summaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
author Olivier Galibert <galibert@pobox.com>2014-12-02 21:38:37 +0100
committer Olivier Galibert <galibert@pobox.com>2014-12-04 09:47:30 +0100
commitc941b34eafc608a43e58e217bf7547b9dc938b6d (patch)
treea5bed020a3f9f2e84fa9d86f4e50d829af7836e6
parent36e59479948fcbdd11fdb772053754c6c23197b2 (diff)
New NOT WORKING:
House of the Dead 4 (Export) [soyandroid, Guru] Virtua Fighter 5 (Export) [soyandroid] After Burner Climax (Export) [soyandroid] Let's Go Jungle (Export) [soyandroid] Outrun 2 SP SDX [soyandroid] Power Smash 3 / Virtua Tennis 3 (Export) [soyandroid] Virtua Tennis 3 (Japan) [Guru] Initial D4 (Rev D) [Guru] Initial D4 (Rev C) [Guru] Sega Race-TV (Export) [soyandroid, Guru] House of the Dead EX (Japan) [soyandroid] Rambo (Export) [soyandroid, Guru] Hummer Extreme [soyandroid] VBios updater [Guru]
-rw-r--r--src/mame/drivers/lindbergh.c208
-rw-r--r--src/mame/mame.lst15
2 files changed, 210 insertions, 13 deletions
diff --git a/src/mame/drivers/lindbergh.c b/src/mame/drivers/lindbergh.c
index ef29ab1b4c0..5fdee6a3dcf 100644
--- a/src/mame/drivers/lindbergh.c
+++ b/src/mame/drivers/lindbergh.c
@@ -24,6 +24,39 @@ The familiar PIC is still present on the back of the system and likely decrypts
On this red box the CPU is a Celeron D at 2.8GHz. RAM is 512M DDR PC3200
The box has Sega number 845-0001D-02
+
+Security
+--------
+
+The security seems to work in multiple steps. The information there
+is a combination of our research and things found on the internet.
+
+- At boot, the bios unlocks the CF card through an IDE 0x82 command
+ with a currently unknown key. There is also a hardware heartbeat
+ signal on the IDE bus to avoid hotswapping.
+
+- The system boots on the CF which holds a customized Montavista linux.
+
+- The CF system can either install the game (from the DVD) or start it (on the HD)
+
+- The DVD is decrypted (probably on-the-fly with aesloop) using a
+ fixed system key (all the dvd images start identically).
+
+- The PIC includes an AES-CBC engine and has as data an IV, a key,
+ some game-specific identification information, and two pre and
+ post-whitening values. Everything but the key is dumpable through
+ commands, but the key seems well-protected. It's not realistic to
+ decrypt very large amounts of data through it though, the bandwidth
+ would be way too low.
+
+- The HD is probably unlocked by the CF and bootstrap code is
+ decrypted through the PIC. That code in turn loop-decrypts/mounts all the
+ data needed from the partition (probably /usr, /X11R6 and /home).
+
+Currently, we do not have access to the CF image, making it impossible
+to do a complete boot/install.
+
+
Lindbergh Game List
-------------------
Security
@@ -371,21 +404,172 @@ static MACHINE_CONFIG_START(lindbergh, lindbergh_state)
MCFG_AC97_ADD( ":pci:1f.5", 0x808625a6, 0x02, 0x103382c0)
MACHINE_CONFIG_END
+#define LINDBERGH_BIOS \
+ ROM_REGION32_LE(0x100000, ":pci:1f.0", 0) /* PC bios, location 3j7 */ \
+ ROM_SYSTEM_BIOS(0, "bios0", "6.0.0010 alternate version") \
+ ROMX_LOAD("6.0.0010a.bin", 0x00000, 0x100000, CRC(10dd9b76) SHA1(1fdf1f921bc395846a7c3180fbdbc4ca287a9670), ROM_BIOS(1) ) \
+ ROM_SYSTEM_BIOS(1, "bios1", "6.0.0009") \
+ ROMX_LOAD("6.0.0009.bin", 0x00000, 0x100000, CRC(5ffdfbf8) SHA1(605bc4967b749b4e6d13fc2ebb845ba956a259a7), ROM_BIOS(2) ) \
+ ROM_SYSTEM_BIOS(2, "bios2", "6.0.0010") \
+ ROMX_LOAD("6.0.0010.bin", 0x00000, 0x100000, CRC(ea2bf888) SHA1(c9c5b6f0d4f4f36620939b15dd2f128a74347e37), ROM_BIOS(3) ) \
+\
+ ROM_REGION(0x400000, ":pci:1e.0:03.0", 0) /* Baseboard MPC firmware */ \
+ ROM_LOAD("fpr-24370b.ic6", 0x000000, 0x400000, CRC(c3b021a4) SHA1(1b6938a50fe0e4ae813864649eb103838c399ac0)) \
+\
+ ROM_REGION32_LE(0x10000, ":pci:01.0:00.0", 0) /* Geforce bios extension (custom or standard?) */ \
+ ROM_LOAD("vid_bios.u504", 0x00000, 0x10000, CRC(f78d14d7) SHA1(f129787e487984edd23bf344f2e9500c85052275)) \
+
ROM_START(lindbios)
- ROM_REGION32_LE(0x100000, ":pci:1f.0", 0) // PC bios, location 3j7
- ROM_SYSTEM_BIOS(0, "bios0", "6.0.0010 alternate version")
- ROMX_LOAD("6.0.0010a.bin", 0x00000, 0x100000, CRC(10dd9b76) SHA1(1fdf1f921bc395846a7c3180fbdbc4ca287a9670), ROM_BIOS(1) )
- ROM_SYSTEM_BIOS(1, "bios1", "6.0.0009")
- ROMX_LOAD("6.0.0009.bin", 0x00000, 0x100000, CRC(5ffdfbf8) SHA1(605bc4967b749b4e6d13fc2ebb845ba956a259a7), ROM_BIOS(2) )
- ROM_SYSTEM_BIOS(2, "bios2", "6.0.0010")
- ROMX_LOAD("6.0.0010.bin", 0x00000, 0x100000, CRC(ea2bf888) SHA1(c9c5b6f0d4f4f36620939b15dd2f128a74347e37), ROM_BIOS(3) )
+ LINDBERGH_BIOS
+ROM_END
+
+ROM_START(hotd4)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0427 / 317-0427-COM
+ ROM_LOAD("317-0427-com.bin", 0, 0x2000, CRC(ef4a120c) SHA1(fcc0386fa708af9e010e40e1d259a6bd95e8b9e2))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0003a", 0, SHA1(46544e28735f55418dd78bd19446093874438264))
+ROM_END
+
+ROM_START(vf5)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0438 / 317-0438-COM
+ ROM_LOAD("317-0438-com.bin", 0, 0x2000, CRC(9aeb15d3) SHA1(405ddc44b2b40b72cfe2a081a0d5e43ceb9a380e))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0008e", 0, NO_DUMP)
+ROM_END
+
+ROM_START(abclimax)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0440 / 317-0440-COM
+ ROM_LOAD("317-0440-com.bin", 0, 0x2000, CRC(8d09e717) SHA1(6b25982f7042541874115d33ea5d0c028140a962))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0009", 0, NO_DUMP)
+ROM_END
+
+ROM_START(letsgoju)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0442 / 317-0442-COM
+ ROM_LOAD("317-0442-com.bin", 0, 0x2000, CRC(b706efbb) SHA1(97c2b65e521113c5201f0b588fcb37a39148a637))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0011", 0, NO_DUMP)
+ROM_END
+
+ROM_START(outr2sdx)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0452 / 317-0452-COM (to verify, may be the one for OutRun 2 Special Tours)
+ ROM_LOAD("317-0452-com.bin", 0, 0x2000, CRC(f5b7bb3f) SHA1(6b179b255b3d29e5ce61902eeae4da07177a2943))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0015a", 0, NO_DUMP)
+ROM_END
+
+ROM_START(psmash3)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0434 / 317-0434-COM
+ ROM_LOAD("317-0434-com.bin", 0, 0x2000, CRC(70e3b202) SHA1(4925a288f937d54529abe6ef467c9c23674e47f0))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0005a", 0, NO_DUMP)
+ROM_END
+
+ROM_START(vtennis3)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0506 / 317-0506-JPN
+ ROM_LOAD("317-0506-jpn.bin", 0, 0x2000, NO_DUMP)
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0005c", 0, SHA1(1fd689753c4b70dff0286cb7f623ee7fd439db62))
+ROM_END
+
+
+ROM_START(initiad4)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0486E / 317-0486-COM
+ ROM_LOAD("317-0846-com.bin", 0, 0x2000, NO_DUMP)
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0030d", 0, SHA1(e43e6d22fab4eceb81db8309e4634e049d9c41e6))
+ROM_END
+
+ROM_START(initiad4c)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0486E / 317-0486-COM
+ ROM_LOAD("317-0846-com.bin", 0, 0x2000, NO_DUMP)
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0030c", 0, SHA1(b1919f28539afec4c4bc52357e5210a090b5ae32))
+ROM_END
+
+ROM_START(segartv)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0504 / 317-0504-COM
+ ROM_LOAD("317-0504-com.bin", 0, 0x2000, CRC(ae7eaea8) SHA1(187e417e0b5543d95245364b547925426aa9f80e))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0044", 0, SHA1(914aa23ece8aaf0f1942f77272b3a87d10f7a7db))
+ROM_END
+
+ROM_START(hotdex)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0550 / 317-0550-JPN
+ ROM_LOAD("317-0550-jpn.bin", 0, 0x2000, CRC(7e247f13) SHA1(d416b0e7742b32eb31443967e84ef93fc9e56dfb))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("hotdex", 0, NO_DUMP)
+ROM_END
+
+ROM_START(rambo)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0540 / 317-0540-COM
+ ROM_LOAD("317-0540-com.bin", 0, 0x2000, CRC(fd9a7bc0) SHA1(140b05573e25a41c1237c7a96c8e099efbfd75b8))
+
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0069", 0, SHA1(1f3401b652c45db2b843360aff9cda862c2832c0))
+ROM_END
+
+ROM_START(hummerxt)
+ LINDBERGH_BIOS
+
+ ROM_REGION(0x2000, ":pic", 0) // PIC security id unknown
+ ROM_LOAD("hummerextreme.bin", 0, 0x2000, CRC(524bc69a) SHA1(c79b6bd384196c169e40e623f4c80c8b9eb11f81))
+ROM_END
- ROM_REGION(0x400000, ":pci:1e.0:03.0", 0) // Baseboard MPC firmware
- ROM_LOAD("fpr-24370b.ic6", 0x000000, 0x400000, CRC(c3b021a4) SHA1(1b6938a50fe0e4ae813864649eb103838c399ac0))
+ROM_START(lbvbiosu)
+ LINDBERGH_BIOS
- ROM_REGION32_LE(0x10000, ":pci:01.0:00.0", 0) // Geforce bios extension (custom or standard?)
- ROM_LOAD("vid_bios.u504", 0x00000, 0x10000, CRC(f78d14d7) SHA1(f129787e487984edd23bf344f2e9500c85052275))
+ DISK_REGION("dvd")
+ DISK_IMAGE_READONLY("dvp-0021b", 0, SHA1(362ac028ba19ba4762678953a033034a5ee8ad53))
ROM_END
-GAME(1999, lindbios, 0, lindbergh, 0, driver_device, 0, ROT0, "Sega Lindbergh", "Sega Lindbergh Bios", GAME_IS_SKELETON)
+GAME(1999, lindbios, 0, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Sega Lindbergh Bios", GAME_IS_BIOS_ROOT)
+GAME(2005, hotd4, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "House of the Dead 4 (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2005, vf5, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Virtua Fighter 5 (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2006, abclimax, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "After Burner Climax (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2006, letsgoju, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Let's Go Jungle (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2006, outr2sdx, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Outrun 2 SP SDX", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2006, psmash3, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Power Smash 3 / Virtua Tennis 3 (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2006, vtennis3, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Virtua Tennis 3 (Japan)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2007, initiad4, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Initial D4 (Rev D)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2007, initiad4c, initiad4, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Initial D4 (Rev C)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2007, segartv, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Sega Race-TV (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2008, hotdex, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "House of the Dead EX (Japan)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2008, rambo, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Rambo (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(2009, hummerxt, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Hummer Extreme", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
+GAME(200?, lbvbiosu, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "VBios updater", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND)
diff --git a/src/mame/mame.lst b/src/mame/mame.lst
index dbb309621c0..c160c4d3085 100644
--- a/src/mame/mame.lst
+++ b/src/mame/mame.lst
@@ -5102,7 +5102,20 @@ ecap // 1999.12 Emergency Call Ambulance - US proto or location test
// Sega Lindbergh games
lindbios
-
+hotd4
+vf5
+abclimax
+letsgoju
+outr2sdx
+psmash3
+vtennis3
+initiad4
+initiad4c
+segartv
+hotdex
+rambo
+hummerxt
+lbvbiosu
// Deniam games
// they run on Sega System 16 video hardware