}
540		else
541		{
542		res = ROM[protaddr / 4] & 0xffff0000;
543		res |= ROM[protaddr / 4] & 0xffff;
544		}
545		#endif
546		return 0;
547		}
548
549		return 0;
550		}
551
552
553	23	/*************************************
554	24	*
555	25	* Common Handlers
556	26	*
557	27	*************************************/
558	28
559		// the naomi hookup of 315-5881 reads 16-bits at a time, here we seem to read 32?
560
561	29	READ32_MEMBER( stv_state::common_prot_r )
562	30	{
563	31	UINT32 *ROM = (UINT32 *)space.machine().root_device().memregion("abus")->base();
r243061	r243062
566	34	{
567	35	if(offset == 3)
568	36	{
569		#ifdef MAME_DEBUG
570		popmessage("Prot read at %06x with data = %08x",space.device().safe_pc(),m_abus_protkey);
571		#endif
572		if (!m_using_crypt_device) // decrypt using hacks
573		{
574		UINT32 realret = space.read_dword(0x2000000 + m_ctrl_index);
575		UINT32 retdata = m_prot_readback(space, m_ctrl_index, m_abus_protkey);
576		//fwrite(&realret, 1, 4, fp);
577		//fwrite(&retdata, 1, 4, fp2);
578
579		logerror("A-Bus control protection read at %06x with data = %08x Returning = %08x Would otherwise return = %08x\n", space.device().safe_pc(), m_abus_protkey, retdata, realret);
580		m_ctrl_index += 4;
581		return retdata;
582		}
583		else // decrypt using real decryption device
584		{
585		UINT8* base;
586		UINT16 res = m_cryptdevice->do_decrypt(base);
587		UINT16 res2 = m_cryptdevice->do_decrypt(base);
588		res = ((res & 0xff00) >> 8) | ((res & 0x00ff) << 8);
589		res2 = ((res2 & 0xff00) >> 8) | ((res2 & 0x00ff) << 8);
	37	UINT8* base;
	38	UINT16 res = m_cryptdevice->do_decrypt(base);
	39	UINT16 res2 = m_cryptdevice->do_decrypt(base);
	40	res = ((res & 0xff00) >> 8) | ((res & 0x00ff) << 8);
	41	res2 = ((res2 & 0xff00) >> 8) | ((res2 & 0x00ff) << 8);
590	42
591		return res2 | (res << 16);
592		}
593
	43	return res2 | (res << 16);
594	44	}
595	45	return m_a_bus[offset];
596	46	}
r243061	r243062
611	61	WRITE32_MEMBER ( stv_state::common_prot_w )
612	62	{
613	63	COMBINE_DATA(&m_a_bus[offset]);
614		//printf("A-Bus control protection write at %06x: [%02x] <- %08x\n",space.device().safe_pc(),offset,data);
615	64
616	65	if (offset == 0)
617	66	{
r243061	r243062
619	68	}
620	69	else if(offset == 2)
621	70	{
622		COMBINE_DATA(&m_abus_prot_addr);
	71	if (mem_mask&0xffff0000) m_cryptdevice->set_addr_low(data >> 16);
	72	if (mem_mask&0x0000ffff) m_cryptdevice->set_addr_high(data&0xffff);
623	73
624		m_cryptdevice->set_addr_low(m_abus_prot_addr >> 16);
625		m_cryptdevice->set_addr_high(m_abus_prot_addr&0xffff);
626
627	74	}
628	75	else if(offset == 3)
629	76	{
630	77	COMBINE_DATA(&m_abus_protkey);
631	78
632	79	m_cryptdevice->set_subkey(m_abus_protkey>>16);
633
634
635		int a_bus_vector;
636		a_bus_vector = m_abus_prot_addr >> 16;
637		a_bus_vector|= (m_abus_prot_addr & 0xffff) << 16;
638		a_bus_vector<<= 1;
639		/*
640		if (fp)
641		{
642		fclose(fp);
643		fp = 0;
644		}
645		if (fp2)
646		{
647		fclose(fp2);
648		fp2 = 0;
649		}
650		char filename[256];
651		sprintf(filename,"encrypted_%s_key_%04x_address_%08x", machine().system().name, m_abus_protkey>>16, a_bus_vector);
652		fp=fopen(filename, "w+b");
653		sprintf(filename,"not-encrypted_%s_key_%04x_address_%08x", machine().system().name, m_abus_protkey>>16, a_bus_vector);
654		fp2=fopen(filename, "w+b");
655		*/
656
657		//printf("MAIN : %08x  DATA : %08x %08x\n",m_abus_protkey,m_abus_prot_addr,a_bus_vector);
658
659		// if you look at the first transfer in ffreveng this is clearly a ROM address from a table |  MAIN : 10d70000  DATA : 0b780013 002616f0
660		// (opr21872.7, offset 0x616f0, which happens to be 0x2616f0 in the ROM region "game0")
661		// the values sent by the CPU are plucked from a table above where the data is, located at 0x60000
662		// Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
663		// 00060000   00 00 16 F0 00 00 2F A0  00 00 46 90 00 00 4D 04
664		// this is the first entry in the table, 0x16f0 is the address, 0x2fa0 is the length.
665		// the next entry is address 0x4690, length 0x4d04.  0x16f0 + 0x2fa0 == 0x4690 so that entry is located straight after the first one
666		// the game reads the number of bytes specified in the length via the protection device, writing them to RAM.  This suggests there
667		// is no compression going on, only some form of encryption.
668
669		m_ctrl_index = a_bus_vector;
670	80	}
671	81	}
672	82
r243061	r243062
675	85	m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x4fffff0, 0x4ffffff, read32_delegate(FUNC(stv_state::common_prot_r), this), write32_delegate(FUNC(stv_state::common_prot_w), this));
676	86
677	87	INT64 key = get_315_5881_key(machine());
678
679		if (key != -1)
680		{
681		m_cryptdevice->set_key(key); // use real decryption
682		m_using_crypt_device = 1;
683		}
684		else
685		m_using_crypt_device = 0; // use protection sim
	88	m_cryptdevice->set_key(key);
686	89	}
687	90
688		void stv_state::install_sss_protection()
689		{
690		install_common_protection();
691		m_prot_readback = sss_prot_read_callback;
692		}
693
694		void stv_state::install_astrass_protection()
695		{
696		install_common_protection();
697		}
698
699		void stv_state::install_ffreveng_protection()
700		{
701		install_common_protection();
702		m_prot_readback = ffreveng_prot_read_callback;
703		}
704
705		void stv_state::install_elandore_protection()
706		{
707		install_common_protection();
708		m_prot_readback = elandore_prot_read_callback;
709		}
710
711		void stv_state::install_rsgun_protection()
712		{
713		install_common_protection();
714		m_prot_readback = rsgun_prot_read_callback;
715		}
716
717		void stv_state::install_twcup98_protection()
718		{
719		install_common_protection();
720		m_prot_readback = twcup98_prot_read_callback;
721		}
722
723
724	91	void stv_state::stv_register_protection_savestates()
725	92	{
726	93	save_item(NAME(m_a_bus));
727		save_item(NAME(m_ctrl_index));
728		save_item(NAME(m_internal_counter));
729		save_item(NAME(m_char_offset));
730	94	}

https://github.com/mamedev/mame/commit/38d121129e9063a8760dfff20ae27fd3af8a0d1d

Previous

199869 Revisions

Next

---

© 1997-2024 The MAME Team