summaryrefslogtreecommitdiffstatshomepage
path: root/src/mame/machine/nb1412m2.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'src/mame/machine/nb1412m2.cpp')
-rw-r--r--src/mame/machine/nb1412m2.cpp186
1 files changed, 141 insertions, 45 deletions
diff --git a/src/mame/machine/nb1412m2.cpp b/src/mame/machine/nb1412m2.cpp
index 3e1c3ba3c84..dffe8990e7e 100644
--- a/src/mame/machine/nb1412m2.cpp
+++ b/src/mame/machine/nb1412m2.cpp
@@ -7,51 +7,69 @@ Nichibutsu 1412M2 device emulation
Written by Angelo Salese
Fancy data decrypter + timer + ?
-Most creative usage is hooked up in Mighty Guy sound CPU,
-other games just uses it as a much simpler protection chip providing code
+Most creative usage is hooked up in Mighty Guy sound CPU,
+other games just uses it as a much simpler protection chip providing code
snippets.
-It is unknown at current stage if inside the chip there's a MCU
+It is unknown at current stage if inside the chip there's a MCU
(with internal ROM).
TODO:
-- understand how Mighty Guy decrypts data (uses port adjuster in a
+- understand how Mighty Guy decrypts data (uses port adjuster in a
different way than the other games);
Legacy notes from drivers:
-- m_mAmazonProtReg[4] bit 0 used on hiscore data (clear on code),
- 0x29f vs 0x29e (not an offset?)
+- m_mAmazonProtReg[4] bit 0 used on hiscore data (clear on code),
+ 0x29f vs 0x29e (not an offset?)
- static const uint16_t mAmazonProtData[] =
{
- 0x0000,0x5000,0x5341,0x4b45,0x5349,0x4755,0x5245, <- default high scores (0x40db4) - wrong data ?
- 0x0000,0x4000,0x0e4b,0x4154,0x5544,0x4f4e,0x0e0e,
- 0x0000,0x3000,0x414e,0x4b41,0x4b45,0x5544,0x4f4e,
- 0x0000,0x2000,0x0e0e,0x4b49,0x5455,0x4e45,0x0e0e,
- 0x0000,0x1000,0x0e4b,0x414b,0x4553,0x4f42,0x410e,
-
- 0x4ef9,0x0000,0x62fa,0x0000,0x4ef9,0x0000,0x805E,0x0000, <- code (0x40d92)
- 0xc800 <- checksum
+ 0x0000,0x5000,0x5341,0x4b45,0x5349,0x4755,0x5245, <- default high scores (0x40db4) - wrong data ?
+ 0x0000,0x4000,0x0e4b,0x4154,0x5544,0x4f4e,0x0e0e,
+ 0x0000,0x3000,0x414e,0x4b41,0x4b45,0x5544,0x4f4e,
+ 0x0000,0x2000,0x0e0e,0x4b49,0x5455,0x4e45,0x0e0e,
+ 0x0000,0x1000,0x0e4b,0x414b,0x4553,0x4f42,0x410e,
+
+ 0x4ef9,0x0000,0x62fa,0x0000,0x4ef9,0x0000,0x805E,0x0000, <- code (0x40d92)
+ 0xc800 <- checksum
};
- static const uint16_t mAmatelasProtData[] =
{
- 0x0000,0x5000,0x5341,0x4b45,0x5349,0x4755,0x5245, <- default high scores (0x40db4)
- 0x0000,0x4000,0x0e4b,0x4154,0x5544,0x4f4e,0x0e0e,
- 0x0000,0x3000,0x414e,0x4b41,0x4b45,0x5544,0x4f4e,
- 0x0000,0x2000,0x0e0e,0x4b49,0x5455,0x4e45,0x0e0e,
- 0x0000,0x1000,0x0e4b,0x414b,0x4553,0x4f42,0x410e,
- 0x4ef9,0x0000,0x632e,0x0000,0x4ef9,0x0000,0x80C2,0x0000, <- code (0x40d92)
- 0x6100 <- checksum
+ 0x0000,0x5000,0x5341,0x4b45,0x5349,0x4755,0x5245, <- default high scores (0x40db4)
+ 0x0000,0x4000,0x0e4b,0x4154,0x5544,0x4f4e,0x0e0e,
+ 0x0000,0x3000,0x414e,0x4b41,0x4b45,0x5544,0x4f4e,
+ 0x0000,0x2000,0x0e0e,0x4b49,0x5455,0x4e45,0x0e0e,
+ 0x0000,0x1000,0x0e4b,0x414b,0x4553,0x4f42,0x410e,
+ 0x4ef9,0x0000,0x632e,0x0000,0x4ef9,0x0000,0x80C2,0x0000, <- code (0x40d92)
+ 0x6100 <- checksum
};
- static const uint16_t mHoreKidProtData[] =
{
- 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000, <- N/A
- 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,
- 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,
- 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,
- 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,
- 0x4e75,0x4e75,0x4e75,0x4e75,0x4e75,0x4e75,0x4e75,0x4e75, <- code (0x40dba) It actually never jumps there?
- 0x1800 <- checksum
+ 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000, <- N/A
+ 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,
+ 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,
+ 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,
+ 0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,
+ 0x4e75,0x4e75,0x4e75,0x4e75,0x4e75,0x4e75,0x4e75,0x4e75, <- code (0x40dba) It actually never jumps there?
+ 0x1800 <- checksum
};
+- mightguy:
+ * sound "protection" uses address/data to ports 2/3 (R/W)
+ * Register map:
+ * 0x32: always 5, rom read trigger?
+ * 0x33: - address 1 (source?)
+ * 0x34: /
+ * 0x35: - address 2 (adjust value in rom?)
+ * 0x36: /
+ * 0x37: R reused for ym3526 register set, read protection rom (same as amatelas)
+ *
+ * 0x40: counter set, always 1?
+ * 0x41: R bit 0 pulse timer? W oneshot timer?
+ * 0x42: counter set, always 3?
+ * 0x43: counter set, always 3?
+ *
+ * 0x92: data in/out (for dac?)
+ * 0x94: test register? (W 0xaa, checks if R 0xaa)
+
***************************************************************************/
#include "emu.h"
@@ -71,16 +89,43 @@ DEFINE_DEVICE_TYPE(NB1412M2, nb1412m2_device, "nb1412m2", "NB1412M2 Mahjong Cust
// LIVE DEVICE
//**************************************************************************
+void nb1412m2_device::nb1412m2_map(address_map &map)
+{
+ map(0x32, 0x32).w(this,FUNC(nb1412m2_device::rom_op_w));
+ map(0x33, 0x34).w(this,FUNC(nb1412m2_device::rom_address_w));
+ map(0x35, 0x36).w(this,FUNC(nb1412m2_device::rom_adjust_w));
+ map(0x37, 0x37).r(this,FUNC(nb1412m2_device::rom_decrypt_r));
+
+ map(0x40, 0x40).nopw();
+ map(0x41, 0x41).r(this,FUNC(nb1412m2_device::timer_r)).nopw();
+ map(0x42, 0x43).nopw();
+
+ map(0x92, 0x92).ram(); // latch?
+ map(0x94, 0x94).rw(this,FUNC(nb1412m2_device::xor_r),FUNC(nb1412m2_device::xor_w));
+
+ // 16-bit registers (1=upper), more latches?
+ map(0xa0, 0xa1).ram();
+ map(0xa2, 0xa3).ram();
+}
+
//-------------------------------------------------
// nb1412m2_device - constructor
//-------------------------------------------------
nb1412m2_device::nb1412m2_device(const machine_config &mconfig, const char *tag, device_t *owner, uint32_t clock)
: device_t(mconfig, NB1412M2, tag, owner, clock)
+ , device_memory_interface(mconfig, *this)
+ , m_space_config("regs", ENDIANNESS_LITTLE, 8, 8, 0, address_map_constructor(), address_map_constructor(FUNC(nb1412m2_device::nb1412m2_map), this))
, m_data(*this, DEVICE_SELF)
{
}
+device_memory_interface::space_config_vector nb1412m2_device::memory_space_config() const
+{
+ return space_config_vector {
+ std::make_pair(0, &m_space_config)
+ };
+}
//-------------------------------------------------
// device_start - device-specific startup
@@ -90,6 +135,9 @@ void nb1412m2_device::device_start()
{
save_item(NAME(m_command));
save_item(NAME(m_rom_address));
+ save_item(NAME(m_adj_address));
+ save_item(NAME(m_rom_op));
+ save_item(NAME(m_xor));
}
@@ -101,6 +149,9 @@ void nb1412m2_device::device_reset()
{
m_command = 0xff;
m_rom_address = 0;
+ m_adj_address = 0;
+ m_rom_op = 0;
+ m_xor = 0;
}
@@ -108,32 +159,77 @@ void nb1412m2_device::device_reset()
// READ/WRITE HANDLERS
//**************************************************************************
-READ8_MEMBER( nb1412m2_device::data_r )
+WRITE8_MEMBER( nb1412m2_device::rom_op_w )
+{
+ m_rom_op = data;
+}
+
+WRITE8_MEMBER( nb1412m2_device::rom_address_w )
{
- if(m_command == 0x37) // readback from ROM data
+ if(offset == 0) // rom hi address
+ {
+ m_rom_address &= 0x00ff;
+ m_rom_address |= data << 8;
+ }
+ else // rom lo address
{
- // TODO: provided by commands 0x35 & 0x36 (maybe 0x32 too)
- uint8_t prot_adj = 0x44;
+ m_rom_address &= 0xff00;
+ m_rom_address |= data;
+ }
+}
- return m_data[m_rom_address & 0x1fff] - prot_adj;
+WRITE8_MEMBER( nb1412m2_device::rom_adjust_w )
+{
+ if(offset == 0) // rom hi address
+ {
+ m_adj_address &= 0x00ff;
+ m_adj_address |= data << 8;
+ }
+ else // rom lo address
+ {
+ m_adj_address &= 0xff00;
+ m_adj_address |= data;
}
+}
+
+// readback from ROM data
+READ8_MEMBER( nb1412m2_device::rom_decrypt_r )
+{
+ // TODO: provided by commands 0x35 & 0x36 (maybe 0x32 too)
+ uint8_t prot_adj = m_data[m_adj_address] == 0xff ? 0x44 : 0x82;
+
+// printf("%02x %04x %02x\n",m_data[m_adj_address],m_adj_address,m_rom_op);
+
+ return m_data[m_rom_address & 0x1fff] - prot_adj;
+}
+
+// Mighty Guy specifics
+READ8_MEMBER( nb1412m2_device::timer_r )
+{
+// return (this->clock().cycles() / 0x34) & 1; // wrong
+ return machine().rand() & 1;
+}
+
+WRITE8_MEMBER( nb1412m2_device::xor_w )
+{
+ m_xor = data ^ m_xor;
+}
- return 0;
+READ8_MEMBER( nb1412m2_device::xor_r )
+{
+ // write 0xaa, reads back if register is equal to 0xaa (xor reg?)
+ return m_xor;
+}
+
+// public accessors
+READ8_MEMBER( nb1412m2_device::data_r )
+{
+ return this->space().read_byte(m_command);
}
WRITE8_MEMBER( nb1412m2_device::data_w )
{
- switch(m_command)
- {
- case 0x33: // rom hi
- m_rom_address &= 0x00ff;
- m_rom_address |= data << 8;
- break;
- case 0x34: // rom lo
- m_rom_address &= 0xff00;
- m_rom_address |= data;
- break;
- }
+ this->space().write_byte(m_command, data);
}
WRITE8_MEMBER( nb1412m2_device::command_w )