diff options
Diffstat (limited to 'src/mame/drivers/model2.c')
-rw-r--r-- | src/mame/drivers/model2.c | 133 |
1 files changed, 101 insertions, 32 deletions
diff --git a/src/mame/drivers/model2.c b/src/mame/drivers/model2.c index 6b27d971af5..95f4c9e5baa 100644 --- a/src/mame/drivers/model2.c +++ b/src/mame/drivers/model2.c @@ -1234,10 +1234,6 @@ static const UINT8 ZGUNProt[] = 0xE4,0x66,0xD0,0x4A,0x7D,0x4A,0x13,0xDE,0xD7,0x9F,0x38,0xAA,0x00,0x56,0x85,0x0A }; -static const UINT8 DCOPKey1326[]= -{ - 0x43,0x66,0x54,0x11,0x99,0xfe,0xcc,0x8e,0xdd,0x87,0x11,0x89,0x22,0xdf,0x44,0x09 -}; READ32_MEMBER(model2_state::model2_prot_r) { @@ -1250,23 +1246,10 @@ READ32_MEMBER(model2_state::model2_prot_r) } else if (offset == 0x1000e/4) { - retval = m_protram[m_protstate+1] | m_protram[m_protstate]<<8; + retval = m_protram[m_protstate+1] | m_protram[m_protstate+0]<<8; retval <<= 16; m_protstate+=2; } - else if (offset == 0x7ff8/4) - { - retval = m_protram[m_protstate+1] | m_protram[m_protstate]<<8; - m_protstate+=2; - } - else if (offset == 0x400c/4) - { - m_prot_a = !m_prot_a; - if (m_prot_a) - retval = 0xffff; - else - retval = 0xfff0; - } else logerror("Unhandled Protection READ @ %x mask %x (PC=%x)\n", offset, mem_mask, space.device().safe_pc()); printf("model2_prot_r %08x: %08x (%08x)\n", offset*4, retval, mem_mask); @@ -1291,17 +1274,6 @@ WRITE32_MEMBER(model2_state::model2_prot_w) { switch (data) { - // dynamcop - case 0x7700: - strcpy((char *)m_protram+2, "UCHIDA MOMOKA "); - break; - - // dynamcop - case 0x1326: - m_protstate = 0; - memcpy(m_protram+2, DCOPKey1326, sizeof(DCOPKey1326)); - break; - // zerogun case 0xA1BC: case 0xAD23: @@ -1337,6 +1309,91 @@ WRITE32_MEMBER(model2_state::model2_prot_w) } + +READ32_MEMBER(model2_state::model2_5881prot_r) +{ + UINT32 retval = 0; + + if (offset == 0x0000/4) + { + // status: bit 0 = 1 for busy, 0 for ready + retval = 0; // we're always ready + } + else if (offset == 0x000e/4) + { + if (first_read == 1) + { + // is there a CPU core bug or similar? + // the only way to return the same stream as the previous simulation (for dynamite cop) is to return a + // 0x0000 as the first return value before returning the actual sequence. + // note that even with our simulation code pilot kids crashes in the way it would if the protection failed, so something seems wrong. + first_read = 0; + retval = 0; + } + else + { + UINT8* base; + retval = m_cryptdevice->do_decrypt(base); + retval = ((retval & 0xff00) >> 8) | ((retval & 0x00ff) << 8); + retval <<= 16; + } + } + else logerror("Unhandled Protection READ @ %x mask %x (PC=%x)\n", offset, mem_mask, space.device().safe_pc()); + + logerror("model2_5881prot_r %08x: %08x (%08x)\n", offset*4, retval, mem_mask); + + return retval; +} + +WRITE32_MEMBER(model2_state::model2_5881prot_w) +{ + logerror("model2_5881prot_w %08x: %08x (%08x)\n", offset*4, data, mem_mask); + + + if (offset == 0x0008/4) + { + // code is copied to RAM first, so base address is always 0 + m_cryptdevice->set_addr_low(0); + m_cryptdevice->set_addr_high(0); + + if (data != 0) + printf("model2_5881prot_w address isn't 0?\n"); + + first_read = 1; + } + else if (offset == 0x000c/4) + { + printf("subkey %08x (%08x)\n", data, mem_mask); + m_cryptdevice->set_subkey(data&0xffff); + } + else printf("Unhandled Protection WRITE %x @ %x mask %x (PC=%x)\n", data, offset, mem_mask, space.device().safe_pc()); + +} + + +READ32_MEMBER(model2_state::doa_prot_r) +{ + UINT32 retval = 0; + + if (offset == 0x7ff8/4) + { + retval = m_protram[m_protstate+1] | m_protram[m_protstate]<<8; + m_protstate+=2; + } + else if (offset == 0x400c/4) + { + m_prot_a = !m_prot_a; + if (m_prot_a) + retval = 0xffff; + else + retval = 0xfff0; + } + else logerror("Unhandled Protection READ @ %x mask %x (PC=%x)\n", offset, mem_mask, space.device().safe_pc()); + + return retval; +} + + WRITE32_MEMBER(model2_state::doa_prot_w) { if (offset == 0x7ff2 / 4) @@ -5911,8 +5968,20 @@ ROM_END DRIVER_INIT_MEMBER(model2_state,genprot) { - m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x01d80000, 0x01dfffff, read32_delegate(FUNC(model2_state::model2_prot_r),this), write32_delegate(FUNC(model2_state::model2_prot_w),this)); - m_protstate = m_protpos = 0; + + INT64 key = get_315_5881_key(machine()); + + if (key != -1) + { + m_maincpu->space(AS_PROGRAM).install_ram(0x01d80000, 0x01d8ffff); + m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x01d90000, 0x01d9ffff, read32_delegate(FUNC(model2_state::model2_5881prot_r), this), write32_delegate(FUNC(model2_state::model2_5881prot_w), this)); + m_cryptdevice->set_key(key); + } + else + { + m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x01d80000, 0x01dfffff, read32_delegate(FUNC(model2_state::model2_prot_r), this), write32_delegate(FUNC(model2_state::model2_prot_w), this)); + m_protstate = m_protpos = 0; + } } DRIVER_INIT_MEMBER(model2_state,pltkids) @@ -5983,7 +6052,7 @@ DRIVER_INIT_MEMBER(model2_state,overrev) DRIVER_INIT_MEMBER(model2_state,doa) { - m_maincpu->space(AS_PROGRAM).install_write_handler(0x01d80000, 0x01dfffff, write32_delegate(FUNC(model2_state::doa_prot_w),this)); + m_maincpu->space(AS_PROGRAM).install_readwrite_handler(0x01d80000, 0x01dfffff, read32_delegate(FUNC(model2_state::doa_prot_r),this), write32_delegate(FUNC(model2_state::doa_prot_w),this)); m_protstate = m_protpos = 0; |