From ea36d218540bc804cc2a3f0fed5d0f59c06d93a9 Mon Sep 17 00:00:00 2001 From: MetalliC <0vetal0@gmail.com> Date: Thu, 25 Jan 2018 01:02:47 +0200 Subject: use hand xor-ed rom instead of patch (nw) --- src/mame/drivers/pgm2.cpp | 45 +++++++++++++++++++++------------------------ 1 file changed, 21 insertions(+), 24 deletions(-) diff --git a/src/mame/drivers/pgm2.cpp b/src/mame/drivers/pgm2.cpp index de759b9b650..2717831ec16 100644 --- a/src/mame/drivers/pgm2.cpp +++ b/src/mame/drivers/pgm2.cpp @@ -470,28 +470,29 @@ READ16_MEMBER(pgm2_state::module_rom_r) WRITE16_MEMBER(pgm2_state::module_rom_w) { //printf("module write %04X at %08X\n", data, offset); - switch (data) + uint32_t dec_val = ((module_key->key[0] | (module_key->key[1] << 8) | (module_key->key[2] << 16)) >> 6) & 0xffff; + if (data == dec_val) { - case 0x4947: // "IG" 1st part of key - break; - case 0xc2b1: // 2nd part of key, assume it enables descramble // might be wrong and normal data access enabled only after whole sequence complete decrypt_kov3_module(module_key->addr_xor, module_key->data_xor); - break; - // following might be wrong, and trigger is address or both - case 0x00c2: // checksum read mode enable, step 1 and 4 - module_sum_read = true; - if (offset != 0xe5a7 && offset != 0xa521) - popmessage("module write %04X at %08X\n", data, offset); - break; - case 0x0084: // checksum read mode enable, step 2 and 3 - if (offset != 0x5e7a && offset != 0x5a12) - popmessage("module write %04X at %08X\n", data, offset); - break; - default: - popmessage("module write %04X at %08X\n", data, offset); - break; } + else + switch (data) + { + // following might be wrong, and trigger is address or both + case 0x00c2: // checksum read mode enable, step 1 and 4 + module_sum_read = true; + if (offset != 0xe5a7 && offset != 0xa521) + popmessage("module write %04X at %08X\n", data, offset); + break; + case 0x0084: // checksum read mode enable, step 2 and 3 + if (offset != 0x5e7a && offset != 0x5a12) + popmessage("module write %04X at %08X\n", data, offset); + break; + default: + logerror("module write %04X at %08X\n", data, offset); + break; + } } // very primitive Atmel ARM PIO simulation, should be improved and devicified @@ -1152,7 +1153,7 @@ ROM_START( kov3_101 ) KOV3_INTERNAL_CHINA ROM_REGION( 0x1000000, "user1", 0 ) - ROM_LOAD( "kov3_v101.bin", 0x00000000, 0x0800000, BAD_DUMP CRC(f156c62b) SHA1(bd39f4ba0862c9bd8178f6679b1af01a9f5dc162) ) // not raw but descrambled + ROM_LOAD( "kov3_v101.bin", 0x00000000, 0x0800000, BAD_DUMP CRC(d6664449) SHA1(64d912425f018c3531951019b33e909657724547) ) // dump was not raw, manually xored with fake value KOV3_VIDEO_SOUND_ROMS ROM_END @@ -1434,7 +1435,7 @@ DRIVER_INIT_MEMBER(pgm2_state,ddpdojt) // currently we don't know how to derive address/data xor values from real keys, so we need both static const kov3_module_key kov3_104_key = { { 0x40,0xac,0x30,0x00,0x47,0x49,0x00,0x00 } ,{ 0xeb,0x7d,0x8d,0x90,0x2c,0xf4,0x09,0x82 }, 0x18ec71, 0xb89d }; // fake zero-key static const kov3_module_key kov3_102_key = { { 0x49,0xac,0xb0,0xec,0x47,0x49,0x95,0x38 } ,{ 0x09,0xbd,0xf1,0x31,0xe6,0xf0,0x65,0x2b }, 0x021d37, 0x81d0 }; -static const kov3_module_key kov3_101_key = { { 0xc1,0x2c,0xc1,0xe5,0x3c,0xc1,0x59,0x9e } ,{ 0xf2,0xb2,0xf0,0x89,0x37,0xf2,0xc7,0x0b }, 0, 0 }; // xor values is unknown, 0 for not scrambled dump +static const kov3_module_key kov3_101_key = { { 0xc1,0x2c,0xc1,0xe5,0x3c,0xc1,0x59,0x9e } ,{ 0xf2,0xb2,0xf0,0x89,0x37,0xf2,0xc7,0x0b }, 0, 0xffff }; // real xor values is unknown static const kov3_module_key kov3_100_key = { { 0x40,0xac,0x30,0x00,0x47,0x49,0x00,0x00 } ,{ 0x96,0xf0,0x91,0xe1,0xb3,0xf1,0xef,0x90 }, 0x3e8aa8, 0xc530 }; // fake zero-key DRIVER_INIT_MEMBER(pgm2_state,kov3) @@ -1472,10 +1473,6 @@ DRIVER_INIT_MEMBER(pgm2_state, kov3_102) DRIVER_INIT_MEMBER(pgm2_state, kov3_101) { - // patch data change check - uint32_t* rom = (uint32_t*)memregion("maincpu")->base(); - rom[0x1cfc / 4] = 0xe320f000; - module_key = &kov3_101_key; DRIVER_INIT_CALL(kov3); } -- cgit v1.2.3