From d64195a2d0c7e07f128424a6a679609153ac08e8 Mon Sep 17 00:00:00 2001 From: smf- Date: Sat, 24 Dec 2016 16:20:07 +0000 Subject: * New games added --------------- Eeekk! [Andrew Welburn, Craig Anstett, smf] Dumped PAL10H8 for Beastie Feastie (conversion kit) [Andrew Welburn, Craig Anstett] EPOS decryption simplification WIP [smf] --- scripts/target/mame/arcade.lua | 6 +- src/mame/drivers/pacman.cpp | 88 ++++++++++++-- src/mame/includes/pacman.h | 21 +--- src/mame/machine/acitya.cpp | 204 -------------------------------- src/mame/machine/acitya.h | 2 - src/mame/machine/epos.cpp | 215 ++++++++++++++++++++++++++++++++++ src/mame/machine/epos.h | 2 + src/mame/machine/theglobp.cpp | 258 ----------------------------------------- src/mame/machine/theglobp.h | 2 - src/mame/mame.lst | 1 + 10 files changed, 303 insertions(+), 496 deletions(-) delete mode 100644 src/mame/machine/acitya.cpp delete mode 100644 src/mame/machine/acitya.h create mode 100644 src/mame/machine/epos.cpp create mode 100644 src/mame/machine/epos.h delete mode 100644 src/mame/machine/theglobp.cpp delete mode 100644 src/mame/machine/theglobp.h diff --git a/scripts/target/mame/arcade.lua b/scripts/target/mame/arcade.lua index 65200a0029f..4b7fff2c2a8 100644 --- a/scripts/target/mame/arcade.lua +++ b/scripts/target/mame/arcade.lua @@ -2935,14 +2935,12 @@ files { MAME_DIR .. "src/mame/drivers/pacman.cpp", MAME_DIR .. "src/mame/includes/pacman.h", MAME_DIR .. "src/mame/video/pacman.cpp", - MAME_DIR .. "src/mame/machine/acitya.cpp", - MAME_DIR .. "src/mame/machine/acitya.h", + MAME_DIR .. "src/mame/machine/epos.cpp", + MAME_DIR .. "src/mame/machine/epos.h", MAME_DIR .. "src/mame/machine/jumpshot.cpp", MAME_DIR .. "src/mame/machine/jumpshot.h", MAME_DIR .. "src/mame/machine/pacplus.cpp", MAME_DIR .. "src/mame/machine/pacplus.h", - MAME_DIR .. "src/mame/machine/theglobp.cpp", - MAME_DIR .. "src/mame/machine/theglobp.h", MAME_DIR .. "src/mame/drivers/pengo.cpp", } diff --git a/src/mame/drivers/pacman.cpp b/src/mame/drivers/pacman.cpp index 7f3c2a4ae2f..4a7e0518c55 100644 --- a/src/mame/drivers/pacman.cpp +++ b/src/mame/drivers/pacman.cpp @@ -345,10 +345,9 @@ Boards: #include "machine/watchdog.h" #include "sound/ay8910.h" #include "sound/sn76496.h" -#include "machine/acitya.h" +#include "machine/epos.h" #include "machine/jumpshot.h" #include "machine/pacplus.h" -#include "machine/theglobp.h" /************************************* @@ -1428,13 +1427,8 @@ static ADDRESS_MAP_START( nmouse_portmap, AS_IO, 8, pacman_state ) AM_RANGE(0x00, 0x00) AM_WRITE(nmouse_interrupt_vector_w) ADDRESS_MAP_END -static ADDRESS_MAP_START( theglobp_portmap, AS_IO, 8, pacman_state ) - AM_RANGE(0x00, 0xff) AM_READ(theglobp_decrypt_rom) /* Switch protection logic */ - AM_IMPORT_FROM(writeport) -ADDRESS_MAP_END - -static ADDRESS_MAP_START( acitya_portmap, AS_IO, 8, pacman_state ) - AM_RANGE(0x00, 0xff) AM_READ(acitya_decrypt_rom) /* Switch protection logic */ +static ADDRESS_MAP_START( epos_portmap, AS_IO, 8, pacman_state ) + AM_RANGE(0x00, 0xff) AM_READ(epos_decryption_w) /* Switch protection logic */ AM_IMPORT_FROM(writeport) ADDRESS_MAP_END @@ -2376,6 +2370,39 @@ static INPUT_PORTS_START( theglobp ) INPUT_PORTS_END +static INPUT_PORTS_START( eeekk ) + PORT_INCLUDE(pacman) + PORT_MODIFY("IN0") + PORT_SERVICE_NO_TOGGLE( 0x10, 0x10 ) + PORT_BIT( 0x40, IP_ACTIVE_LOW, IPT_UNKNOWN ) + PORT_BIT( 0x80, IP_ACTIVE_LOW, IPT_BUTTON1 ) PORT_PLAYER(2) + + PORT_MODIFY("IN1") + PORT_BIT( 0x10, IP_ACTIVE_LOW, IPT_UNKNOWN ) + PORT_BIT( 0x40, IP_ACTIVE_LOW, IPT_BUTTON1 ) PORT_PLAYER(1) + + PORT_MODIFY("DSW1") + PORT_DIPNAME( 0x03, 0x03, DEF_STR(Lives) ) PORT_DIPLOCATION("SW:1,2") + PORT_DIPSETTING( 0x03, "3" ) + PORT_DIPSETTING( 0x02, "4" ) + PORT_DIPSETTING( 0x01, "5" ) + PORT_DIPSETTING( 0x00, "6" ) + PORT_DIPNAME( 0x1c, 0x10, DEF_STR( Difficulty ) ) PORT_DIPLOCATION("SW:3,4,5") + PORT_DIPSETTING( 0x00, "8" ) + PORT_DIPSETTING( 0x04, "7" ) + PORT_DIPSETTING( 0x08, "6" ) + PORT_DIPSETTING( 0x0c, "5" ) + PORT_DIPSETTING( 0x10, "4" ) + PORT_DIPSETTING( 0x14, "3" ) + PORT_DIPSETTING( 0x18, "2" ) + PORT_DIPSETTING( 0x1c, "1" ) + PORT_DIPNAME( 0x20, 0x00, DEF_STR(Demo_Sounds) ) PORT_DIPLOCATION("SW:6") + PORT_DIPSETTING( 0x00, DEF_STR(On) ) + PORT_DIPSETTING( 0x20, DEF_STR(Off) ) + PORT_BIT( 0x40, IP_ACTIVE_LOW, IPT_UNKNOWN ) + PORT_BIT( 0x80, IP_ACTIVE_LOW, IPT_UNKNOWN ) +INPUT_PORTS_END + static INPUT_PORTS_START( vanvan ) PORT_START("IN0") PORT_BIT( 0x01, IP_ACTIVE_LOW, IPT_JOYSTICK_UP ) PORT_4WAY @@ -3651,7 +3678,7 @@ static MACHINE_CONFIG_DERIVED( theglobp, pacman ) /* basic machine hardware */ MCFG_CPU_MODIFY("maincpu") MCFG_CPU_PROGRAM_MAP(epos_map) - MCFG_CPU_IO_MAP(theglobp_portmap) + MCFG_CPU_IO_MAP(epos_portmap) MCFG_MACHINE_START_OVERRIDE(pacman_state,theglobp) MCFG_MACHINE_RESET_OVERRIDE(pacman_state,theglobp) @@ -3663,13 +3690,25 @@ static MACHINE_CONFIG_DERIVED( acitya, pacman ) /* basic machine hardware */ MCFG_CPU_MODIFY("maincpu") MCFG_CPU_PROGRAM_MAP(epos_map) - MCFG_CPU_IO_MAP(acitya_portmap) + MCFG_CPU_IO_MAP(epos_portmap) MCFG_MACHINE_START_OVERRIDE(pacman_state,acitya) MCFG_MACHINE_RESET_OVERRIDE(pacman_state,acitya) MACHINE_CONFIG_END +static MACHINE_CONFIG_DERIVED( eeekk, pacman ) + + /* basic machine hardware */ + MCFG_CPU_MODIFY("maincpu") + MCFG_CPU_PROGRAM_MAP(epos_map) + MCFG_CPU_IO_MAP(epos_portmap) + + MCFG_MACHINE_START_OVERRIDE(pacman_state,eeekk) + MCFG_MACHINE_RESET_OVERRIDE(pacman_state,eeekk) +MACHINE_CONFIG_END + + static MACHINE_CONFIG_DERIVED( vanvan, pacman ) /* basic machine hardware */ @@ -6029,6 +6068,9 @@ ROM_START( beastfp ) ROM_LOAD( "beastf.5e", 0x0000, 0x1000, CRC(5654dc34) SHA1(fc2336b951a3ab48d4fc4f36a8dd80e79e8ca1a0) ) ROM_LOAD( "beastf.5f", 0x1000, 0x1000, CRC(1b30ca61) SHA1(8495d8a280346246f00c4f1dc42ab5a2a02c5863) ) + ROM_REGION( 0x002c, "epos_pal10h8", 0) + ROM_LOAD( "beastf.ic4", 0x0000, 0x002c, CRC(a6ab926d) SHA1(a8c2ddce2d595cecf057b37916f2f897de8a0e4e) ) // pal10h8 + ROM_REGION( 0x0120, "proms", 0 ) ROM_LOAD( "glob.7f", 0x0000, 0x0020, CRC(1f617527) SHA1(448845cab63800a05fcb106897503d994377f78f) ) ROM_LOAD( "glob.4a", 0x0020, 0x0100, CRC(28faa769) SHA1(7588889f3102d4e0ca7918f536556209b2490ea1) ) @@ -6039,6 +6081,29 @@ ROM_START( beastfp ) ROM_END + +ROM_START( eeekk ) + ROM_REGION( 0x20000, "maincpu", 0 ) + ROM_LOAD( "pg03094.u2", 0x0000, 0x2000, CRC(701e37f2) SHA1(15bbd983e9112ce15dd229f126f2bccfa8b9807c) ) + ROM_LOAD( "pg03094.u3", 0x2000, 0x2000, CRC(bcf524ae) SHA1(be2a1a2984ea1439c63d8c353e4ae85bf42c8a55) ) + + ROM_REGION( 0x2000, "gfx1", 0 ) + ROM_LOAD( "pg03094.5e", 0x0000, 0x1000, CRC(780183a8) SHA1(8466d75d79b3c87db143f5c2e8b58dad1d2e501c) ) + ROM_LOAD( "pg03094.5f", 0x1000, 0x1000, CRC(418526e4) SHA1(a95764e216ccdaca0631604e1101ba91884effde) ) + + ROM_REGION( 0x002c, "epos_pal10h8", 0) + ROM_LOAD( "eeekk.ic4", 0x0000, 0x002c, CRC(f588ba4e) SHA1(07d74da02172789ccd1fead2b5afe8ce72c5149d) ) // pal10h8 + + ROM_REGION( 0x0120, "proms", 0 ) + ROM_LOAD( "eeekk.7f", 0x0000, 0x0020, CRC(c64c8a53) SHA1(55e7b88cb1ce129e8154722a489d76c38924d3f1) ) // 82s123 + ROM_LOAD( "eeekk.4a", 0x0020, 0x0100, CRC(a5044ded) SHA1(566bd06674bf8069dc633102493c9991b64e4379) ) // 82s126 + + ROM_REGION( 0x0200, "namco", 0 ) /* sound PROMs */ + ROM_LOAD( "82s126.1m", 0x0000, 0x0100, CRC(a9cc86bf) SHA1(bbcec0570aeceb582ff8238a4bc8546a23430081) ) // 82s126 + ROM_LOAD( "82s126.3m", 0x0100, 0x0100, CRC(77245b66) SHA1(0c4d0bee858b97632411c440bea6948a74759746) ) // 82s126 - timing - not used +ROM_END + + ROM_START( vanvan ) ROM_REGION( 0x10000, "maincpu", 0 ) ROM_LOAD( "van-1.50", 0x0000, 0x1000, CRC(cf1b2df0) SHA1(938b4434c0129cf9151f829901d00e47dca68956) ) @@ -7284,6 +7349,7 @@ GAME( 1983, theglobp, suprglob, theglobp, theglobp, driver_device, 0, ROT GAME( 1983, sprglobp, suprglob, theglobp, theglobp, driver_device, 0, ROT90, "Epos Corporation", "Super Glob (Pac-Man hardware)", MACHINE_SUPPORTS_SAVE ) GAME( 1983, sprglbpg, suprglob, pacman, theglobp, driver_device, 0, ROT90, "bootleg", "Super Glob (Pac-Man hardware) (German bootleg)", MACHINE_SUPPORTS_SAVE ) GAME( 1984, beastfp, suprglob, theglobp, theglobp, driver_device, 0, ROT90, "Epos Corporation", "Beastie Feastie (conversion kit)", MACHINE_SUPPORTS_SAVE ) +GAME( 1984, eeekk, 0, eeekk, eeekk, driver_device, 0, ROT90, "Epos Corporation", "Eeekk!", MACHINE_SUPPORTS_SAVE ) GAME( 1984, drivfrcp, 0, drivfrcp, drivfrcp, pacman_state, drivfrcp, ROT90, "Shinkai Inc. (Magic Electronics Inc. license)", "Driving Force (Pac-Man conversion)", MACHINE_SUPPORTS_SAVE ) diff --git a/src/mame/includes/pacman.h b/src/mame/includes/pacman.h index e9e15c4b938..cbfe2da6948 100644 --- a/src/mame/includes/pacman.h +++ b/src/mame/includes/pacman.h @@ -155,14 +155,14 @@ public: void eyes_decode(uint8_t *data); void mspacman_install_patches(uint8_t *ROM); - // theglopb.c - void theglobp_decrypt_rom_8(); - void theglobp_decrypt_rom_9(); - void theglobp_decrypt_rom_A(); - void theglobp_decrypt_rom_B(); - DECLARE_READ8_MEMBER(theglobp_decrypt_rom); + // epos.c + DECLARE_READ8_MEMBER(epos_decryption_w); DECLARE_MACHINE_START(theglobp); DECLARE_MACHINE_RESET(theglobp); + DECLARE_MACHINE_START(eeekk); + DECLARE_MACHINE_RESET(eeekk); + DECLARE_MACHINE_START(acitya); + DECLARE_MACHINE_RESET(acitya); // pacplus.c uint8_t pacplus_decrypt(int addr, uint8_t e); @@ -171,13 +171,4 @@ public: // jumpshot.c uint8_t jumpshot_decrypt(int addr, uint8_t e); void jumpshot_decode(); - - // acitya.c - void acitya_decrypt_rom_8(); - void acitya_decrypt_rom_9(); - void acitya_decrypt_rom_A(); - void acitya_decrypt_rom_B(); - DECLARE_READ8_MEMBER(acitya_decrypt_rom); - DECLARE_MACHINE_START(acitya); - DECLARE_MACHINE_RESET(acitya); }; diff --git a/src/mame/machine/acitya.cpp b/src/mame/machine/acitya.cpp deleted file mode 100644 index 68b7aec03e8..00000000000 --- a/src/mame/machine/acitya.cpp +++ /dev/null @@ -1,204 +0,0 @@ -// license:BSD-3-Clause -// copyright-holders:David Widel -/*************************************************************************** - - machine.c - -Same Epos board as usual(theglobp,beastf,street heat), see theglobp.c for hardware documentation. This is fairly easy to decrypt since it has consecutive bytes with the same algorithym. There are 4 different algorithyms. One consists almost entirely of text, one contains the majority of code and the remaining 2 are not used much and are therefore the most difficult. It is however difficult to decrypt to rom. The data for the coin sound is actually program code in a different phase. You need to move the sound tables and add a rom to get it to run without the daughterboard. - -acitya contains a bug with the insurance in blackjack. It's impossible to collect, so it's likely that acitya is earlier than bwcasino. - -I don't think this game is a gambling game. For one thing there's no real output hardware on a pacman board and the epos daughterboard doesn't contain any either. - -David Widel d_widel@hotmail.com - -***************************************************************************/ - -#include "emu.h" -#include "includes/pacman.h" - - -void pacman_state::acitya_decrypt_rom_8() -{ - int oldbyte,inverted_oldbyte,newbyte; - int mem; - uint8_t *RAM; - - RAM = memregion("maincpu")->base(); - - - for (mem=0;mem<0x4000;mem++) - { - oldbyte = RAM[mem]; - inverted_oldbyte = ~oldbyte; - - /* Note: D2 is inverted and connected to D1, D5 is inverted and - connected to D0. The other six data bits are converted by a - PAL10H8 driven by the counter. */ - - /* Direct inversion */ - newbyte = (inverted_oldbyte & 0x80) >> 2; - newbyte |= (oldbyte & 0x40) >> 0; - newbyte |= (inverted_oldbyte & 0x20) >> 5; - newbyte |= (inverted_oldbyte & 0x10) >> 1; - newbyte |= (oldbyte & 0x08) << 1; - newbyte |= (inverted_oldbyte & 0x04) >> 1; - newbyte |= (oldbyte & 0x02) << 6; - newbyte |= (inverted_oldbyte & 0x01) << 2; - - RAM[mem + 0x10000] = newbyte; - } - - return; -} - - -void pacman_state::acitya_decrypt_rom_9() -{ - int oldbyte,inverted_oldbyte,newbyte; - int mem; - uint8_t *RAM; - - RAM = memregion("maincpu")->base(); - - for (mem=0;mem<0x4000;mem++) - { - oldbyte = RAM[mem]; - inverted_oldbyte = ~oldbyte; - - /* Note: D2 is inverted and connected to D1, D5 is inverted and - connected to D0. The other six data bits are converted by a - PAL10H8 driven by the counter. */ - - /* Direct inversion */ - newbyte = (inverted_oldbyte & 0x80) >> 0; - newbyte |= (oldbyte & 0x40) >> 0; - newbyte |= (inverted_oldbyte & 0x20) >> 5; - newbyte |= (oldbyte & 0x10) >> 1; - newbyte |= (oldbyte & 0x08) << 1; - newbyte |= (inverted_oldbyte & 0x04) >> 1; - newbyte |= (inverted_oldbyte & 0x02) << 4; - newbyte |= (inverted_oldbyte & 0x01) << 2; - RAM[mem + 0x14000] = newbyte; - } - - return; -} - -void pacman_state::acitya_decrypt_rom_A() -{ - int oldbyte,inverted_oldbyte,newbyte; - int mem; - uint8_t *RAM; - - RAM = memregion("maincpu")->base(); - - for (mem=0;mem<0x4000;mem++) - { - oldbyte = RAM[mem]; - inverted_oldbyte = ~oldbyte; - - /* Note: D2 is inverted and connected to D1, D5 is inverted and - connected to D0. The other six data bits are converted by a - PAL10H8 driven by the counter. */ - - newbyte = (inverted_oldbyte & 0x80) >> 2; - newbyte |= (inverted_oldbyte & 0x40) >> 2; - newbyte |= (inverted_oldbyte & 0x20) >> 5; - newbyte |= (inverted_oldbyte & 0x10) >> 1; - - newbyte |= (inverted_oldbyte & 0x08) >> 1; - newbyte |= (inverted_oldbyte & 0x04) >> 1; - newbyte |= (oldbyte & 0x02) << 6; - newbyte |= (oldbyte & 0x01) << 6; - RAM[mem + 0x18000] = newbyte; - } - - return; -} - -void pacman_state::acitya_decrypt_rom_B() -{ - int oldbyte,inverted_oldbyte,newbyte; - int mem; - uint8_t *RAM; - - RAM = memregion("maincpu")->base(); - - for (mem=0;mem<0x4000;mem++) - { - oldbyte = RAM[mem]; - inverted_oldbyte = ~oldbyte; - - /* Note: D2 is inverted and connected to D1, D5 is inverted and - connected to D0. The other six data bits are converted by a - PAL10H8 driven by the counter. */ - - /* Direct inversion */ - newbyte = (inverted_oldbyte & 0x80) >> 0; - newbyte |= (inverted_oldbyte & 0x40) >> 2; - newbyte |= (inverted_oldbyte & 0x20) >> 5; - newbyte |= (oldbyte & 0x10) >> 1; - newbyte |= (inverted_oldbyte & 0x08) >> 1; - newbyte |= (inverted_oldbyte & 0x04) >> 1; - newbyte |= (inverted_oldbyte & 0x02) << 4; - newbyte |= (oldbyte & 0x01) << 6; - - - RAM[mem + 0x1C000] = newbyte; - } - - return; -} - - -READ8_MEMBER(pacman_state::acitya_decrypt_rom ) -{ - if (offset & 0x01) - { - m_counter = (m_counter - 1) & 0x0F; - } - else - { - m_counter = (m_counter + 1) & 0x0F; - } - - switch(m_counter) - { - case 0x08: membank ("bank1")->set_entry (0); break; - case 0x09: membank ("bank1")->set_entry (1); break; - case 0x0A: membank ("bank1")->set_entry (2); break; - case 0x0B: membank ("bank1")->set_entry (3); break; - default: - logerror("Invalid counter = %02X\n",m_counter); - break; - } - - return 0; -} - - -MACHINE_START_MEMBER(pacman_state,acitya) -{ - uint8_t *RAM = memregion("maincpu")->base(); - - /* While the PAL supports up to 16 decryption methods, only four - are actually used in the PAL. Therefore, we'll take a little - memory overhead and decrypt the ROMs using each method in advance. */ - acitya_decrypt_rom_8(); - acitya_decrypt_rom_9(); - acitya_decrypt_rom_A(); - acitya_decrypt_rom_B(); - - membank("bank1")->configure_entries(0, 4, &RAM[0x10000], 0x4000); - - save_item(NAME(m_counter)); -} - - -MACHINE_RESET_MEMBER(pacman_state,acitya) -{ - /* The initial state of the counter is 0x0B */ - m_counter = 0x0B; - membank("bank1")->set_entry(3); -} diff --git a/src/mame/machine/acitya.h b/src/mame/machine/acitya.h deleted file mode 100644 index f15a7f4cd0e..00000000000 --- a/src/mame/machine/acitya.h +++ /dev/null @@ -1,2 +0,0 @@ -// license:BSD-3-Clause -// copyright-holders:David Widel diff --git a/src/mame/machine/epos.cpp b/src/mame/machine/epos.cpp new file mode 100644 index 00000000000..ba9dd48a3af --- /dev/null +++ b/src/mame/machine/epos.cpp @@ -0,0 +1,215 @@ +// license:BSD-3-Clause +// copyright-holders:smf, Mike Balfour, David Widel + +#include "emu.h" +#include "includes/pacman.h" + +READ8_MEMBER(pacman_state::epos_decryption_w) +{ + if (offset & 0x01) + { + m_counter = (m_counter - 1) & 0x0F; + } + else + { + m_counter = (m_counter + 1) & 0x0F; + } + + switch (m_counter) + { + case 0x08: + case 0x09: + case 0x0A: + case 0x0B: + membank("bank1")->set_entry(m_counter & 3); + break; + + default: + logerror("Invalid counter = %02X\n", m_counter); + break; + } + + return 0; +} + +static void epos_decrypt_rom(uint8_t *ROM, uint8_t invert, int offset, int *bs) +{ + for (int mem = 0; mem < 0x4000; mem++ ) + { + ROM[mem + offset] = BITSWAP8(ROM[mem] ^ invert, bs[0], bs[1], bs[2], bs[3], bs[4], bs[5], bs[6], bs[7]); + } +} + + +/* + +The Glob protection description: + +The Glob is designed to run on modified Pacman hardware. It contains +two graphics ROMs at 5E and 5F, but contains code ROMs on a daughterboard +similar in concept to Ms. Pacman. However, these code ROMs are decrypted +through additional circuitry. The daughterboard was encased in epoxy. + +Here's a description of the protection as best as I can give it. + +1) The decrypted D0 bit fed to the CPU is simply an inversion of the +D5 bit from the code ROMs. +2) The decrypted D1 bit fed to the CPU is simply an inversion of the +D2 bit from the code ROMs. +3) The other 6 data bits are decrypted by a 10H8 PAL. The PAL also +takes as input a 4-bit counter. The counter is incremented and +decremented as follows: +- the Z-80 command IN($xx) where xx is an odd number decrements the +counter; an even number increments the counter. +Ex: IN($64) would increment the counter, IN($6B) would decrement +the counter. +4) The PAL output also contains the two ROM enable lines used to enable +the two encrypted code ROMs. As long as the system is working +correctly, these ROMs will always be enabled. + +As it so happens, only four counter values are ever used, which is +fortunate because the PAL only contains signals to enable the ROMs for +those four counter values. The valid counter values are $8, $9, $A, and +$B. The counter's intial value is $A, which is set by jumpers on the +daughterboard. Following is a description of the resulting decryptions +for these four counter states. + +COUNTER ENCRYPTED DECRYPTED +VALUE VALUE + +DDDDDDDD DDDDDDDD +76543210 76543210 + +Counter = 8: abcdefgh EAhBDgFC +Counter = 9: abcdefgh FAgeDBFC +Counter = A: abcdefgh EHDBagFC +Counter = B: abcdefgh GHDEaBFC + +In the above diagram, capital letters represent inverted bits. Notice +that bits D2 and D5 are the same independent of counter state, this is +because these bits are not decrypted by the PAL. + + +In the code below, all four of these decryption patterns are used to +decrypt the entire code ROMs before execution. This is done for speed, +since we can then just bankswitch between the decrypted code sets on +each IN($xx) command, as opposed to dynamically decrypting every byte. + +- Mike Balfour (mab22@po.cwru.edu) + +*/ + +MACHINE_START_MEMBER(pacman_state, theglobp) +{ + /* Note: D2 is inverted and connected to D1, D5 is inverted and + connected to D0. The other six data bits are converted by a + PAL10H8 driven by the counter. */ + + int bs[4][8] = { + { 3,7,0,6,4,1,2,5 }, + { 1,7,0,3,4,6,2,5 }, + { 3,0,4,6,7,1,2,5 }, + { 1,0,4,3,7,6,2,5 }, + }; + + /* While the PAL supports up to 16 decryption methods, only four + are actually used in the PAL. Therefore, we'll take a little + memory overhead and decrypt the ROMs using each method in advance. */ + + uint8_t *ROM = memregion("maincpu")->base(); + epos_decrypt_rom(ROM, 0xfc, 0x10000, bs[0]); + epos_decrypt_rom(ROM, 0xf6, 0x14000, bs[1]); + epos_decrypt_rom(ROM, 0x7d, 0x18000, bs[2]); + epos_decrypt_rom(ROM, 0x77, 0x1c000, bs[3]); + + membank("bank1")->configure_entries(0, 4, &ROM[0x10000], 0x4000); + + save_item(NAME(m_counter)); +} + +MACHINE_RESET_MEMBER(pacman_state, theglobp) +{ + m_counter = 0x0A; + membank("bank1")->set_entry(m_counter & 3); +} + +/* + +Same Epos board as usual(theglobp,beastf,street heat). This is fairly easy to decrypt since it has consecutive bytes with the same algorithym. There are 4 different algorithyms. One consists almost entirely of text, one contains the majority of code and the remaining 2 are not used much and are therefore the most difficult. It is however difficult to decrypt to rom. The data for the coin sound is actually program code in a different phase. You need to move the sound tables and add a rom to get it to run without the daughterboard. + +acitya contains a bug with the insurance in blackjack. It's impossible to collect, so it's likely that acitya is earlier than bwcasino. + +I don't think this game is a gambling game. For one thing there's no real output hardware on a pacman board and the epos daughterboard doesn't contain any either. + +David Widel d_widel@hotmail.com + +*/ + +MACHINE_START_MEMBER(pacman_state, acitya) +{ + /* Note: D2 is inverted and connected to D1, D5 is inverted and + connected to D0. The other six data bits are converted by a + PAL10H8 driven by the counter. */ + + int bs[4][8] = { + { 1,6,7,3,4,0,2,5 }, + { 7,6,1,3,4,0,2,5 }, + { 1,0,7,6,4,3,2,5 }, + { 7,0,1,6,4,3,2,5 }, + }; + + /* While the PAL supports up to 16 decryption methods, only four + are actually used in the PAL. Therefore, we'll take a little + memory overhead and decrypt the ROMs using each method in advance. */ + + uint8_t *ROM = memregion("maincpu")->base(); + epos_decrypt_rom(ROM, 0xb5, 0x10000, bs[0]); + epos_decrypt_rom(ROM, 0xa7, 0x14000, bs[1]); + epos_decrypt_rom(ROM, 0xfc, 0x18000, bs[2]); + epos_decrypt_rom(ROM, 0xee, 0x1c000, bs[3]); + + membank("bank1")->configure_entries(0, 4, &ROM[0x10000], 0x4000); + + save_item(NAME(m_counter)); +} + +MACHINE_RESET_MEMBER(pacman_state, acitya) +{ + m_counter = 0x0B; + membank("bank1")->set_entry(m_counter & 3); +} + + +MACHINE_START_MEMBER(pacman_state, eeekk) +{ + /* Note: D2 is inverted and connected to D1, D5 is inverted and + connected to D0. The other six data bits are converted by a + PAL10H8 driven by the counter. */ + + int bs[4][8] = { + { 7,6,1,3,0,4,2,5 }, + { 7,1,4,3,0,6,2,5 }, + { 7,6,1,0,3,4,2,5 }, + { 7,1,4,0,3,6,2,5 }, + }; + + /* While the PAL supports up to 16 decryption methods, only four + are actually used in the PAL. Therefore, we'll take a little + memory overhead and decrypt the ROMs using each method in advance. */ + + uint8_t *ROM = memregion("maincpu")->base(); + epos_decrypt_rom(ROM, 0xfd, 0x10000, bs[0]); + epos_decrypt_rom(ROM, 0xbf, 0x14000, bs[1]); + epos_decrypt_rom(ROM, 0x75, 0x18000, bs[2]); + epos_decrypt_rom(ROM, 0x37, 0x1c000, bs[3]); + + membank("bank1")->configure_entries(0, 4, &ROM[0x10000], 0x4000); + + save_item(NAME(m_counter)); +} + +MACHINE_RESET_MEMBER(pacman_state, eeekk) +{ + m_counter = 0x09; + membank("bank1")->set_entry(m_counter & 3); +} diff --git a/src/mame/machine/epos.h b/src/mame/machine/epos.h new file mode 100644 index 00000000000..6d2f3b8a4dd --- /dev/null +++ b/src/mame/machine/epos.h @@ -0,0 +1,2 @@ +// license:BSD-3-Clause +// copyright-holders:Nicola Salmoria diff --git a/src/mame/machine/theglobp.cpp b/src/mame/machine/theglobp.cpp deleted file mode 100644 index 8c153ecfa13..00000000000 --- a/src/mame/machine/theglobp.cpp +++ /dev/null @@ -1,258 +0,0 @@ -// license:BSD-3-Clause -// copyright-holders:Nicola Salmoria -/*************************************************************************** - - machine.c - - Functions to emulate general aspects of the machine (RAM, ROM, interrupts, - I/O ports) - - The Glob protection description: - - The Glob is designed to run on modified Pacman hardware. It contains - two graphics ROMs at 5E and 5F, but contains code ROMs on a daughterboard - similar in concept to Ms. Pacman. However, these code ROMs are decrypted - through additional circuitry. The daughterboard was encased in epoxy. - - Here's a description of the protection as best as I can give it. - - 1) The decrypted D0 bit fed to the CPU is simply an inversion of the - D5 bit from the code ROMs. - 2) The decrypted D1 bit fed to the CPU is simply an inversion of the - D2 bit from the code ROMs. - 3) The other 6 data bits are decrypted by a 10H8 PAL. The PAL also - takes as input a 4-bit counter. The counter is incremented and - decremented as follows: - - the Z-80 command IN($xx) where xx is an odd number decrements the - counter; an even number increments the counter. - Ex: IN($64) would increment the counter, IN($6B) would decrement - the counter. - 4) The PAL output also contains the two ROM enable lines used to enable - the two encrypted code ROMs. As long as the system is working - correctly, these ROMs will always be enabled. - - As it so happens, only four counter values are ever used, which is - fortunate because the PAL only contains signals to enable the ROMs for - those four counter values. The valid counter values are $8, $9, $A, and - $B. The counter's intial value is $A, which is set by jumpers on the - daughterboard. Following is a description of the resulting decryptions - for these four counter states. - - COUNTER ENCRYPTED DECRYPTED - VALUE VALUE - - DDDDDDDD DDDDDDDD - 76543210 76543210 - - Counter = 8: abcdefgh EAhBDgFC - Counter = 9: abcdefgh FAgeDBFC - Counter = A: abcdefgh EHDBagFC - Counter = B: abcdefgh GHDEaBFC - - In the above diagram, capital letters represent inverted bits. Notice - that bits D2 and D5 are the same independent of counter state, this is - because these bits are not decrypted by the PAL. - - - In the code below, all four of these decryption patterns are used to - decrypt the entire code ROMs before execution. This is done for speed, - since we can then just bankswitch between the decrypted code sets on - each IN($xx) command, as opposed to dynamically decrypting every byte. - - - Mike Balfour (mab22@po.cwru.edu) - -***************************************************************************/ - -#include "emu.h" -#include "includes/pacman.h" - - -void pacman_state::theglobp_decrypt_rom_8() -{ - int oldbyte,inverted_oldbyte,newbyte; - int mem; - uint8_t *RAM; - - RAM = memregion("maincpu")->base(); - - - for (mem=0;mem<0x4000;mem++) - { - oldbyte = RAM[mem]; - inverted_oldbyte = ~oldbyte; - - /* Note: D2 is inverted and connected to D1, D5 is inverted and - connected to D0. The other six data bits are converted by a - PAL10H8 driven by the counter. */ - - /* Direct inversion */ - newbyte = (inverted_oldbyte & 0x04) >> 1; - newbyte |= (inverted_oldbyte & 0x20) >> 5; - /* PAL */ - newbyte |= (oldbyte & 0x01) << 5; - newbyte |= (oldbyte & 0x02) << 1; - newbyte |= (inverted_oldbyte & 0x08) << 4; - newbyte |= (inverted_oldbyte & 0x10) >> 1; - newbyte |= (inverted_oldbyte & 0x40) >> 2; - newbyte |= (inverted_oldbyte & 0x80) >> 1; - - RAM[mem + 0x10000] = newbyte; - } - - return; -} - - -void pacman_state::theglobp_decrypt_rom_9() -{ - int oldbyte,inverted_oldbyte,newbyte; - int mem; - uint8_t *RAM; - - RAM = memregion("maincpu")->base(); - - for (mem=0;mem<0x4000;mem++) - { - oldbyte = RAM[mem]; - inverted_oldbyte = ~oldbyte; - - /* Note: D2 is inverted and connected to D1, D5 is inverted and - connected to D0. The other six data bits are converted by a - PAL10H8 driven by the counter. */ - - /* Direct inversion */ - newbyte = (inverted_oldbyte & 0x04) >> 1; - newbyte |= (inverted_oldbyte & 0x20) >> 5; - /* PAL */ - newbyte |= (oldbyte & 0x01) << 5; - newbyte |= (inverted_oldbyte & 0x02) << 6; - newbyte |= (oldbyte & 0x08) << 1; - newbyte |= (inverted_oldbyte & 0x10) >> 1; - newbyte |= (inverted_oldbyte & 0x40) >> 4; - newbyte |= (inverted_oldbyte & 0x80) >> 1; - - RAM[mem + 0x14000] = newbyte; - } - - return; -} - -void pacman_state::theglobp_decrypt_rom_A() -{ - int oldbyte,inverted_oldbyte,newbyte; - int mem; - uint8_t *RAM; - - RAM = memregion("maincpu")->base(); - - for (mem=0;mem<0x4000;mem++) - { - oldbyte = RAM[mem]; - inverted_oldbyte = ~oldbyte; - - /* Note: D2 is inverted and connected to D1, D5 is inverted and - connected to D0. The other six data bits are converted by a - PAL10H8 driven by the counter. */ - - /* Direct inversion */ - newbyte = (inverted_oldbyte & 0x04) >> 1; - newbyte |= (inverted_oldbyte & 0x20) >> 5; - /* PAL */ - newbyte |= (inverted_oldbyte & 0x01) << 6; - newbyte |= (oldbyte & 0x02) << 1; - newbyte |= (inverted_oldbyte & 0x08) << 4; - newbyte |= (inverted_oldbyte & 0x10) << 1; - newbyte |= (inverted_oldbyte & 0x40) >> 2; - newbyte |= (oldbyte & 0x80) >> 4; - - RAM[mem + 0x18000] = newbyte; - } - - return; -} - -void pacman_state::theglobp_decrypt_rom_B() -{ - int oldbyte,inverted_oldbyte,newbyte; - int mem; - uint8_t *RAM; - - RAM = memregion("maincpu")->base(); - - for (mem=0;mem<0x4000;mem++) - { - oldbyte = RAM[mem]; - inverted_oldbyte = ~oldbyte; - - /* Note: D2 is inverted and connected to D1, D5 is inverted and - connected to D0. The other six data bits are converted by a - PAL10H8 driven by the counter. */ - - /* Direct inversion */ - newbyte = (inverted_oldbyte & 0x04) >> 1; - newbyte |= (inverted_oldbyte & 0x20) >> 5; - /* PAL */ - newbyte |= (inverted_oldbyte & 0x01) << 6; - newbyte |= (inverted_oldbyte & 0x02) << 6; - newbyte |= (oldbyte & 0x08) << 1; - newbyte |= (inverted_oldbyte & 0x10) << 1; - newbyte |= (inverted_oldbyte & 0x40) >> 4; - newbyte |= (oldbyte & 0x80) >> 4; - - RAM[mem + 0x1C000] = newbyte; - } - - return; -} - - -READ8_MEMBER(pacman_state::theglobp_decrypt_rom ) -{ - if (offset & 0x01) - { - m_counter = (m_counter - 1) & 0x0F; - } - else - { - m_counter = (m_counter + 1) & 0x0F; - } - - switch(m_counter) - { - case 0x08: membank ("bank1")->set_entry (0); break; - case 0x09: membank ("bank1")->set_entry (1); break; - case 0x0A: membank ("bank1")->set_entry (2); break; - case 0x0B: membank ("bank1")->set_entry (3); break; - default: - logerror("Invalid counter = %02X\n",m_counter); - break; - } - - return 0; -} - - -MACHINE_START_MEMBER(pacman_state,theglobp) -{ - uint8_t *RAM = memregion("maincpu")->base(); - - /* While the PAL supports up to 16 decryption methods, only four - are actually used in the PAL. Therefore, we'll take a little - memory overhead and decrypt the ROMs using each method in advance. */ - theglobp_decrypt_rom_8(); - theglobp_decrypt_rom_9(); - theglobp_decrypt_rom_A(); - theglobp_decrypt_rom_B(); - - membank("bank1")->configure_entries(0, 4, &RAM[0x10000], 0x4000); - - save_item(NAME(m_counter)); -} - - -MACHINE_RESET_MEMBER(pacman_state,theglobp) -{ - /* The initial state of the counter is 0x0A */ - m_counter = 0x0A; - membank("bank1")->set_entry(2); -} diff --git a/src/mame/machine/theglobp.h b/src/mame/machine/theglobp.h deleted file mode 100644 index 6d2f3b8a4dd..00000000000 --- a/src/mame/machine/theglobp.h +++ /dev/null @@ -1,2 +0,0 @@ -// license:BSD-3-Clause -// copyright-holders:Nicola Salmoria diff --git a/src/mame/mame.lst b/src/mame/mame.lst index cbb5d544585..08fc9e5e471 100644 --- a/src/mame/mame.lst +++ b/src/mame/mame.lst @@ -29404,6 +29404,7 @@ crushs // 1981 bootleg ctrpllrp // hack dremshpr // (c) 1982 Sanritsu drivfrcp // (c) 1984 Shinkai Inc. (Magic Eletronics Inc. license) +eeekk // (c) 1984 Epos Corporation eggor // (c) 1983 Telko eyes // (c) 1982 Digitrex Techstar + "Rockola presents" eyes2 // (c) 1982 Techstar + "Rockola presents" -- cgit v1.2.3