summaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
author David Haywood <mamehaze@users.noreply.github.com>2013-07-21 15:53:58 +0000
committer David Haywood <mamehaze@users.noreply.github.com>2013-07-21 15:53:58 +0000
commit2998430da7afce91188919fdfc4336ff40ca6740 (patch)
tree3ed8f76627ae6c8e500e8e39d1efaefad0c32dcc
parentad27c3045a98515cb9e349d508737d4fa0fa2a44 (diff)
notes (nw)
-rw-r--r--src/mame/drivers/funkyjet.c6
-rw-r--r--src/mame/machine/deco104.c63
-rw-r--r--src/mame/machine/deco146.c116
3 files changed, 86 insertions, 99 deletions
diff --git a/src/mame/drivers/funkyjet.c b/src/mame/drivers/funkyjet.c
index 5e9e1698412..855ef96c499 100644
--- a/src/mame/drivers/funkyjet.c
+++ b/src/mame/drivers/funkyjet.c
@@ -104,7 +104,7 @@ READ16_MEMBER( funkyjet_state::funkyjet_protection_region_0_146_r )
// UINT16 realdat = deco16_146_funkyjet_prot_r(space,offset&0x3ff,mem_mask);
int real_address = 0 + (offset *2);
- int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 5, 6, 4, 7, 3, 8, 2, 9, 1, 10, 0) & 0x7fff;
+ int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) & 0x7fff;
UINT8 cs = 0;
UINT16 data = m_deco146->read_data( deco146_addr, mem_mask, cs );
@@ -119,7 +119,7 @@ WRITE16_MEMBER( funkyjet_state::funkyjet_protection_region_0_146_w )
// deco16_146_funkyjet_prot_w(space,offset&0x3ff,data,mem_mask);
int real_address = 0 + (offset *2);
- int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 5, 6, 4, 7, 3, 8, 2, 9, 1, 10, 0) & 0x7fff;
+ int deco146_addr = BITSWAP32(real_address, /* NC */31,30,29,28,27,26,25,24,23,22,21,20,19,18, 13,12,11,/**/ 17,16,15,14, /* note, same bitswap as fghthist */ 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) & 0x7fff;
UINT8 cs = 0;
m_deco146->write_data( space, deco146_addr, data, mem_mask, cs );
}
@@ -337,6 +337,8 @@ static MACHINE_CONFIG_START( funkyjet, funkyjet_state )
MCFG_SCREEN_UPDATE_DRIVER(funkyjet_state, screen_update_funkyjet)
MCFG_DECO146_ADD("ioprot")
+ MCFG_DECO146_SET_INTERFACE_SCRAMBLE_INTERLEAVE
+
MCFG_GFXDECODE(funkyjet)
MCFG_PALETTE_LENGTH(1024)
diff --git a/src/mame/machine/deco104.c b/src/mame/machine/deco104.c
index c4deecca4ce..077571d3741 100644
--- a/src/mame/machine/deco104.c
+++ b/src/mame/machine/deco104.c
@@ -1,68 +1,9 @@
/****************************************************************************
Data East 104 based protection/IO chips
+ (a variation on the Deco 146 protection, see deco146.c for notes)
-
- Game Custom chip number
- ------------------------------------------------
- Caveman Ninja 104
- Wizard Fire 104
- Pocket Gal DX 104
- Boogie Wings 104
- Rohga 104
- Diet GoGo 104
- Tattoo Assassins 104?
- Dream Ball 104
- Night Slashers 104
- Double Wings 104
- Schmeiser Robo 104
-
- for more modern 60/66/75/146 knowledge see deco146.c
-
-
- This series of chips is used for I/O and copy protection. They are all
- 16 bit word based chips, with 0x400 write addresses, and 0x400 read
- addresses. The basic idea of the protection is that read & write
- addresses don't match. So if you write to write address 0, you might
- read that data back at read address 10, and something else will be at 0.
- In addition, the data read back may be bit shifted in various ways.
- Games can be very well protected by writing variables to the chip, and
- expecting certain values back from certain read addresses. With care,
- it can be impossible to tell from the game code what values go where,
- and what shifting goes on. Eg, writing 10 values to the chip, of which
- 7 are dummy values, then reading back 3 particular values, and using them
- in a multiplication and add calculation to get a jump address for the
- program. Even if you can guess one of many possible legal jump addresses
- it's hard to tell what values should be bit shifted in what way.
-
- It's also been found some chips contain a hardwired XOR port and hardwired
- NAND port which affects only certain read values.
-
- The chips also handle the interface to the sound cpu via a write address,
- and game inputs via several read addresses. The I/O input data is also
- mirrored to several locations, some with bit shifting.
-
- Although several games use chip 104, each seems to be different, the
- address lines leading to the chip on each game are probably arranged
- differently, to further scramble reads/writes. From hardware tests
- chips 60 && 66 appear to be identical.
-
- Update January - April 2006:
- Further work on examining the 146 chip has revealed that if you
- read an address immediately after writing it, you always get
- the written value returned. This behaviour is confirmed
- to only exist for one read/write 'tick' - any other read will
- return that location to its usual state - ie, bit shifter
- or input port. This has been emulated for the 146 chip in
- Nitroball and Fighters History but the behaviour probably
- also exists in earlier chips as it explains the 'one-shot'
- ports in Mutant Fighter.
-
- The 'double buffer' feature seen in the 104 chip is also
- confirmed to exist in the 146 chip. Again, this may well
- be present in the earlier chip too.
-
- Emulation by Bryan McPhail, mish@tendril.co.uk
+ original protection simulations by Bryan McPhail, mish@tendril.co.uk
***************************************************************************/
diff --git a/src/mame/machine/deco146.c b/src/mame/machine/deco146.c
index 726bcd129cb..c51dce7fa28 100644
--- a/src/mame/machine/deco146.c
+++ b/src/mame/machine/deco146.c
@@ -1,43 +1,87 @@
/* Data East 146 protection chip / memory-mapper & I/O interface */
/*
- this was based on the analysis of a 146 chip by Charles MacDonald
- http://cgfm2.emuviews.com/new/detech.txt
- using a Super Shanghai board
+ The 146 emulation was based on the analysis of a 146 chip by
+ Charles MacDonald http://cgfm2.emuviews.com/new/detech.txt
+ using a Super Shanghai board and comparisons with the old protection
+ simulations.
+
+ The 104 emulation (deco104.c) currently only has per-game cases and
+ is incomplete.
+
+ The Deco 146 and 104 chips act as I/O chips and as protection devices
+ by using 2 banks of 0x80 words of RAM built into the chips.
+
+ The chip has 0x400 read addresses each of which is mapped to one of
+ the RAM addresses (scrambled) as well as logic for shifting, xoring
+ and masking the bits returned.
+
+ In addition there is the aformentioned bankswitch behavior triggered
+ by causing a read related to a specific write address.
+
+ The chip also provides takes an additional 4 address lines and uses
+ them to map Chip Select outputs meaning depending on some
+ configuration registers meaning it can potentially be used as a
+ memory mapping device similar to the Sega System 16 ones, however
+ nothing makes proper use of this functionality.
+
+ There seems to be a way to select an alt read mode too, causing
+ the port read lines to be xored.
+
+ Many games only use the basic I/O functions!
+
+ Data East Customs
+ 60,66,75 and 146 all appear to have identical functionality
+
+ Custom chip 104 appears to work in the same way but with different
+ internal tables and different special ports.
+
+ Chip 146 104
+ XOR register port 0x2c 0x42
+ MASK register port 0x36 0xee
+ Soundlatch port 0x64 0xa8
+ Bankswitch port 0x78 0x66
+ Extra addr Xor(if used) 0x44a 0x2a4
+
+ Both chips are often connected with the lower 10 address lines
+ scrambled or reversed.
+
+ Game Chip Address Scramble Extra Read Address Xor?
+
+ --- 146 compatible games ---
+
+ Edward Randy 60 None No
+ Mutant Fighter 66 None No
+ Captain America 75 None No
+ Lemmings 75 None Yes
+ Robocop 2 75 None Yes
+ Super Shanghai Dragon's Eye 146 None No
+ Funky Jet 146 Interleave No
+ Sotsugyo Shousho (same board / config as Funky Jet)
+ Nitro Ball 146 Reversed Yes
+ Fighters History 146? (surface scratched) Interleave Yes
+ Stadium Hero 96 146 None Yes
+ Dragon Gun 146 Reversed No
+ Lock 'n' Loaded (same board / config as Dragon Gun)
+
+ --- 104 games ---
+
+ Caveman Ninja 104 None Yes
+ Wizard Fire 104 Reversed No
+ Pocket Gal DX 104 None* No*
+ Boogie Wings 104 Reversed Yes
+ Rohga 104 None No
+ Diet GoGo 104 Interleave Yes
+ Tattoo Assassins 104 Interleave No
+ Dream Ball 104 None No
+ Night Slashers 104 Interleave No
+ Double Wings 104 Interleave** Yes**
+ Schmeiser Robo 104 None No
+
+
+ * not currently hooked up, conflicts on an input port with Rohga, needs more investigation
+ ** simulation massively incomplete
- Currently used for
- 146 Super Shanghai
- 146 Funky Jet / Sotsugyo Shousho
- 60 Edward Randy
- 66 Mutant Fighter
- 75 Captain America
-
- 60,66,75 appear to operate in the same way as 146, possibly the same chip rebadged?
-
- the lower 10 address lines are often rearranged when the chip is hooked up
-
- The following games use 146 compatible chips, but appear to use some kind of different
- read mode (legacy implementations included)
-
- 146? Fighters History*
- 146 Nitro Ball*
- 75 Robocop 2**
- 75 Lemmings**
-
- *Address lines are connected backwards compared to Robocop 2, reverse them to get
- the sound / xor / mask write ports at the expected addresses, but the input port
- addresses are still different to our implementation (the same as Robocop 2)
-
- ** need to move here
-
- The following are also 146 style chips and need moving
- 146 Stadium Hero 96
- 146 Dragon Gun / Lock 'n' Loaded
-
-
-
- Chip 104 seems to be a similar thing but almost certainly has different internal
- tables, see decoprot.c
*/