diff options
| author | 2026-05-22 04:28:16 +0200 | |
|---|---|---|
| committer | 2026-05-22 04:28:16 +0200 | |
| commit | 014287e3f600d6570e5cf11d139ef8c9592383d9 (patch) | |
| tree | 1bd45939b6245dac0e7e12228aa022ba297bb995 /src | |
| parent | 7b343424fe2cf27670df105e9444fe91ce19446d (diff) | |
igs/igs036crypt.cpp: added some notes and corrected a couple of decryption keys [IQ_132]
Diffstat (limited to 'src')
| -rw-r--r-- | src/mame/igs/igs036crypt.cpp | 132 |
1 files changed, 105 insertions, 27 deletions
diff --git a/src/mame/igs/igs036crypt.cpp b/src/mame/igs/igs036crypt.cpp index 3a35d0c8990..e93ad2df481 100644 --- a/src/mame/igs/igs036crypt.cpp +++ b/src/mame/igs/igs036crypt.cpp @@ -47,19 +47,97 @@ be expected that the hardware is calculating them that way rather than using lookup tables or otherwise. It should be stressed that this obfuscation is done system-wide without dependence on the game keys. -On a different note, the unused tail of the ROMs are pattern-filled and, more interestingly, -that region appears to be hiding 20-bytes values (SHA-1 hashes?) located at -positions which vary per set. See the table below. +The unused section at the tail end of the ROMs are pattern-filled and hide 20-byte +values located at positions which vary per set. The first 16 bytes is a magic number +that the internal ROM looks for while hash checking the external ROM. Once a match +is found, the next 4 bytes is used as a hash for the external ROM and the 4 bytes of +the hash are skipped in the hash calculation. It appears that the hash algorhythm is +the same for all igs036 games, with the exception of the two shifts that are used. +Note that the hash check is performed while the external ROM is decrypted. +Code to validate the hash is commented below. + +set name location magic numbers hash shift variables +---------------------------------------------------------------------------------------- +bubucar $0facdc 2fb42900, 348172c1, 00ed7a12, 6857025d, 019cc7ba 3 7 +cjbq $138624 354c05bd, 07b06735, 1afa4159, 1f271130, a59385fd 12 8 +cjddzsp $18e818 552c6bcf, 106f37e8, 549c0b95, 2c1f740e, 56e569b5 15 15 +cjdh2 $117154 08b159ef, 22b54714, 0151323d, 3f813ace, 10a2b6c6 11 9 +cjdh2d $117154 08b159ef, 22b54714, 0151323d, 3f813ace, 10a2b6c6 11 9 +cjdh2a $1c0518 08b159ef, 22b54714, 0151323d, 3f813ace, f04702c8 11 9 +cjdh2b $1723fc 08b159ef, 22b54714, 0151323d, 3f813ace, 7f47d2ae 11 9 +cjdh2c $141f58 08b159ef, 22b54714, 0151323d, 3f813ace, fe0d6b93 11 9 +cjgdy $0e273c 5f1c50b2, 6ac31ac6, 70076097, 1d635d39, 33d0bd8a 10 11 +cjjl $0ea318 4c110962, 50704f37, 243e0985, 6347552d, 67a08caa 9 1 +dahuaxy $1268d4 625a7333, 7b9b47fb, 2ec4609b, 7aaf371b, 01ed83c1 2 10 +ddpdojt $1b4148 15bc6fb8, 35e82dda, 51b14195, 245d569c, a76a668b 14 16 - magic numbers in internal rom at $2194 +hlddz $104390 58c15165, 27ec4cf2, 66403aa8, 702c3c5a, 29c27ccf 14 3 +huoqilin * *, *, *, *, * * * - not decrypted +hyleyuan $0b242c 77c32aee, 377a4a65, 27e54ccc, 654c07df, 9bbe40c4 10 8 +igsm312 $0a3c74 1ce9796c, 18a36daf, 23a53ae1, 0083298a, 55bb68d6 16 9 +jhzb $04d4bc *, *, *, *, * * * - not decrypted +jxry $0d438c 2d4e7920, 21642c1a, 4d62017f, 48bd05f8, 09ad158d 15 9 +kof98um $e50e60 0b445743, 07ce3bc7, 057e142a, 0e9f2e02, b7d96ae1 2 10 - magic numbers in internal rom at $1f8c +kov2nl $7a88e8 5c544a7e, 66cf70e2, 3b47512b, 6377571d, 6af2c7d7 6 11 - magic numbers in internal rom at $1de8 +kov2nl_302cn $7a88e8 5c544a7e, 66cf70e2, 3b47512b, 6377571d, 6af2c7d7 6 11 - magic numbers in internal rom at $1de8 +kov2nl_301 $7a88e8 5c544a7e, 66cf70e2, 3b47512b, 6377571d, 92d55bba 6 11 - magic numbers in internal rom at $1de8 +kov2nl_301cn $7a88e8 5c544a7e, 66cf70e2, 3b47512b, 6377571d, 92d55bba 6 11 - magic numbers in internal rom at $1de8 +kov2nl_300 $7a88e8 5c544a7e, 66cf70e2, 3b47512b, 6377571d, 78d5d2e0 6 11 - magic numbers in internal rom at $1de8 +kov2nl_300cn $7a88e8 5c544a7e, 66cf70e2, 3b47512b, 6377571d, 78d5d2e0 6 11 - magic numbers in internal rom at $1de8 +kov3 $6f57f0 16d35891, 60b14073, 583c4d6a, 53310115, 214e45fb 14 5 - magic numbers in internal rom at $3abc +kov3_102 $718040 16d35891, 60b14073, 583c4d6a, 53310115, cf2cc899 14 5 - magic numbers in internal rom at $3abc +kov3_101 $6a2768 16d35891, 60b14073, 583c4d6a, 53310115, a90ce881 14 5 - magic numbers in internal rom at $3abc +kov3_100 $625ca4 16d35891, 60b14073, 583c4d6a, 53310115, 04336dc9 14 5 - magic numbers in internal rom at $3abc +lhfy $0bdfa8 60b21064, 4db03dd6, 0db233e5, 5bea4031, 67b18dfe 15 7 +lhtb $1028f0 5dd4630d, 70e71677, 015e1311, 772c0df0, 859953de 3 15 +lhzb3in1 $1c6734 54984109, 699b67e7, 7feb4e52, 723921e3, 95a835ce 15 3 +lhzbgqb $0a202c 5f1d3a21, 00bb362b, 099345e2, 78524a17, 31b2e095 5 4 +mghammer $0ad0b4 3e3b0db5, 53b5729b, 58a75dfe, 687776c1, 1ea2b8bb 15 5 +mjzhizun $11ed6c 359203fe, 21016b16, 3bab46e2, 520c7f0e, be167bd9 16 2 +orleg2 $76c77c 22b313b9, 5f454f7c, 3a316c32, 53446c7c, 7699b6f8 3 13 - magic numbers in internal rom at $3de4 +orleg2_104cn $76c77c 22b313b9, 5f454f7c, 3a316c32, 53446c7c, 7699b6f8 3 13 - magic numbers in internal rom at $3de4 +orleg2_104jp $76c77c 22b313b9, 5f454f7c, 3a316c32, 53446c7c, 7699b6f8 3 13 - magic numbers in internal rom at $3de4 +orleg2_103 $763984 22b313b9, 5f454f7c, 3a316c32, 53446c7c, e5cebfc0 3 13 - magic numbers in internal rom at $3de4 +orleg2_103cn $763984 22b313b9, 5f454f7c, 3a316c32, 53446c7c, e5cebfc0 3 13 - magic numbers in internal rom at $3de4 +orleg2_103jp $763984 22b313b9, 5f454f7c, 3a316c32, 53446c7c, e5cebfc0 3 13 - magic numbers in internal rom at $3de4 +orleg2_101 $72b888 22b313b9, 5f454f7c, 3a316c32, 53446c7c, 544c5fb4 3 13 - magic numbers in internal rom at $3de4 +orleg2_101cn $72b888 22b313b9, 5f454f7c, 3a316c32, 53446c7c, 544c5fb4 3 13 - magic numbers in internal rom at $3de4 +orleg2_101jp $72b888 22b313b9, 5f454f7c, 3a316c32, 53446c7c, 544c5fb4 3 13 - magic numbers in internal rom at $3de4 +qhzb $1e9b98 21e21071, 7aaf4768, 77533bff, 6ca12afc, 198070f1 6 10 +slqzsp $0f55d0 21e21071, 7aaf4768, 77533bff, 6ca12afc, 4a0d16f8 6 10 +super70s * *, *, *, *, * * * - bad dump +sydh $094368 3fc52afb, 62496f83, 149a4c76, 472a6923, d3590fb6 7 12 +xcjnh * *, *, *, *, * * * - not decrypted +xyddz $11cf60 72046e3c, 4bc75582, 466f29c0, 7c35738d, 3378adc2 16 15 +xydn $13cad0 767744f2, 12107fb5, 7bb62d17, 0c3d2a9d, 0adb99c6 10 11 +zjddz $0cb3ec 22ce1a47, 43ef51b0, 17700b9b, 6789505d, 11cb5ac2 16 3 + +static void calculate_hash(unsigned char *src, unsigned int length, unsigned int magic_numbers[4], int shift1, int shift2) +{ + unsigned int calculated_hash = 0; + unsigned int stored_hash = 0; + unsigned int stored_hash_offset = 0; + + for (int i = 0; i < length; i += 4) + { + unsigned int value = ((src[i + 0] << 0) | (src[i + 1] << 8) | (src[i + 2] << 16) | (src[i + 3] << 24)); + + if (stored_hash_offset == 4) + { + stored_hash = value; + stored_hash_offset = 0; + } + else + { + stored_hash_offset = (magic_numbers[stored_hash_offset & 3] == value) ? (stored_hash_offset + 1) : 0; + calculated_hash = (calculated_hash ^ (value << shift1) ^ (calculated_hash >> shift2)) | 0x80; + } + } + + printf ("Expected hash: %8.8x, found %8.8x.\n", stored_hash, calculated_hash); +} -driver 20-bytes value position in the ROM ---------- ---------------------------------- -orleg2o $763984-$763997 -orleg2 $76C77C-$76C78F -kov3 $718040-$718053 -kof98umh $E50E60-$E50E73 TO-DO: -- complete the table with the 20-bytes values - decryption tables for the programs using less than 0x80000 of code (huoqilin, jhzb) *****************************************************************************/ @@ -393,17 +471,17 @@ const uint8_t dahuaxy_key[0x100] = { 0xa0, 0xb2, 0x13, 0x92, 0x80, 0xa2, 0x03, 0x2a, 0xbb, 0x2b, 0x2a, 0x93, 0x8c, 0x85, 0x26, 0x03, 0x82, 0xa2, 0x22, 0x02, 0x90, 0x1d, 0x22, 0xaf, 0x08, 0x93, 0x22, 0x92, 0x38, 0xbb, 0x93, 0x83, 0x13, 0xb1, 0x93, 0x92, 0x03, 0x60, 0xe7, 0x2f, 0x01, 0x5b, 0x13, 0x52, 0xa5, 0x85, 0x47, 0xe6, - 0x01, 0x59, 0xd2, 0x93, 0x86, 0xd2, 0xc7, 0x02, 0x11, 0x8a, 0x4a, 0x43, 0x50, 0x0a, 0x8f, 0x5a, + 0x01, 0x59, 0xd2, 0x93, 0x86, 0xd2, 0xc7, 0x02, 0x11, 0x8a, 0x4a, 0x03, 0x50, 0x0a, 0x8f, 0x5a, 0x50, 0xaa, 0x82, 0x93, 0x85, 0x0b, 0x47, 0x22, 0xdb, 0x6b, 0x23, 0x12, 0xa7, 0x28, 0xcb, 0xee, 0x82, 0xd9, 0x53, 0x22, 0x26, 0xa1, 0x12, 0x3a, 0x7a, 0x08, 0x83, 0x7b, 0x96, 0x67, 0x9f, 0x33, - 0xa2, 0x00, 0x13, 0x8b, 0x26, 0x0b, 0x23, 0x2a, 0x91, 0x2a, 0x3b, 0x83, 0x8a, 0x0f, 0xa6, 0x02, - 0x00, 0x9b, 0x13, 0x82, 0x91, 0x01, 0x12, 0x1e, 0x8b, 0x9b, 0x8b, 0x83, 0x10, 0x9c, 0x0e, 0x9e, - 0x93, 0xb8, 0x93, 0xba, 0x26, 0xa9, 0x22, 0xa7, 0x8b, 0x23, 0x12, 0xa2, 0xa6, 0x20, 0x03, 0xab, - 0xa1, 0x3b, 0x93, 0x12, 0x30, 0x2a, 0x36, 0x23, 0xab, 0x03, 0x23, 0x9b, 0x08, 0x81, 0x03, 0x83, - 0x61, 0xea, 0xf3, 0x4b, 0x85, 0x6b, 0x82, 0x02, 0x90, 0xd3, 0xdb, 0x3a, 0xc3, 0xa5, 0xea, 0xe3, - 0x13, 0x81, 0x12, 0x02, 0x02, 0x54, 0xd7, 0x02, 0x88, 0x0a, 0xd3, 0x1a, 0x84, 0xc4, 0x46, 0x8a, - 0x12, 0x62, 0xa2, 0xfb, 0xe3, 0xcb, 0x42, 0x62, 0x8a, 0x83, 0xcb, 0xdb, 0x49, 0xed, 0xc2, 0x4b, - 0xe0, 0xd9, 0xc3, 0x13, 0x66, 0x38, 0xd6, 0x67, 0xd9, 0xba, 0xdb, 0x3b, 0x0e, 0xe6, 0x5e, 0x33, + 0xa2, 0x80, 0x13, 0x0b, 0xa6, 0x8b, 0xa3, 0x2a, 0x11, 0xaa, 0x3b, 0x03, 0x0a, 0x0f, 0x26, 0x82, + 0x80, 0x9b, 0x93, 0x82, 0x11, 0x01, 0x12, 0x9e, 0x8b, 0x1b, 0x0b, 0x03, 0x10, 0x1c, 0x0e, 0x9e, + 0x93, 0x38, 0x13, 0x3a, 0x26, 0xa9, 0x22, 0x27, 0x8b, 0x23, 0x12, 0xa2, 0xa6, 0x20, 0x83, 0x2b, + 0x21, 0xbb, 0x93, 0x12, 0xb0, 0xaa, 0xb6, 0x23, 0x2b, 0x83, 0x23, 0x1b, 0x88, 0x81, 0x03, 0x83, + 0xe1, 0xea, 0x73, 0x4b, 0x85, 0x6b, 0x82, 0x82, 0x90, 0xd3, 0x5b, 0x3a, 0xc3, 0x25, 0xea, 0xe3, + 0x13, 0x01, 0x12, 0x82, 0x02, 0xd4, 0x57, 0x02, 0x08, 0x0a, 0xd3, 0x1a, 0x04, 0xc4, 0xc6, 0x0a, + 0x92, 0x62, 0xa2, 0xfb, 0x63, 0x4b, 0xc2, 0x62, 0x0a, 0x03, 0x4b, 0x5b, 0xc9, 0x6d, 0xc2, 0x4b, + 0xe0, 0xd9, 0x43, 0x93, 0x66, 0x38, 0xd6, 0xe7, 0xd9, 0xba, 0x5b, 0x3b, 0x0e, 0x66, 0xde, 0xb3, }; const uint8_t slqzsp_key[0x100] = { @@ -453,14 +531,14 @@ const uint8_t xyddz_key[0x100] = { 0x83, 0x10, 0x12, 0x8b, 0x15, 0x0d, 0xc3, 0x17, 0x93, 0xc9, 0x9b, 0x5b, 0x8e, 0x4b, 0x92, 0x56, 0xb3, 0x79, 0x32, 0x4a, 0x22, 0xa2, 0xc2, 0x27, 0x28, 0x31, 0x43, 0xda, 0x63, 0x0c, 0x07, 0xc2, 0x61, 0x91, 0x12, 0xa3, 0x01, 0x91, 0xa7, 0xa6, 0xa1, 0x99, 0x33, 0x43, 0x3d, 0x12, 0xd2, 0xbe, - 0xa3, 0x89, 0x13, 0x93, 0x27, 0x22, 0x82, 0x23, 0xa3, 0x22, 0x3a, 0x1a, 0x21, 0x2d, 0x26, 0x2f, - 0x10, 0x0b, 0x12, 0x8b, 0x81, 0x0e, 0x82, 0x1e, 0x91, 0x09, 0x1a, 0x8a, 0x8b, 0x08, 0x9e, 0x96, - 0x33, 0xb3, 0xb2, 0x0a, 0x24, 0x80, 0x02, 0x0e, 0x3b, 0x1b, 0x13, 0x9b, 0x28, 0x02, 0x06, 0xa2, - 0x83, 0x02, 0x93, 0xbb, 0xa6, 0x37, 0x26, 0x2e, 0xa8, 0x08, 0xa3, 0xaa, 0xb7, 0x92, 0x1e, 0x87, - 0xe3, 0x12, 0x02, 0x6b, 0x82, 0x8c, 0xa2, 0xc2, 0x12, 0xe2, 0x93, 0x93, 0x83, 0x8b, 0x4f, 0xef, - 0x82, 0x83, 0x03, 0xd3, 0x17, 0x41, 0x53, 0x92, 0xc9, 0xc2, 0x4b, 0x02, 0xca, 0x58, 0x56, 0x0a, - 0xa3, 0xba, 0x03, 0x2b, 0xa1, 0xef, 0xc7, 0xe7, 0x90, 0xc1, 0x1b, 0xfa, 0x68, 0x80, 0x83, 0x27, - 0x52, 0xb1, 0x43, 0xea, 0x95, 0xae, 0x67, 0x02, 0x49, 0xc8, 0x7b, 0x22, 0xc3, 0xed, 0x72, 0xe7, + 0xa3, 0x09, 0x93, 0x13, 0x27, 0xa2, 0x82, 0xa3, 0xa3, 0x22, 0xba, 0x1a, 0xa1, 0xad, 0xa6, 0x2f, + 0x90, 0x0b, 0x12, 0x8b, 0x01, 0x8e, 0x02, 0x1e, 0x91, 0x09, 0x9a, 0x8a, 0x8b, 0x08, 0x9e, 0x96, + 0x33, 0x33, 0x32, 0x8a, 0xa4, 0x80, 0x02, 0x8e, 0xbb, 0x9b, 0x13, 0x1b, 0xa8, 0x02, 0x86, 0x22, + 0x83, 0x02, 0x93, 0x3b, 0xa6, 0xb7, 0x26, 0x2e, 0xa8, 0x08, 0x23, 0xaa, 0xb7, 0x12, 0x1e, 0x87, + 0x63, 0x12, 0x02, 0x6b, 0x02, 0x8c, 0x22, 0xc2, 0x92, 0x62, 0x93, 0x13, 0x83, 0x8b, 0x4f, 0x6f, + 0x82, 0x03, 0x83, 0x53, 0x17, 0x41, 0x53, 0x12, 0x49, 0x42, 0x4b, 0x82, 0x4a, 0xd8, 0xd6, 0x8a, + 0x23, 0xba, 0x03, 0x2b, 0xa1, 0x6f, 0x47, 0xe7, 0x90, 0xc1, 0x9b, 0xfa, 0x68, 0x00, 0x83, 0x27, + 0xd2, 0x31, 0xc3, 0xea, 0x15, 0xae, 0xe7, 0x82, 0xc9, 0x48, 0x7b, 0xa2, 0x43, 0xed, 0xf2, 0x67, }; const uint8_t cjbq_key[0x100] = { |
