diff options
author | Aaron Giles <aaron@aarongiles.com> | 2009-08-21 01:26:24 +0000 |
---|---|---|
committer | Aaron Giles <aaron@aarongiles.com> | 2009-08-21 01:26:24 +0000 |
commit | 2e64cfa8f3aa785ffc8afc8793d141273e7f4da0 (patch) | |
tree | e19778900dca0fe4a183e6bfb8baf7af81144882 | |
parent | f65cad4a5aa5b0194bc1886425489744ea14d159 (diff) |
> From: David Haywood [mailto:neohaze@nildram.co.uk]
> Sent: Thursday, August 20, 2009 4:20 PM
> Cc: Aaron Giles
> Subject: Re: Brap Boys progress
>
> Last one for tonight. I'm sending these because I have no idea when
> the
> next source update will be and I'd prefer it to be as up to date as
> possible so that this info can't be lost.
>
> We're almost half way there as far as decrypting brapboysj tables is
> concerned, however, we still need to better understand how the
> protection device uses them.
>
> These all apply against a clean SVN, not the previous patches I sent.
>
> David Haywood wrote:
> > more progress in decrypting the tables.
> >
> > David Haywood wrote:
> >> current progress, 2 extra tables decrypted.
> >>
> >>
> >> David Haywood wrote:
> >>> Further work on the decrypting of tables from the ROM. Added a
> >>> status table of the data I've decrypted, data I have to study etc.
> >>>
> >>> David Haywood wrote:
> >>>> Missed an 'else' sorry, wasn't decoding the table correctly.
> >>>>
> >>>> David Haywood wrote:
> >>>>> here's another which will decrypt table 0x19 for brapboys. (use
> >>>>> this instead of previous)
> >>>>>
> >>>>> I guess I need to understand something else like where it REALLY
> >>>>> writes the table data, or some other maths related ops, because
> it
> >>>>> just does a trap #0 to an infinite loop and then watchdog resets
> >>>>> now without requesting any more tables than the ones I've
> >>>>> decrypted. I'll work on decrypting the rest of them tho, as we
> >>>>> have a trojan that can supply whatever tables we request, however
> >>>>> understanding how to use them is becoming more important.
> >>>>>
> >>>>> David Haywood wrote:
> >>>>>> this decrypts table 11 (ugly ... but correct compared to the
> >>>>>> extracted data which is included for verification at this point)
> >>>>>>
> >>>>>> I may send newer versions as more tables are decrypted,
> depending
> >>>>>> on progress. This is so that nothing gets lost, and can be
> >>>>>> included.
-rw-r--r-- | src/mame/machine/kaneko16.c | 505 |
1 files changed, 381 insertions, 124 deletions
diff --git a/src/mame/machine/kaneko16.c b/src/mame/machine/kaneko16.c index 4f57d5db376..afc6fdf907d 100644 --- a/src/mame/machine/kaneko16.c +++ b/src/mame/machine/kaneko16.c @@ -350,12 +350,96 @@ where games specify the same decryption key the table used is the same, I don't */ +/* + + +Status + +Blocks marked ** are decrypted and verified + ~~ means I have the data to study + +(Shogun Warriors) + + Block 10 Found Base 0060 - Mode? 01 Unknown 14 Key 00 Length 0532 + Block 11 Found Base 0598 - Mode? 01 Unknown 48 Key 00 Length 03f4 + +** Block 19 Found Base 09bc - Mode? 03 Unknown 01 Key 01 Length 00da + + Block 30 Found Base 0b20 - Mode? 02 Unknown 01 Key 10 Length 022a + Block 31 Found Base 0d50 - Mode? 02 Unknown 03 Key 11 Length 0246 + Block 32 Found Base 0f9c - Mode? 02 Unknown 01 Key 12 Length 0226 + Block 33 Found Base 11c8 - Mode? 02 Unknown 02 Key 13 Length 0216 + Block 34 Found Base 13e4 - Mode? 02 Unknown 02 Key 14 Length 0226 + Block 35 Found Base 1610 - Mode? 02 Unknown 03 Key 15 Length 024a + Block 36 Found Base 1860 - Mode? 02 Unknown 03 Key 16 Length 0222 + Block 37 Found Base 1a88 - Mode? 02 Unknown 02 Key 17 Length 0216 + Block 38 Found Base 1ca4 - Mode? 02 Unknown 02 Key 18 Length 0222 + Block 39 Found Base 1ecc - Mode? 02 Unknown 01 Key 19 Length 0206 + Block 3a Found Base 20d8 - Mode? 02 Unknown 01 Key 1a Length 0202 + Block 3b Found Base 22e0 - Mode? 02 Unknown 02 Key 1b Length 021e + +** Block 40 Found Base 251c - Inline Encryption (size 22) - Mode? 01 Unknown 03 Key (unused?) 62 Length 1008 +** Block 41 Found Base 354c - Mode? 01 Unknown 7c Key 00 Length 1008 + +** Block 58 Found Base 45de - Mode? 01 Unknown 02 Key 15 Length 1d4e + + Block 60 Found Base 635c - Mode? 02 Unknown 3f Key b0 Length 00e6 + Block 61 Found Base 6448 - Mode? 02 Unknown 3f Key 31 Length 00e6 + Block 62 Found Base 6534 - Mode? 02 Unknown 3f Key 32 Length 00e6 + Block 63 Found Base 6620 - Inline Encryption (size 33) - Mode? 02 Unknown 3f Key (unused?) 73 Length 00e6 + Block 64 Found Base 673f - Mode? 02 Unknown 3f Key 34 Length 00e6 + Block 65 Found Base 682b - Inline Encryption (size 35) - Mode? 02 Unknown 3f Key (unused?) 75 Length 00e6 + Block 66 Found Base 694c - Mode? 02 Unknown 3f Key 36 Length 00e6 + Block 67 Found Base 6a38 - Mode? 02 Unknown 3f Key b7 Length 00e6 + Block 68 Found Base 6b24 - Mode? 02 Unknown 3f Key 38 Length 00e6 + Block 69 Found Base 6c10 - Inline Encryption (size 39) - Mode? 02 Unknown 3f Key (unused?) 79 Length 00e6 + Block 6a Found Base 6d35 - Mode? 02 Unknown 3f Key 3a Length 00e6 + Block 6b Found Base 6e21 - Mode? 02 Unknown 3f Key bb Length 00e6 + +** Block 80 Found Base 6f85 - Mode? 00 Unknown 3f Key 01 Length 02b0 + + +(BRap Boys Special) + +** Block 10 Found Base 0060 - Mode? 01 Unknown 02 Key 04 Length 00d0 +** Block 11 Found Base 0136 - Inline Encryption (size 13) - Mode? 00 Unknown 3f Key (unused?) 53 Length 00fe +** Block 12 Found Base 024d - Mode? 02 Unknown 38 Key 00 Length 0050 | just a shift +** Block 13 Found Base 02a3 - Mode? 02 Unknown 6f Key bc Length 09e0 | shift 2 places - (test mode code / data!) +** Block 14 Found Base 0c89 - Mode? 03 Unknown 01 Key 31 Length 1880 | just a table +** Block 15 Found Base 250f - Mode? 02 Unknown 3f Key 24 Length 03b8 | shift 3 places + table, contains GAME OVER, CONTINUE +** Block 16 Found Base 28cd - Mode? 01 Unknown 03 Key 80 Length 018a +** Block 17 Found Base 2a5d - Mode? 01 Unknown 1f Key 15 Length 018a +-- Block 18 Found Base 2bed - Mode? 01 Unknown 44 Key 00 Length 0184 +** Block 19 Found Base 2d77 - Mode? 01 Unknown 03 Key 19 Length 0184 | just a table + Block 1a Found Base 2f01 - Inline Encryption (size 21) - Mode? 02 Unknown 3f Key (unused?) 61 Length 0a24 + Block 1b Found Base 394c - Mode? 01 Unknown 5f Key 22 Length 0e02 + Block 1c Found Base 4754 - Mode? 01 Unknown 1f Key 3f Length 0e02 + Block 1d Found Base 555c - Mode? 01 Unknown 03 Key bf Length 0e02 + Block 1e Found Base 6364 - Mode? 01 Unknown 01 Key 24 Length 0e02 +** Block 1f Found Base 716c - Mode? 02 Unknown 1f Key 39 Length 02ac | 1 place shift + table + Block 20 Found Base 741e - Mode? 03 Unknown 03 Key af Length 01a4 + Block 21 Found Base 75c8 - Inline Encryption (size 3d) - Mode? 03 Unknown 2f Key (unused?) 7d Length 01fa +** Block 22 Found Base 7805 - Mode? 03 Unknown 1f Key 17 Length 010c | 1 place shift + table +** Block 23 Found Base 7917 - Mode? 03 Unknown 03 Key 89 Length 018c | just a table +~~ Block 24 Found Base 7aa9 - Inline Encryption (size 03) - Mode? 03 Unknown 5f Key (unused?) 43 Length 0214 + Block 25 Found Base 7cc6 - Inline Encryption (size 1d) - Mode? 03 Unknown 02 Key (unused?) 5d Length 0178 + Block 26 Found Base 7e61 - Mode? 03 Unknown 03 Key 05 Length 04e2 + Block 27 Found Base 8349 - Mode? 03 Unknown 3f Key a7 Length 00fa + Block 28 Found Base 8449 - Inline Encryption (size 23) - Mode? 03 Unknown 1f Key (unused?) 63 Length 015a + Block 29 Found Base 85cc - Mode? 03 Unknown 03 Key 15 Length 00d6 + Block 2a Found Base 86a8 - Mode? 03 Unknown 3f Key a1 Length 00aa + Block 2b Found Base 8758 - Mode? 03 Unknown 2f Key 04 Length 01a2 + Block 2c Found Base 8900 - Mode? 03 Unknown 2f Key 04 Length 04cc + Block 2d Found Base 8dd2 - Mode? 03 Unknown 03 Key 15 Length 0486 + +*/ + UINT16 calc3_mcu_crc; /* decryption tables */ -/* table 0x00 = not encrypted? */ -static UINT8 calc3_table00[64] = { +/* table 0x00 = not encrypted? (but can still be bitswapped) */ +static UINT8 calc3_key00[64] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, @@ -363,7 +447,7 @@ static UINT8 calc3_table00[64] = { }; /* ok */ -static UINT8 calc3_table01[64] = { +static UINT8 calc3_key01[64] = { 0xce,0xab,0xa1,0xaa,0x20,0x20,0xcb,0x57,0x5b,0x65,0xd6,0x65,0x5e,0x92,0x6c,0x0a, 0xf8,0xea,0xb6,0xfd,0x76,0x35,0x47,0xaf,0xed,0xe0,0xcc,0x4d,0x4c,0xd6,0x74,0x78, 0x20,0x1c,0x1f,0xc1,0x25,0x2e,0x49,0xe7,0x90,0x1b,0xb4,0xcf,0x1e,0x61,0xd7,0x46, @@ -371,57 +455,78 @@ static UINT8 calc3_table01[64] = { }; /* ok - shogwarr */ -static UINT8 calc3_table15[64] = { +static UINT8 calc3_key15[64] = { 0x0C,0xEB,0x30,0x25,0xA8,0xED,0xE3,0x23,0xAC,0x2B,0x8D,0x34,0x88,0x9F,0x55,0xB5, 0xBF,0x15,0xE3,0x7C,0x54,0xD4,0x72,0xA9,0x7E,0x80,0x27,0x9F,0xA3,0x3F,0xA1,0x4D, 0x84,0x1B,0xD1,0xB2,0xB5,0xA7,0x0C,0xA0,0x51,0xE6,0x5E,0xC0,0xEB,0x68,0x22,0xD6, 0xC8,0xB6,0xCF,0x46,0x4B,0xF0,0x15,0xD7,0xB0,0xB5,0x29,0xB8,0xFD,0x43,0x5C,0xC0 }; + /* ok - brapboys initial transfer */ -static UINT8 calc3_table04[64] = { +static UINT8 calc3_key04[64] = { 0xff,0x4a,0x62,0xa3,0xf4,0xb4,0x8c,0x2d,0x84,0xbd,0x87,0x3a,0x9e,0xe9,0xd7,0x12, 0xff,0x50,0x40,0x39,0xa6,0x47,0xd9,0x38,0x89,0x3c,0x62,0xa0,0x86,0xe2,0xd7,0x4d, 0x9c,0x8e,0x45,0xe8,0x5b,0xe1,0xdd,0xaf,0x99,0xa8,0x47,0x79,0x67,0x00,0x38,0xf4, 0x43,0xbe,0x47,0x32,0x8f,0x0e,0xfd,0x64,0x42,0x59,0x2b,0xe5,0xde,0x6d,0x80,0x7a, }; - -/* partial guessed tables -unsigned char table31[64] = { - // x x x ok x x x ok x x x ok x x x ok - 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0xaf, 0x00, 0x00, 0x00, 0x3a, 0x00, 0x00, 0x00, 0x3b, - 0x00, 0x00, 0x00, 0xbb, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0xb1, 0x00, 0x00, 0x00, 0xdc, - 0x00, 0x00, 0x00, 0xb5, 0x00, 0x00, 0x00, 0x3d, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x00, 0x00, 0xde, - 0x00, 0x00, 0x00, 0x7e, 0x00, 0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0xb1 + static UINT8 calc3_key17[64] = { + 0x1b,0x48,0xa4,0xdd,0x2e,0x7a,0xe3,0xd1,0x6d,0x9e,0x49,0x31,0xdb,0x13,0xe6,0x00, + 0xf1,0x8f,0xcb,0x3f,0x23,0xc1,0xf3,0xb4,0x30,0x35,0xf4,0xea,0x2c,0x77,0x65,0x79, + 0x4e,0x7b,0x0e,0x87,0x79,0x3c,0xd1,0x8f,0x8b,0xa4,0x5a,0x61,0x68,0xac,0x87,0x6b, + 0xc4,0xc4,0x98,0x36,0xb3,0x75,0x16,0x33,0xf2,0x45,0x84,0xb8,0xf2,0xdb,0xc7,0x46, + }; + + static UINT8 calc3_key19[64] = { + 0x30,0x72,0xe0,0xca,0xa4,0xe5,0x41,0x44,0xd4,0xfe,0xe6,0x82,0x3e,0x85,0x18,0x30, + 0x50,0x17,0x9f,0x77,0xf8,0xcb,0xb0,0xc4,0xed,0x16,0x96,0xca,0xba,0xec,0x22,0xca, + 0x8f,0x28,0xd3,0x12,0xc6,0x2e,0xc4,0xc3,0x36,0xcf,0x59,0xd8,0x3a,0x6c,0xa7,0x64, + 0x7f,0x5f,0xa6,0x1b,0x90,0x96,0x19,0x14,0x22,0x81,0x38,0xcd,0x20,0x2f,0x22,0x70, }; - - -unsigned char tableb0[64] = { - // x x x ok x x x ok x x x ok x x x ok - 0x00, 0x00, 0x00, 0x5e, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x81, - 0x00, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x6d, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x32, - 0x00, 0x00, 0x00, 0x76, 0x00, 0x00, 0x00, 0xb2, 0x00, 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0xb2, 0x00, 0x00, 0x00, 0xe4, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x5b + + static UINT8 calc3_key24[64] = { + 0x75,0x49,0x7a,0xd6,0x84,0xbd,0x70,0xbe,0x10,0x19,0x6c,0xb2,0xa9,0x5f,0x6b,0x78, + 0x14,0x29,0x2a,0x15,0xd0,0x4a,0x10,0x93,0x69,0xb2,0xdf,0x02,0x7f,0x92,0x19,0xbd, + 0x95,0xc1,0x32,0xee,0x99,0x5e,0x7a,0x55,0x37,0xb7,0xc8,0x45,0xdc,0x6a,0xe6,0xef, + 0x8b,0xca,0xbe,0xe2,0x63,0x85,0x49,0xd3,0xeb,0x83,0x32,0x9a,0x23,0x11,0x4c,0x7e, + }; + +static UINT8 calc3_key31[64] = { + 0x02,0x21,0x0f,0xf2,0x98,0xc6,0xa7,0x51,0xbd,0x50,0xe6,0xc6,0x8d,0x15,0xb4,0xc5, + 0x18,0x99,0x78,0x45,0xeb,0xe4,0x09,0xfa,0x5c,0xa4,0x51,0x4f,0x98,0x02,0xc0,0x24, + 0x6d,0x44,0x77,0x4b,0xd7,0x26,0x2f,0xc3,0x4c,0xf8,0xee,0xb1,0xc7,0x76,0x68,0x22, + 0x94,0x6a,0x35,0x82,0xe0,0x02,0xb7,0xda,0xff,0xf2,0xc7,0xcc,0x7b,0x48,0x25,0x4f, +}; + + static UINT8 calc3_key39[64] = { + 0x7d,0xf8,0x54,0xc5,0x74,0xf6,0x54,0x1d,0x40,0xe1,0x71,0xc2,0xdd,0x03,0x72,0xdf, + 0x3b,0x77,0xa1,0x1c,0xc7,0xd6,0xb1,0x67,0xb7,0x13,0x6f,0xf4,0x18,0xa4,0x2a,0x82, + 0x98,0xe3,0xe3,0xe1,0x12,0xb3,0x33,0xb1,0xde,0x66,0xff,0x6c,0xd5,0xde,0xdd,0xa6, + 0x26,0xf3,0x44,0x94,0xdb,0x15,0x76,0xcc,0x28,0x33,0x2d,0x4b,0x79,0xdb,0x06,0xbc }; -unsigned char tableb7[64] = { - // x x x ok x x x ok x x x ok x x x ok - 0x00, 0x00, 0x00, 0x33, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x00, 0x00, 0xe0, 0x00, 0x00, 0x00, 0xd7, - 0x00, 0x00, 0x00, 0xe7, 0x00, 0x00, 0x00, 0x54, 0x00, 0x00, 0x00, 0x2b, 0x00, 0x00, 0x00, 0x82, - 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xa2, 0x00, 0x00, 0x00, 0xb4, 0x00, 0x00, 0x00, 0x26, - 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x9d, 0x00, 0x00, 0x00, 0x33 + static UINT8 calc3_key80[64] = { + 0x33,0x8e,0x6f,0x22,0xac,0x01,0x9f,0x7a,0xc7,0xca,0x23,0xc4,0xa4,0x9c,0x07,0xf8, + 0x98,0xc1,0x17,0x4a,0xb2,0xbc,0xcc,0xf4,0x0e,0x2e,0xf6,0x35,0xdd,0xf6,0x29,0x9a, + 0x2f,0x9c,0xe8,0x7c,0x86,0xf0,0x93,0xca,0x1a,0xee,0x10,0x08,0xec,0xe5,0x3a,0x98, + 0x8c,0xd8,0x0d,0x39,0xaa,0x25,0x8d,0xcd,0x5d,0x64,0x7a,0x5f,0x35,0x92,0xb5,0x64, }; -unsigned char tablebb[64] = { - // x x x ok x x x ok x x x ok x x x ok - 0x00, 0x00, 0x00, 0x62, 0x00, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x00, 0xf8, 0x00, 0x00, 0x00, 0x3d, - 0x00, 0x00, 0x00, 0xec, 0x00, 0x00, 0x00, 0x99, 0x00, 0x00, 0x00, 0xa0, 0x00, 0x00, 0x00, 0x69, - 0x00, 0x00, 0x00, 0xeb, 0x00, 0x00, 0x00, 0x6f, 0x00, 0x00, 0x00, 0x97, 0x00, 0x00, 0x00, 0x9e, - 0x00, 0x00, 0x00, 0xe1, 0x00, 0x00, 0x00, 0x9f, 0x00, 0x00, 0x00, 0xfd, 0x00, 0x00, 0x00, 0x4d + static UINT8 calc3_key89[64] = { + 0xdd,0xa9,0x15,0x18,0x9d,0x01,0x24,0x9c,0xed,0x7a,0xeb,0x42,0x8b,0x9e,0xf3,0x72, + 0x26,0xc9,0x45,0x18,0xea,0xd2,0x54,0x5f,0xcf,0xed,0xac,0xbc,0xa1,0xd0,0x5f,0x2f, + 0xce,0x15,0x2a,0xc6,0xf1,0xe0,0x69,0x62,0x22,0xc1,0xc0,0xbd,0xfa,0xdc,0x85,0xac, + 0x67,0x47,0xee,0xa2,0x35,0xb3,0xff,0x76,0x57,0x4f,0x30,0x66,0xf8,0xe9,0xe0,0x5b, }; -*/ +static UINT8 calc3_keybc[64] = { + 0xb8,0x8a,0xa5,0x8f,0x58,0x30,0xb0,0x38,0xa6,0x53,0x84,0x33,0xd4,0xd7,0xbd,0x26, + 0x45,0x35,0xb7,0xf6,0x1a,0x20,0x7b,0x8d,0x7e,0x68,0x69,0xdb,0xb1,0x1e,0xa5,0x1a, + 0xd5,0xf9,0x42,0x57,0x7a,0xf8,0x30,0x2e,0xea,0x49,0xe5,0xd5,0x34,0x6a,0xcd,0x5b, + 0xfa,0x8e,0x71,0x32,0xfa,0x42,0x69,0xec,0x5d,0x50,0x02,0x42,0xc2,0xe4,0xae,0x5a, + }; + // global so we can use them in the filename when we save out the data (debug..) static UINT8 calc3_decryption_key_byte; static UINT8 calc3_unknown; @@ -438,8 +543,10 @@ int calc3_decompress_table(running_machine* machine, int tabnum, UINT8* dstram, UINT16 length; int x; int offset = 0; - numregions = rom[offset+0]; + int isbrap = ( !strcmp(machine->gamedrv->name,"brapboysj") || !strcmp(machine->gamedrv->name,"brapboys")); + numregions = rom[offset+0]; + if (tabnum > numregions) { printf("CALC3 error, requested table > num tables!\n"); @@ -506,13 +613,95 @@ int calc3_decompress_table(running_machine* machine, int tabnum, UINT8* dstram, { for (i=0;i<length;i++) { - UINT8 dat = rom[offset+i]; - UINT8 inlinet = rom[inline_table_base + (i%inline_table_size)]; - //printf("%02x, ",inlinet); - dat -= inlinet; + UINT8 dat=0; + + if (tabnum==0x11 && isbrap ) + { - if (tabnum==0x40) // fjbuster / shogun warriors japanese character select (what enables this extra?) + // typed data.. to verify results, out decrypt works! + unsigned char rawData[252+2] = { + 0x00,0x00, 0x42, 0x79, 0x00, 0x20, 0x08, 0x2E, 0x10, 0x39, 0x00, 0x20, 0x00, 0xC2, + 0x02, 0x40, 0x00, 0x30, 0xE4, 0x48, 0x33, 0xFB, 0x00, 0x3C, 0x00, 0x10, + 0x22, 0x42, 0x30, 0x3B, 0x00, 0x32, 0x43, 0xEE, 0x00, 0x0A, 0x41, 0xF9, + 0x00, 0x20, 0x08, 0x30, 0x4A, 0x50, 0x67, 0x00, 0x00, 0x04, 0x4E, 0x75, + 0x11, 0x40, 0x00, 0x02, 0x11, 0x7C, 0x00, 0xFC, 0x00, 0x03, 0x31, 0x49, + 0x00, 0x04, 0x30, 0xBC, 0x00, 0x01, 0x42, 0x6E, 0xFF, 0xB0, 0x41, 0xFA, + 0x00, 0x16, 0x2C, 0x88, 0x4E, 0x75, 0x00, 0x16, 0x00, 0x00, 0x00, 0x17, + 0x00, 0x01, 0x00, 0x18, 0x00, 0x00, 0x00, 0x19, 0x00, 0x01, 0x33, 0xC0, + 0x00, 0x2C, 0x00, 0x00, 0x30, 0x3C, 0x00, 0x14, 0x51, 0xC8, 0xFF, 0xFE, + 0x33, 0xC0, 0x00, 0x2D, 0x00, 0x00, 0x42, 0x79, 0x00, 0x20, 0x08, 0x2E, + 0x41, 0xF9, 0x00, 0x10, 0x78, 0xB6, 0x70, 0x07, 0x0C, 0x10, 0x00, 0x03, + 0x66, 0x00, 0x00, 0x0E, 0x53, 0x68, 0x00, 0x0E, 0x66, 0x00, 0x00, 0x06, + 0x10, 0xBC, 0x00, 0x04, 0x41, 0xE8, 0x00, 0x12, 0x51, 0xC8, 0xFF, 0xE6, + 0x32, 0x39, 0x00, 0x10, 0x22, 0x46, 0x02, 0x41, 0xFF, 0xFC, 0x10, 0x39, + 0x00, 0x20, 0x00, 0xC2, 0x02, 0x40, 0x00, 0x01, 0x82, 0x40, 0xE3, 0x48, + 0x82, 0x40, 0x33, 0xC1, 0x00, 0x90, 0x00, 0x00, 0x33, 0xFB, 0x00, 0x2A, + 0x00, 0x10, 0x20, 0x26, 0xE5, 0x48, 0x23, 0xFB, 0x00, 0x24, 0x00, 0x10, + 0x20, 0x22, 0x33, 0xFB, 0x00, 0x20, 0x00, 0x90, 0x00, 0x02, 0x32, 0x39, + 0x00, 0x10, 0x22, 0x48, 0x82, 0x7B, 0x00, 0x14, 0x33, 0xC1, 0x00, 0x80, + 0x00, 0x08, 0x4E, 0x75, 0xFF, 0xFF, 0x00, 0x3F, 0xE8, 0xC0, 0x42, 0x00, + 0x03, 0xC0, 0x00, 0x00, 0x57, 0x00, 0x7E, 0x00, 0xFC, 0x00, 0x03, 0x03 + }; + + if ( ((i / 19)&1)==0) + { + if (((i%inline_table_size)&1)==1) + { + UINT8 inlinet = rom[inline_table_base + (i%inline_table_size)]; + dat = rom[offset+i]; + //printf("%02x, ",inlinet); + dat -= inlinet; + + dat = BITSWAP8(dat, 4,3,2,1,0,7,6,5); + if (dat != rawData[i]) printf("ERROR %d x %02x %02x\n", (i / 19)&1, dat, rawData[i]); + } + else + { + UINT8 extra[] = { 0x14,0xf0,0xf8,0xd2,0xbe,0xfc,0xac,0x86,0x64,0x08,0x0c/*,0x74,0xd6,0x6a,0x24,0x12,0x1a */}; + UINT8 inlinet = rom[inline_table_base + (i%inline_table_size)]; + dat = rom[offset+i]; + dat -= inlinet; + dat -= extra[(i%inline_table_size)>>1]; + dat = BITSWAP8(dat, 2,1,0,7,6,5,4,3); + + if (dat != rawData[i]) printf("ERROR %d y %02x %02x\n", (i / 19)&1, dat, rawData[i]); + + //dat = rawData[i]; + + } + } + else + { + if (((i%inline_table_size)&1)==0) + { + UINT8 inlinet = rom[inline_table_base + (i%inline_table_size)]; + dat = rom[offset+i]; + dat -= inlinet; + + dat = BITSWAP8(dat, 4,3,2,1,0,7,6,5); + if (dat != rawData[i]) printf("ERROR %d x %02x %02x\n", (i / 19)&1, dat, rawData[i]); + } + else + { + // shhould probably use the inline table somehow? + + UINT8 extra[] = { 0x2f, 0x04, 0xd1, 0x69, 0xad, 0xeb, 0x10, 0x95,0xb0 };; + dat = rom[offset+i]; + + dat -= extra[(i%inline_table_size)>>1]; + dat = BITSWAP8(dat, 2,1,0,7,6,5,4,3); + + if (dat != rawData[i]) printf("ERROR %d y %02x %02x\n", (i / 19)&1, dat, rawData[i]); + } + } + } + else if (tabnum==0x40) // fjbuster / shogun warriors japanese character select (what enables this extra?) { + UINT8 inlinet = rom[inline_table_base + (i%inline_table_size)]; + dat = rom[offset+i]; + //printf("%02x, ",inlinet); + dat -= inlinet; + // note the original, table is an odd number of words, so we can't just check if i is odd / even because the additional overlay // is relative to the start of the original table, and has a size of 0x11 (17) bytes which loop. if (((i%inline_table_size)&1)==0) @@ -532,15 +721,24 @@ int calc3_decompress_table(running_machine* machine, int tabnum, UINT8* dstram, } else { - UINT8* table = calc3_table00; + UINT8* key = calc3_key00; // 0x00 seems to have no 'encryption' - if (calc3_decryption_key_byte == 0x00) table = calc3_table00; + if (calc3_decryption_key_byte == 0x00) key = calc3_key00; + + // each key seems to relate directly to a 0x40 byte decryption table, only these ones handled so far + if (calc3_decryption_key_byte == 0x01) key = calc3_key01; + if (calc3_decryption_key_byte == 0x04) key = calc3_key04; + if (calc3_decryption_key_byte == 0x15) key = calc3_key15; + if (calc3_decryption_key_byte == 0x17) key = calc3_key17; + if (calc3_decryption_key_byte == 0x19) key = calc3_key19; + if (calc3_decryption_key_byte == 0x24) key = calc3_key24; + if (calc3_decryption_key_byte == 0x31) key = calc3_key31; + if (calc3_decryption_key_byte == 0x39) key = calc3_key39; + if (calc3_decryption_key_byte == 0x80) key = calc3_key80; + if (calc3_decryption_key_byte == 0x89) key = calc3_key89; + if (calc3_decryption_key_byte == 0xbc) key = calc3_keybc; - // currently only handle 3 of the formats :-( - if (calc3_decryption_key_byte == 0x01) table = calc3_table01; - if (calc3_decryption_key_byte == 0x15) table = calc3_table15; - if (calc3_decryption_key_byte == 0x04) table = calc3_table04; for (i=0;i<length;i++) { @@ -548,96 +746,129 @@ int calc3_decompress_table(running_machine* machine, int tabnum, UINT8* dstram, UINT8 dat = rom[offset+i]; - - if (tabnum==0x80) // shogwarr table 80 (irq code) + if (tabnum==0x12 && isbrap) + { + dat = BITSWAP8(dat, 4,3,2,1,0,7,6,5); + } + else if (tabnum==0x13 && isbrap) + { + dat -= key[i&0x3f]; + + if ((i&1)==0) dat = BITSWAP8(dat, 5,4,3,2,1,0,7,6); + else dat = BITSWAP8(dat, 1,0,7,6,5,4,3,2); + + } + else if (tabnum==0x14 && isbrap) + { + dat -= key[i&0x3f]; + } + else if (tabnum==0x15 && isbrap) + { + dat -= key[i&0x3f]; + + if ((i&1)==0) dat = BITSWAP8(dat, 2,1,0,7,6,5,4,3); + else dat = BITSWAP8(dat, 4,3,2,1,0,7,6,5); + + //error 264 35 36 (typo, ignore) + } + else if (tabnum==0x16 && isbrap) + { + dat -= key[i&0x3f]; + // error 1 02 should be 00 (the usual) + } + else if (tabnum==0x17 && isbrap) + { + // note we've seen this key (0x15) before, but again, here we have to add sometimes.. obviously a bit to control this.. + if ((i&1)==0) dat += key[i&0x3f]; + else dat -= key[i&0x3f]; + + if ((i&1)==0) dat = BITSWAP8(dat, 0,7,6,5,4,3,2,1); + else dat = BITSWAP8(dat, 6,5,4,3,2,1,0,7); + + //error 1 02 should be 00 (the usual) + //error 390 02 should be 00 (typo, ignore) + //error 391 c6 should be 2c (typo, ignore) + //error 392 03 should be 60 (typo, ignore) + //error 393 60 should be 36 (typo, ignore) + } + else if (tabnum==0x19 && isbrap) + { + dat -= key[i&0x3f]; + // first 2 bytes were 00 in the returned data.. + //if (i==1) dat=0x00; + } + else if (tabnum==0x1f && isbrap) + { + dat -= key[i&0x3f]; + + if ((i&1)==0) dat = BITSWAP8(dat, 0,7,6,5,4,3,2,1); + else dat = BITSWAP8(dat, 6,5,4,3,2,1,0,7); + } + else if (tabnum==0x22 && isbrap) + { + + #if 0 + { + UINT8 test; + UINT8 xxx; + + if ((i&1)==1) xxx = BITSWAP8(rawData[i], 0,7,6,5,4,3,2,1); + else xxx = BITSWAP8(rawData[i], 6,5,4,3,2,1,0,7); + + test= dat-xxx; + + printf("%02x,%02x,%02x ",dat, rawData[i], test); + + if ((i%0x40)==0x3f) + printf("\n"); + + //if (dat!=rawData[i]) printf("error %d %02x should be %02x\n",i, dat, rawData[i]); + } + #endif + { + dat -= key[i&0x3f]; + + if ((i&1)==0) dat = BITSWAP8(dat, 0,7,6,5,4,3,2,1); + else dat = BITSWAP8(dat, 6,5,4,3,2,1,0,7); + // first 2 bytes were 00 in the returned data.. + //if (i==1) dat=0x00; + } + + + } + else if (tabnum==0x23 && isbrap) + { + dat -= key[i&0x3f]; + // error 1 18 should be 00 (usual byte 1 'issue) + // error 384 98 should be 38 (typo, ignore) + + } + else if (tabnum==0x80 && !isbrap) // shogwarr table 80 (irq code) { - - unsigned char extracted80[686+2] = { - 0x00, 0x00, - 0xE7, 0x48, 0xFE, 0xFF, 0x39, 0x4A, 0x10, 0x00, 0xFE, 0x2D, 0x00, 0x67, - 0x64, 0x02, 0x39, 0x4A, 0x10, 0x00, 0x26, 0x2E, 0x00, 0x66, 0x54, 0x02, - 0x3C, 0x10, 0x4D, 0x00, 0x39, 0x4A, 0x10, 0x00, 0x10, 0x2E, 0x04, 0x67, - 0xC0, 0x08, 0x07, 0x00, 0xC0, 0x13, 0x90, 0x00, 0x00, 0x00, 0xF9, 0x43, - 0x58, 0x00, 0x00, 0x00, 0xF9, 0x41, 0x10, 0x00, 0x00, 0x18, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xF9, 0x43, 0x38, 0x00, 0x00, 0x00, 0x3C, 0x30, 0x0F, 0x00, - 0x79, 0x20, 0x10, 0x00, 0xA2, 0x62, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xC8, 0x51, 0x7E, 0xFF, 0x39, 0x4A, 0x10, 0x00, 0x27, 0x2E, - 0x00, 0x66, 0x64, 0x00, 0xF9, 0x45, 0x10, 0x00, 0x40, 0x32, 0xF9, 0x41, - 0x80, 0x00, 0x00, 0x00, 0xDA, 0x30, 0xDA, 0x30, 0xDA, 0x30, 0xDA, 0x30, - 0xF9, 0x41, 0x90, 0x00, 0x14, 0x00, 0x39, 0x30, 0x10, 0x00, 0x38, 0x32, - 0x40, 0x02, 0xC0, 0xFF, 0x40, 0x44, 0xC0, 0x30, 0x39, 0x30, 0x10, 0x00, - 0x3A, 0x32, 0x40, 0x02, 0xC0, 0xFF, 0x40, 0x44, 0x79, 0xD0, 0x10, 0x00, - 0x1E, 0x2E, 0xC0, 0x30, 0x39, 0x30, 0x10, 0x00, 0x3C, 0x32, 0x40, 0x02, - 0xC0, 0xFF, 0x40, 0x44, 0xC0, 0x30, 0x39, 0x30, 0x10, 0x00, 0x3E, 0x32, - 0x40, 0x02, 0xC0, 0xFF, 0x40, 0x44, 0x79, 0xD0, 0x10, 0x00, 0x1E, 0x2E, - 0xC0, 0x30, 0x00, 0x60, 0x9A, 0x00, 0xF9, 0x41, 0x80, 0x00, 0x00, 0x00, - 0x39, 0x30, 0x10, 0x00, 0x40, 0x32, 0x40, 0x31, 0x02, 0x00, 0x40, 0x31, - 0x06, 0x00, 0xF9, 0x41, 0x90, 0x00, 0x1C, 0x00, 0x39, 0x30, 0x10, 0x00, - 0x34, 0x32, 0x48, 0xED, 0x40, 0x44, 0xC0, 0x30, 0x39, 0x30, 0x10, 0x00, - 0x30, 0x32, 0x40, 0x06, 0x20, 0x00, 0x48, 0xED, 0x40, 0x44, 0x79, 0xD0, - 0x10, 0x00, 0x1E, 0x2E, 0xC0, 0x30, 0xF9, 0x41, 0x10, 0x00, 0x28, 0x2E, - 0xE8, 0x45, 0x00, 0x02, 0x79, 0x22, 0x10, 0x00, 0x22, 0x2E, 0xE9, 0x47, - 0x00, 0x10, 0x3C, 0x30, 0x07, 0x00, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, - 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, - 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, - 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, - 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, - 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xD8, 0x22, 0xDA, 0x26, 0xC8, 0x51, - 0xBE, 0xFF, 0xF9, 0x43, 0x58, 0x00, 0x80, 0x00, 0xF9, 0x41, 0x10, 0x00, - 0x80, 0x18, 0x3C, 0x30, 0x1B, 0x00, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, - 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xD8, 0x22, 0xC8, 0x51, - 0xBE, 0xFF, 0xD8, 0x22, 0xD8, 0x22, 0x39, 0x42, 0x10, 0x00, 0xFE, 0x2D, - 0xF9, 0x41, 0x10, 0x00, 0x6C, 0x67, 0x07, 0x70, 0x10, 0x0C, 0x03, 0x00, - 0x00, 0x66, 0x0E, 0x00, 0x68, 0x53, 0x0E, 0x00, 0x00, 0x66, 0x06, 0x00, - 0xBC, 0x10, 0x04, 0x00, 0xE8, 0x41, 0x12, 0x00, 0xC8, 0x51, 0xE6, 0xFF, - 0xC0, 0x33, 0x2C, 0x00, 0x00, 0x00, 0x3C, 0x30, 0x14, 0x00, 0xC8, 0x51, - 0xFE, 0xFF, 0xC0, 0x33, 0x2D, 0x00, 0x00, 0x00, 0xDF, 0x4C, 0xFF, 0x7F, - 0x73, 0x4E - }; - if ((i&1)==0) { - dat -= table[i&0x3f]; - dat = BITSWAP8(dat,2,1,0,7,6,5,4,3); - // we can decode this byte... but compare it to the extract table for verification - if (extracted80[i^1] != dat) printf("error %02x %02x %02x\n", i, extracted80[i^1],dat); + dat -= key[i&0x3f]; + dat = BITSWAP8(dat,2,1,0,7,6,5,4,3); } else { - // I don't understand how to decode this byte :-( - rotation + extra table? - dat = extracted80[i^1]; - } + // note + , not - (!!) + dat += key[i&0x3f]; + dat = BITSWAP8(dat,4,3,2,1,0,7,6,5); + } } - else if (tabnum==0x41) // shogwarr table 41 -- note fjbuster uses table 40, which looks like (almost) the same data but with better encryption... + else if (tabnum==0x41 && !isbrap) // shogwarr table 41 -- note fjbuster uses table 40, which looks like (almost) the same data but with better encryption... { // simple shifts... different direction for each alternating byte.. - dat -= table[i&0x3f]; + dat -= key[i&0x3f]; if ((i&1)==1) dat = BITSWAP8(dat,0,7,6,5,4,3,2,1); else dat = BITSWAP8(dat,6,5,4,3,2,1,0,7); } else { - dat -= table[i&0x3f]; + // plain table case + dat -= key[i&0x3f]; } @@ -783,14 +1014,14 @@ static void calc3_mcu_run(running_machine *machine) calc3_writeaddress = (kaneko16_mcu_ram[(0>>1) + 6] << 16) | (kaneko16_mcu_ram[(0>>1) + 7]); - printf("Calc 3 Init Command - %04x DSW addr\n", calc3_dsw_addr); + printf("Calc 3 Init Command - %04x DSW addr\n", calc3_dsw_addr); printf("Calc 3 Init Command - %04x Eeprom Address\n", calc3_eeprom_addr); printf("Calc 3 Init Command - %04x Future Commands Base\n", calc3_mcu_command_offset); printf("Calc 3 Init Command - %04x Poll / Busy Address\n", calc3_poll_addr); printf("Calc 3 Init Command - %04x ROM Checksum Address\n", cakc3_checkumaddress); printf("Calc 3 Init Command - %08x Data Write Address\n", calc3_writeaddress); - kaneko16_mcu_ram[calc3_dsw_addr/2] = ~input_port_read(machine, "DSW1"); // DSW + kaneko16_mcu_ram[calc3_dsw_addr/2] = ~input_port_read(machine, "DSW1"); // DSW // dsw actually updates in realtime - mcu reads+writes it every frame kaneko16_mcu_ram[cakc3_checkumaddress / 2] = calc3_mcu_crc; // MCU Rom Checksum! for (i=0;i<0x40;i++) @@ -832,14 +1063,40 @@ static void calc3_mcu_run(running_machine *machine) // cause an additional displacement to cause the writeback address to populate that table.. maybe if (commandunk == 0x30) { + int length; commandaddr -= 0x60; - calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_mcu_ram, (calc3_writeaddress&0xffff)-2); + length = calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_mcu_ram, (calc3_writeaddress&0xffff)-2); printf("writing back address %08x to %08x\n", calc3_writeaddress, commandaddr); kaneko16_mcu_ram[(commandaddr>>1)+0] = (calc3_writeaddress>>16)&0xffff; kaneko16_mcu_ram[(commandaddr>>1)+1] = (calc3_writeaddress&0xffff); + calc3_writeaddress += length; + + } + else if (commandunk == 0xa0) + { + int length; + commandaddr -= 0x6d; + length = calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_mcu_ram, (calc3_writeaddress&0xffff)-2); + printf("writing back address %08x to %08x\n", calc3_writeaddress, commandaddr); + kaneko16_mcu_ram[(commandaddr>>1)+0] = (calc3_writeaddress>>16)&0xffff; + kaneko16_mcu_ram[(commandaddr>>1)+1] = (calc3_writeaddress&0xffff); + calc3_writeaddress += length; } + else if (commandunk == 0x98) + { + int length; + commandaddr -= (0x6d+0xd); + length = calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_mcu_ram, (calc3_writeaddress&0xffff)-2); + + printf("writing back address %08x to %08x\n", calc3_writeaddress, commandaddr); + kaneko16_mcu_ram[(commandaddr>>1)+0] = (calc3_writeaddress>>16)&0xffff; + kaneko16_mcu_ram[(commandaddr>>1)+1] = (calc3_writeaddress&0xffff); + calc3_writeaddress += length; + } + + else { calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_calc3_fakeram, fakeoffs&0xfffff); |