From 2e64cfa8f3aa785ffc8afc8793d141273e7f4da0 Mon Sep 17 00:00:00 2001 From: Aaron Giles Date: Fri, 21 Aug 2009 01:26:24 +0000 Subject: > From: David Haywood [mailto:neohaze@nildram.co.uk] > Sent: Thursday, August 20, 2009 4:20 PM > Cc: Aaron Giles > Subject: Re: Brap Boys progress > > Last one for tonight. I'm sending these because I have no idea when > the > next source update will be and I'd prefer it to be as up to date as > possible so that this info can't be lost. > > We're almost half way there as far as decrypting brapboysj tables is > concerned, however, we still need to better understand how the > protection device uses them. > > These all apply against a clean SVN, not the previous patches I sent. > > David Haywood wrote: > > more progress in decrypting the tables. > > > > David Haywood wrote: > >> current progress, 2 extra tables decrypted. > >> > >> > >> David Haywood wrote: > >>> Further work on the decrypting of tables from the ROM. Added a > >>> status table of the data I've decrypted, data I have to study etc. > >>> > >>> David Haywood wrote: > >>>> Missed an 'else' sorry, wasn't decoding the table correctly. > >>>> > >>>> David Haywood wrote: > >>>>> here's another which will decrypt table 0x19 for brapboys. (use > >>>>> this instead of previous) > >>>>> > >>>>> I guess I need to understand something else like where it REALLY > >>>>> writes the table data, or some other maths related ops, because > it > >>>>> just does a trap #0 to an infinite loop and then watchdog resets > >>>>> now without requesting any more tables than the ones I've > >>>>> decrypted. I'll work on decrypting the rest of them tho, as we > >>>>> have a trojan that can supply whatever tables we request, however > >>>>> understanding how to use them is becoming more important. > >>>>> > >>>>> David Haywood wrote: > >>>>>> this decrypts table 11 (ugly ... but correct compared to the > >>>>>> extracted data which is included for verification at this point) > >>>>>> > >>>>>> I may send newer versions as more tables are decrypted, > depending > >>>>>> on progress. This is so that nothing gets lost, and can be > >>>>>> included. --- src/mame/machine/kaneko16.c | 505 +++++++++++++++++++++++++++++++++----------- 1 file changed, 381 insertions(+), 124 deletions(-) diff --git a/src/mame/machine/kaneko16.c b/src/mame/machine/kaneko16.c index 4f57d5db376..afc6fdf907d 100644 --- a/src/mame/machine/kaneko16.c +++ b/src/mame/machine/kaneko16.c @@ -350,12 +350,96 @@ where games specify the same decryption key the table used is the same, I don't */ +/* + + +Status + +Blocks marked ** are decrypted and verified + ~~ means I have the data to study + +(Shogun Warriors) + + Block 10 Found Base 0060 - Mode? 01 Unknown 14 Key 00 Length 0532 + Block 11 Found Base 0598 - Mode? 01 Unknown 48 Key 00 Length 03f4 + +** Block 19 Found Base 09bc - Mode? 03 Unknown 01 Key 01 Length 00da + + Block 30 Found Base 0b20 - Mode? 02 Unknown 01 Key 10 Length 022a + Block 31 Found Base 0d50 - Mode? 02 Unknown 03 Key 11 Length 0246 + Block 32 Found Base 0f9c - Mode? 02 Unknown 01 Key 12 Length 0226 + Block 33 Found Base 11c8 - Mode? 02 Unknown 02 Key 13 Length 0216 + Block 34 Found Base 13e4 - Mode? 02 Unknown 02 Key 14 Length 0226 + Block 35 Found Base 1610 - Mode? 02 Unknown 03 Key 15 Length 024a + Block 36 Found Base 1860 - Mode? 02 Unknown 03 Key 16 Length 0222 + Block 37 Found Base 1a88 - Mode? 02 Unknown 02 Key 17 Length 0216 + Block 38 Found Base 1ca4 - Mode? 02 Unknown 02 Key 18 Length 0222 + Block 39 Found Base 1ecc - Mode? 02 Unknown 01 Key 19 Length 0206 + Block 3a Found Base 20d8 - Mode? 02 Unknown 01 Key 1a Length 0202 + Block 3b Found Base 22e0 - Mode? 02 Unknown 02 Key 1b Length 021e + +** Block 40 Found Base 251c - Inline Encryption (size 22) - Mode? 01 Unknown 03 Key (unused?) 62 Length 1008 +** Block 41 Found Base 354c - Mode? 01 Unknown 7c Key 00 Length 1008 + +** Block 58 Found Base 45de - Mode? 01 Unknown 02 Key 15 Length 1d4e + + Block 60 Found Base 635c - Mode? 02 Unknown 3f Key b0 Length 00e6 + Block 61 Found Base 6448 - Mode? 02 Unknown 3f Key 31 Length 00e6 + Block 62 Found Base 6534 - Mode? 02 Unknown 3f Key 32 Length 00e6 + Block 63 Found Base 6620 - Inline Encryption (size 33) - Mode? 02 Unknown 3f Key (unused?) 73 Length 00e6 + Block 64 Found Base 673f - Mode? 02 Unknown 3f Key 34 Length 00e6 + Block 65 Found Base 682b - Inline Encryption (size 35) - Mode? 02 Unknown 3f Key (unused?) 75 Length 00e6 + Block 66 Found Base 694c - Mode? 02 Unknown 3f Key 36 Length 00e6 + Block 67 Found Base 6a38 - Mode? 02 Unknown 3f Key b7 Length 00e6 + Block 68 Found Base 6b24 - Mode? 02 Unknown 3f Key 38 Length 00e6 + Block 69 Found Base 6c10 - Inline Encryption (size 39) - Mode? 02 Unknown 3f Key (unused?) 79 Length 00e6 + Block 6a Found Base 6d35 - Mode? 02 Unknown 3f Key 3a Length 00e6 + Block 6b Found Base 6e21 - Mode? 02 Unknown 3f Key bb Length 00e6 + +** Block 80 Found Base 6f85 - Mode? 00 Unknown 3f Key 01 Length 02b0 + + +(BRap Boys Special) + +** Block 10 Found Base 0060 - Mode? 01 Unknown 02 Key 04 Length 00d0 +** Block 11 Found Base 0136 - Inline Encryption (size 13) - Mode? 00 Unknown 3f Key (unused?) 53 Length 00fe +** Block 12 Found Base 024d - Mode? 02 Unknown 38 Key 00 Length 0050 | just a shift +** Block 13 Found Base 02a3 - Mode? 02 Unknown 6f Key bc Length 09e0 | shift 2 places - (test mode code / data!) +** Block 14 Found Base 0c89 - Mode? 03 Unknown 01 Key 31 Length 1880 | just a table +** Block 15 Found Base 250f - Mode? 02 Unknown 3f Key 24 Length 03b8 | shift 3 places + table, contains GAME OVER, CONTINUE +** Block 16 Found Base 28cd - Mode? 01 Unknown 03 Key 80 Length 018a +** Block 17 Found Base 2a5d - Mode? 01 Unknown 1f Key 15 Length 018a +-- Block 18 Found Base 2bed - Mode? 01 Unknown 44 Key 00 Length 0184 +** Block 19 Found Base 2d77 - Mode? 01 Unknown 03 Key 19 Length 0184 | just a table + Block 1a Found Base 2f01 - Inline Encryption (size 21) - Mode? 02 Unknown 3f Key (unused?) 61 Length 0a24 + Block 1b Found Base 394c - Mode? 01 Unknown 5f Key 22 Length 0e02 + Block 1c Found Base 4754 - Mode? 01 Unknown 1f Key 3f Length 0e02 + Block 1d Found Base 555c - Mode? 01 Unknown 03 Key bf Length 0e02 + Block 1e Found Base 6364 - Mode? 01 Unknown 01 Key 24 Length 0e02 +** Block 1f Found Base 716c - Mode? 02 Unknown 1f Key 39 Length 02ac | 1 place shift + table + Block 20 Found Base 741e - Mode? 03 Unknown 03 Key af Length 01a4 + Block 21 Found Base 75c8 - Inline Encryption (size 3d) - Mode? 03 Unknown 2f Key (unused?) 7d Length 01fa +** Block 22 Found Base 7805 - Mode? 03 Unknown 1f Key 17 Length 010c | 1 place shift + table +** Block 23 Found Base 7917 - Mode? 03 Unknown 03 Key 89 Length 018c | just a table +~~ Block 24 Found Base 7aa9 - Inline Encryption (size 03) - Mode? 03 Unknown 5f Key (unused?) 43 Length 0214 + Block 25 Found Base 7cc6 - Inline Encryption (size 1d) - Mode? 03 Unknown 02 Key (unused?) 5d Length 0178 + Block 26 Found Base 7e61 - Mode? 03 Unknown 03 Key 05 Length 04e2 + Block 27 Found Base 8349 - Mode? 03 Unknown 3f Key a7 Length 00fa + Block 28 Found Base 8449 - Inline Encryption (size 23) - Mode? 03 Unknown 1f Key (unused?) 63 Length 015a + Block 29 Found Base 85cc - Mode? 03 Unknown 03 Key 15 Length 00d6 + Block 2a Found Base 86a8 - Mode? 03 Unknown 3f Key a1 Length 00aa + Block 2b Found Base 8758 - Mode? 03 Unknown 2f Key 04 Length 01a2 + Block 2c Found Base 8900 - Mode? 03 Unknown 2f Key 04 Length 04cc + Block 2d Found Base 8dd2 - Mode? 03 Unknown 03 Key 15 Length 0486 + +*/ + UINT16 calc3_mcu_crc; /* decryption tables */ -/* table 0x00 = not encrypted? */ -static UINT8 calc3_table00[64] = { +/* table 0x00 = not encrypted? (but can still be bitswapped) */ +static UINT8 calc3_key00[64] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, @@ -363,7 +447,7 @@ static UINT8 calc3_table00[64] = { }; /* ok */ -static UINT8 calc3_table01[64] = { +static UINT8 calc3_key01[64] = { 0xce,0xab,0xa1,0xaa,0x20,0x20,0xcb,0x57,0x5b,0x65,0xd6,0x65,0x5e,0x92,0x6c,0x0a, 0xf8,0xea,0xb6,0xfd,0x76,0x35,0x47,0xaf,0xed,0xe0,0xcc,0x4d,0x4c,0xd6,0x74,0x78, 0x20,0x1c,0x1f,0xc1,0x25,0x2e,0x49,0xe7,0x90,0x1b,0xb4,0xcf,0x1e,0x61,0xd7,0x46, @@ -371,57 +455,78 @@ static UINT8 calc3_table01[64] = { }; /* ok - shogwarr */ -static UINT8 calc3_table15[64] = { +static UINT8 calc3_key15[64] = { 0x0C,0xEB,0x30,0x25,0xA8,0xED,0xE3,0x23,0xAC,0x2B,0x8D,0x34,0x88,0x9F,0x55,0xB5, 0xBF,0x15,0xE3,0x7C,0x54,0xD4,0x72,0xA9,0x7E,0x80,0x27,0x9F,0xA3,0x3F,0xA1,0x4D, 0x84,0x1B,0xD1,0xB2,0xB5,0xA7,0x0C,0xA0,0x51,0xE6,0x5E,0xC0,0xEB,0x68,0x22,0xD6, 0xC8,0xB6,0xCF,0x46,0x4B,0xF0,0x15,0xD7,0xB0,0xB5,0x29,0xB8,0xFD,0x43,0x5C,0xC0 }; + /* ok - brapboys initial transfer */ -static UINT8 calc3_table04[64] = { +static UINT8 calc3_key04[64] = { 0xff,0x4a,0x62,0xa3,0xf4,0xb4,0x8c,0x2d,0x84,0xbd,0x87,0x3a,0x9e,0xe9,0xd7,0x12, 0xff,0x50,0x40,0x39,0xa6,0x47,0xd9,0x38,0x89,0x3c,0x62,0xa0,0x86,0xe2,0xd7,0x4d, 0x9c,0x8e,0x45,0xe8,0x5b,0xe1,0xdd,0xaf,0x99,0xa8,0x47,0x79,0x67,0x00,0x38,0xf4, 0x43,0xbe,0x47,0x32,0x8f,0x0e,0xfd,0x64,0x42,0x59,0x2b,0xe5,0xde,0x6d,0x80,0x7a, }; - -/* partial guessed tables -unsigned char table31[64] = { - // x x x ok x x x ok x x x ok x x x ok - 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0xaf, 0x00, 0x00, 0x00, 0x3a, 0x00, 0x00, 0x00, 0x3b, - 0x00, 0x00, 0x00, 0xbb, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0xb1, 0x00, 0x00, 0x00, 0xdc, - 0x00, 0x00, 0x00, 0xb5, 0x00, 0x00, 0x00, 0x3d, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x00, 0x00, 0xde, - 0x00, 0x00, 0x00, 0x7e, 0x00, 0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0xb1 + static UINT8 calc3_key17[64] = { + 0x1b,0x48,0xa4,0xdd,0x2e,0x7a,0xe3,0xd1,0x6d,0x9e,0x49,0x31,0xdb,0x13,0xe6,0x00, + 0xf1,0x8f,0xcb,0x3f,0x23,0xc1,0xf3,0xb4,0x30,0x35,0xf4,0xea,0x2c,0x77,0x65,0x79, + 0x4e,0x7b,0x0e,0x87,0x79,0x3c,0xd1,0x8f,0x8b,0xa4,0x5a,0x61,0x68,0xac,0x87,0x6b, + 0xc4,0xc4,0x98,0x36,0xb3,0x75,0x16,0x33,0xf2,0x45,0x84,0xb8,0xf2,0xdb,0xc7,0x46, + }; + + static UINT8 calc3_key19[64] = { + 0x30,0x72,0xe0,0xca,0xa4,0xe5,0x41,0x44,0xd4,0xfe,0xe6,0x82,0x3e,0x85,0x18,0x30, + 0x50,0x17,0x9f,0x77,0xf8,0xcb,0xb0,0xc4,0xed,0x16,0x96,0xca,0xba,0xec,0x22,0xca, + 0x8f,0x28,0xd3,0x12,0xc6,0x2e,0xc4,0xc3,0x36,0xcf,0x59,0xd8,0x3a,0x6c,0xa7,0x64, + 0x7f,0x5f,0xa6,0x1b,0x90,0x96,0x19,0x14,0x22,0x81,0x38,0xcd,0x20,0x2f,0x22,0x70, }; - - -unsigned char tableb0[64] = { - // x x x ok x x x ok x x x ok x x x ok - 0x00, 0x00, 0x00, 0x5e, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x81, - 0x00, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x6d, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x32, - 0x00, 0x00, 0x00, 0x76, 0x00, 0x00, 0x00, 0xb2, 0x00, 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0xb2, 0x00, 0x00, 0x00, 0xe4, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x5b + + static UINT8 calc3_key24[64] = { + 0x75,0x49,0x7a,0xd6,0x84,0xbd,0x70,0xbe,0x10,0x19,0x6c,0xb2,0xa9,0x5f,0x6b,0x78, + 0x14,0x29,0x2a,0x15,0xd0,0x4a,0x10,0x93,0x69,0xb2,0xdf,0x02,0x7f,0x92,0x19,0xbd, + 0x95,0xc1,0x32,0xee,0x99,0x5e,0x7a,0x55,0x37,0xb7,0xc8,0x45,0xdc,0x6a,0xe6,0xef, + 0x8b,0xca,0xbe,0xe2,0x63,0x85,0x49,0xd3,0xeb,0x83,0x32,0x9a,0x23,0x11,0x4c,0x7e, + }; + +static UINT8 calc3_key31[64] = { + 0x02,0x21,0x0f,0xf2,0x98,0xc6,0xa7,0x51,0xbd,0x50,0xe6,0xc6,0x8d,0x15,0xb4,0xc5, + 0x18,0x99,0x78,0x45,0xeb,0xe4,0x09,0xfa,0x5c,0xa4,0x51,0x4f,0x98,0x02,0xc0,0x24, + 0x6d,0x44,0x77,0x4b,0xd7,0x26,0x2f,0xc3,0x4c,0xf8,0xee,0xb1,0xc7,0x76,0x68,0x22, + 0x94,0x6a,0x35,0x82,0xe0,0x02,0xb7,0xda,0xff,0xf2,0xc7,0xcc,0x7b,0x48,0x25,0x4f, +}; + + static UINT8 calc3_key39[64] = { + 0x7d,0xf8,0x54,0xc5,0x74,0xf6,0x54,0x1d,0x40,0xe1,0x71,0xc2,0xdd,0x03,0x72,0xdf, + 0x3b,0x77,0xa1,0x1c,0xc7,0xd6,0xb1,0x67,0xb7,0x13,0x6f,0xf4,0x18,0xa4,0x2a,0x82, + 0x98,0xe3,0xe3,0xe1,0x12,0xb3,0x33,0xb1,0xde,0x66,0xff,0x6c,0xd5,0xde,0xdd,0xa6, + 0x26,0xf3,0x44,0x94,0xdb,0x15,0x76,0xcc,0x28,0x33,0x2d,0x4b,0x79,0xdb,0x06,0xbc }; -unsigned char tableb7[64] = { - // x x x ok x x x ok x x x ok x x x ok - 0x00, 0x00, 0x00, 0x33, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x00, 0x00, 0xe0, 0x00, 0x00, 0x00, 0xd7, - 0x00, 0x00, 0x00, 0xe7, 0x00, 0x00, 0x00, 0x54, 0x00, 0x00, 0x00, 0x2b, 0x00, 0x00, 0x00, 0x82, - 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xa2, 0x00, 0x00, 0x00, 0xb4, 0x00, 0x00, 0x00, 0x26, - 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x9d, 0x00, 0x00, 0x00, 0x33 + static UINT8 calc3_key80[64] = { + 0x33,0x8e,0x6f,0x22,0xac,0x01,0x9f,0x7a,0xc7,0xca,0x23,0xc4,0xa4,0x9c,0x07,0xf8, + 0x98,0xc1,0x17,0x4a,0xb2,0xbc,0xcc,0xf4,0x0e,0x2e,0xf6,0x35,0xdd,0xf6,0x29,0x9a, + 0x2f,0x9c,0xe8,0x7c,0x86,0xf0,0x93,0xca,0x1a,0xee,0x10,0x08,0xec,0xe5,0x3a,0x98, + 0x8c,0xd8,0x0d,0x39,0xaa,0x25,0x8d,0xcd,0x5d,0x64,0x7a,0x5f,0x35,0x92,0xb5,0x64, }; -unsigned char tablebb[64] = { - // x x x ok x x x ok x x x ok x x x ok - 0x00, 0x00, 0x00, 0x62, 0x00, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x00, 0xf8, 0x00, 0x00, 0x00, 0x3d, - 0x00, 0x00, 0x00, 0xec, 0x00, 0x00, 0x00, 0x99, 0x00, 0x00, 0x00, 0xa0, 0x00, 0x00, 0x00, 0x69, - 0x00, 0x00, 0x00, 0xeb, 0x00, 0x00, 0x00, 0x6f, 0x00, 0x00, 0x00, 0x97, 0x00, 0x00, 0x00, 0x9e, - 0x00, 0x00, 0x00, 0xe1, 0x00, 0x00, 0x00, 0x9f, 0x00, 0x00, 0x00, 0xfd, 0x00, 0x00, 0x00, 0x4d + static UINT8 calc3_key89[64] = { + 0xdd,0xa9,0x15,0x18,0x9d,0x01,0x24,0x9c,0xed,0x7a,0xeb,0x42,0x8b,0x9e,0xf3,0x72, + 0x26,0xc9,0x45,0x18,0xea,0xd2,0x54,0x5f,0xcf,0xed,0xac,0xbc,0xa1,0xd0,0x5f,0x2f, + 0xce,0x15,0x2a,0xc6,0xf1,0xe0,0x69,0x62,0x22,0xc1,0xc0,0xbd,0xfa,0xdc,0x85,0xac, + 0x67,0x47,0xee,0xa2,0x35,0xb3,0xff,0x76,0x57,0x4f,0x30,0x66,0xf8,0xe9,0xe0,0x5b, }; -*/ +static UINT8 calc3_keybc[64] = { + 0xb8,0x8a,0xa5,0x8f,0x58,0x30,0xb0,0x38,0xa6,0x53,0x84,0x33,0xd4,0xd7,0xbd,0x26, + 0x45,0x35,0xb7,0xf6,0x1a,0x20,0x7b,0x8d,0x7e,0x68,0x69,0xdb,0xb1,0x1e,0xa5,0x1a, + 0xd5,0xf9,0x42,0x57,0x7a,0xf8,0x30,0x2e,0xea,0x49,0xe5,0xd5,0x34,0x6a,0xcd,0x5b, + 0xfa,0x8e,0x71,0x32,0xfa,0x42,0x69,0xec,0x5d,0x50,0x02,0x42,0xc2,0xe4,0xae,0x5a, + }; + // global so we can use them in the filename when we save out the data (debug..) static UINT8 calc3_decryption_key_byte; static UINT8 calc3_unknown; @@ -438,8 +543,10 @@ int calc3_decompress_table(running_machine* machine, int tabnum, UINT8* dstram, UINT16 length; int x; int offset = 0; - numregions = rom[offset+0]; + int isbrap = ( !strcmp(machine->gamedrv->name,"brapboysj") || !strcmp(machine->gamedrv->name,"brapboys")); + numregions = rom[offset+0]; + if (tabnum > numregions) { printf("CALC3 error, requested table > num tables!\n"); @@ -506,13 +613,95 @@ int calc3_decompress_table(running_machine* machine, int tabnum, UINT8* dstram, { for (i=0;i>1]; + dat = BITSWAP8(dat, 2,1,0,7,6,5,4,3); + + if (dat != rawData[i]) printf("ERROR %d y %02x %02x\n", (i / 19)&1, dat, rawData[i]); + + //dat = rawData[i]; + + } + } + else + { + if (((i%inline_table_size)&1)==0) + { + UINT8 inlinet = rom[inline_table_base + (i%inline_table_size)]; + dat = rom[offset+i]; + dat -= inlinet; + + dat = BITSWAP8(dat, 4,3,2,1,0,7,6,5); + if (dat != rawData[i]) printf("ERROR %d x %02x %02x\n", (i / 19)&1, dat, rawData[i]); + } + else + { + // shhould probably use the inline table somehow? + + UINT8 extra[] = { 0x2f, 0x04, 0xd1, 0x69, 0xad, 0xeb, 0x10, 0x95,0xb0 };; + dat = rom[offset+i]; + + dat -= extra[(i%inline_table_size)>>1]; + dat = BITSWAP8(dat, 2,1,0,7,6,5,4,3); + + if (dat != rawData[i]) printf("ERROR %d y %02x %02x\n", (i / 19)&1, dat, rawData[i]); + } + } + } + else if (tabnum==0x40) // fjbuster / shogun warriors japanese character select (what enables this extra?) { + UINT8 inlinet = rom[inline_table_base + (i%inline_table_size)]; + dat = rom[offset+i]; + //printf("%02x, ",inlinet); + dat -= inlinet; + // note the original, table is an odd number of words, so we can't just check if i is odd / even because the additional overlay // is relative to the start of the original table, and has a size of 0x11 (17) bytes which loop. if (((i%inline_table_size)&1)==0) @@ -532,15 +721,24 @@ int calc3_decompress_table(running_machine* machine, int tabnum, UINT8* dstram, } else { - UINT8* table = calc3_table00; + UINT8* key = calc3_key00; // 0x00 seems to have no 'encryption' - if (calc3_decryption_key_byte == 0x00) table = calc3_table00; + if (calc3_decryption_key_byte == 0x00) key = calc3_key00; + + // each key seems to relate directly to a 0x40 byte decryption table, only these ones handled so far + if (calc3_decryption_key_byte == 0x01) key = calc3_key01; + if (calc3_decryption_key_byte == 0x04) key = calc3_key04; + if (calc3_decryption_key_byte == 0x15) key = calc3_key15; + if (calc3_decryption_key_byte == 0x17) key = calc3_key17; + if (calc3_decryption_key_byte == 0x19) key = calc3_key19; + if (calc3_decryption_key_byte == 0x24) key = calc3_key24; + if (calc3_decryption_key_byte == 0x31) key = calc3_key31; + if (calc3_decryption_key_byte == 0x39) key = calc3_key39; + if (calc3_decryption_key_byte == 0x80) key = calc3_key80; + if (calc3_decryption_key_byte == 0x89) key = calc3_key89; + if (calc3_decryption_key_byte == 0xbc) key = calc3_keybc; - // currently only handle 3 of the formats :-( - if (calc3_decryption_key_byte == 0x01) table = calc3_table01; - if (calc3_decryption_key_byte == 0x15) table = calc3_table15; - if (calc3_decryption_key_byte == 0x04) table = calc3_table04; for (i=0;i>1) + 6] << 16) | (kaneko16_mcu_ram[(0>>1) + 7]); - printf("Calc 3 Init Command - %04x DSW addr\n", calc3_dsw_addr); + printf("Calc 3 Init Command - %04x DSW addr\n", calc3_dsw_addr); printf("Calc 3 Init Command - %04x Eeprom Address\n", calc3_eeprom_addr); printf("Calc 3 Init Command - %04x Future Commands Base\n", calc3_mcu_command_offset); printf("Calc 3 Init Command - %04x Poll / Busy Address\n", calc3_poll_addr); printf("Calc 3 Init Command - %04x ROM Checksum Address\n", cakc3_checkumaddress); printf("Calc 3 Init Command - %08x Data Write Address\n", calc3_writeaddress); - kaneko16_mcu_ram[calc3_dsw_addr/2] = ~input_port_read(machine, "DSW1"); // DSW + kaneko16_mcu_ram[calc3_dsw_addr/2] = ~input_port_read(machine, "DSW1"); // DSW // dsw actually updates in realtime - mcu reads+writes it every frame kaneko16_mcu_ram[cakc3_checkumaddress / 2] = calc3_mcu_crc; // MCU Rom Checksum! for (i=0;i<0x40;i++) @@ -832,14 +1063,40 @@ static void calc3_mcu_run(running_machine *machine) // cause an additional displacement to cause the writeback address to populate that table.. maybe if (commandunk == 0x30) { + int length; commandaddr -= 0x60; - calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_mcu_ram, (calc3_writeaddress&0xffff)-2); + length = calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_mcu_ram, (calc3_writeaddress&0xffff)-2); printf("writing back address %08x to %08x\n", calc3_writeaddress, commandaddr); kaneko16_mcu_ram[(commandaddr>>1)+0] = (calc3_writeaddress>>16)&0xffff; kaneko16_mcu_ram[(commandaddr>>1)+1] = (calc3_writeaddress&0xffff); + calc3_writeaddress += length; + + } + else if (commandunk == 0xa0) + { + int length; + commandaddr -= 0x6d; + length = calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_mcu_ram, (calc3_writeaddress&0xffff)-2); + printf("writing back address %08x to %08x\n", calc3_writeaddress, commandaddr); + kaneko16_mcu_ram[(commandaddr>>1)+0] = (calc3_writeaddress>>16)&0xffff; + kaneko16_mcu_ram[(commandaddr>>1)+1] = (calc3_writeaddress&0xffff); + calc3_writeaddress += length; } + else if (commandunk == 0x98) + { + int length; + commandaddr -= (0x6d+0xd); + length = calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_mcu_ram, (calc3_writeaddress&0xffff)-2); + + printf("writing back address %08x to %08x\n", calc3_writeaddress, commandaddr); + kaneko16_mcu_ram[(commandaddr>>1)+0] = (calc3_writeaddress>>16)&0xffff; + kaneko16_mcu_ram[(commandaddr>>1)+1] = (calc3_writeaddress&0xffff); + calc3_writeaddress += length; + } + + else { calc3_decompress_table(machine, commandtabl, (UINT8*)kaneko16_calc3_fakeram, fakeoffs&0xfffff); -- cgit v1.2.3