From c941b34eafc608a43e58e217bf7547b9dc938b6d Mon Sep 17 00:00:00 2001 From: Olivier Galibert Date: Tue, 2 Dec 2014 21:38:37 +0100 Subject: New NOT WORKING: House of the Dead 4 (Export) [soyandroid, Guru] Virtua Fighter 5 (Export) [soyandroid] After Burner Climax (Export) [soyandroid] Let's Go Jungle (Export) [soyandroid] Outrun 2 SP SDX [soyandroid] Power Smash 3 / Virtua Tennis 3 (Export) [soyandroid] Virtua Tennis 3 (Japan) [Guru] Initial D4 (Rev D) [Guru] Initial D4 (Rev C) [Guru] Sega Race-TV (Export) [soyandroid, Guru] House of the Dead EX (Japan) [soyandroid] Rambo (Export) [soyandroid, Guru] Hummer Extreme [soyandroid] VBios updater [Guru] --- src/mame/drivers/lindbergh.c | 208 ++++++++++++++++++++++++++++++++++++++++--- src/mame/mame.lst | 15 +++- 2 files changed, 210 insertions(+), 13 deletions(-) diff --git a/src/mame/drivers/lindbergh.c b/src/mame/drivers/lindbergh.c index ef29ab1b4c0..5fdee6a3dcf 100644 --- a/src/mame/drivers/lindbergh.c +++ b/src/mame/drivers/lindbergh.c @@ -24,6 +24,39 @@ The familiar PIC is still present on the back of the system and likely decrypts On this red box the CPU is a Celeron D at 2.8GHz. RAM is 512M DDR PC3200 The box has Sega number 845-0001D-02 + +Security +-------- + +The security seems to work in multiple steps. The information there +is a combination of our research and things found on the internet. + +- At boot, the bios unlocks the CF card through an IDE 0x82 command + with a currently unknown key. There is also a hardware heartbeat + signal on the IDE bus to avoid hotswapping. + +- The system boots on the CF which holds a customized Montavista linux. + +- The CF system can either install the game (from the DVD) or start it (on the HD) + +- The DVD is decrypted (probably on-the-fly with aesloop) using a + fixed system key (all the dvd images start identically). + +- The PIC includes an AES-CBC engine and has as data an IV, a key, + some game-specific identification information, and two pre and + post-whitening values. Everything but the key is dumpable through + commands, but the key seems well-protected. It's not realistic to + decrypt very large amounts of data through it though, the bandwidth + would be way too low. + +- The HD is probably unlocked by the CF and bootstrap code is + decrypted through the PIC. That code in turn loop-decrypts/mounts all the + data needed from the partition (probably /usr, /X11R6 and /home). + +Currently, we do not have access to the CF image, making it impossible +to do a complete boot/install. + + Lindbergh Game List ------------------- Security @@ -371,21 +404,172 @@ static MACHINE_CONFIG_START(lindbergh, lindbergh_state) MCFG_AC97_ADD( ":pci:1f.5", 0x808625a6, 0x02, 0x103382c0) MACHINE_CONFIG_END +#define LINDBERGH_BIOS \ + ROM_REGION32_LE(0x100000, ":pci:1f.0", 0) /* PC bios, location 3j7 */ \ + ROM_SYSTEM_BIOS(0, "bios0", "6.0.0010 alternate version") \ + ROMX_LOAD("6.0.0010a.bin", 0x00000, 0x100000, CRC(10dd9b76) SHA1(1fdf1f921bc395846a7c3180fbdbc4ca287a9670), ROM_BIOS(1) ) \ + ROM_SYSTEM_BIOS(1, "bios1", "6.0.0009") \ + ROMX_LOAD("6.0.0009.bin", 0x00000, 0x100000, CRC(5ffdfbf8) SHA1(605bc4967b749b4e6d13fc2ebb845ba956a259a7), ROM_BIOS(2) ) \ + ROM_SYSTEM_BIOS(2, "bios2", "6.0.0010") \ + ROMX_LOAD("6.0.0010.bin", 0x00000, 0x100000, CRC(ea2bf888) SHA1(c9c5b6f0d4f4f36620939b15dd2f128a74347e37), ROM_BIOS(3) ) \ +\ + ROM_REGION(0x400000, ":pci:1e.0:03.0", 0) /* Baseboard MPC firmware */ \ + ROM_LOAD("fpr-24370b.ic6", 0x000000, 0x400000, CRC(c3b021a4) SHA1(1b6938a50fe0e4ae813864649eb103838c399ac0)) \ +\ + ROM_REGION32_LE(0x10000, ":pci:01.0:00.0", 0) /* Geforce bios extension (custom or standard?) */ \ + ROM_LOAD("vid_bios.u504", 0x00000, 0x10000, CRC(f78d14d7) SHA1(f129787e487984edd23bf344f2e9500c85052275)) \ + ROM_START(lindbios) - ROM_REGION32_LE(0x100000, ":pci:1f.0", 0) // PC bios, location 3j7 - ROM_SYSTEM_BIOS(0, "bios0", "6.0.0010 alternate version") - ROMX_LOAD("6.0.0010a.bin", 0x00000, 0x100000, CRC(10dd9b76) SHA1(1fdf1f921bc395846a7c3180fbdbc4ca287a9670), ROM_BIOS(1) ) - ROM_SYSTEM_BIOS(1, "bios1", "6.0.0009") - ROMX_LOAD("6.0.0009.bin", 0x00000, 0x100000, CRC(5ffdfbf8) SHA1(605bc4967b749b4e6d13fc2ebb845ba956a259a7), ROM_BIOS(2) ) - ROM_SYSTEM_BIOS(2, "bios2", "6.0.0010") - ROMX_LOAD("6.0.0010.bin", 0x00000, 0x100000, CRC(ea2bf888) SHA1(c9c5b6f0d4f4f36620939b15dd2f128a74347e37), ROM_BIOS(3) ) + LINDBERGH_BIOS +ROM_END + +ROM_START(hotd4) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0427 / 317-0427-COM + ROM_LOAD("317-0427-com.bin", 0, 0x2000, CRC(ef4a120c) SHA1(fcc0386fa708af9e010e40e1d259a6bd95e8b9e2)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0003a", 0, SHA1(46544e28735f55418dd78bd19446093874438264)) +ROM_END + +ROM_START(vf5) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0438 / 317-0438-COM + ROM_LOAD("317-0438-com.bin", 0, 0x2000, CRC(9aeb15d3) SHA1(405ddc44b2b40b72cfe2a081a0d5e43ceb9a380e)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0008e", 0, NO_DUMP) +ROM_END + +ROM_START(abclimax) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0440 / 317-0440-COM + ROM_LOAD("317-0440-com.bin", 0, 0x2000, CRC(8d09e717) SHA1(6b25982f7042541874115d33ea5d0c028140a962)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0009", 0, NO_DUMP) +ROM_END + +ROM_START(letsgoju) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0442 / 317-0442-COM + ROM_LOAD("317-0442-com.bin", 0, 0x2000, CRC(b706efbb) SHA1(97c2b65e521113c5201f0b588fcb37a39148a637)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0011", 0, NO_DUMP) +ROM_END + +ROM_START(outr2sdx) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0452 / 317-0452-COM (to verify, may be the one for OutRun 2 Special Tours) + ROM_LOAD("317-0452-com.bin", 0, 0x2000, CRC(f5b7bb3f) SHA1(6b179b255b3d29e5ce61902eeae4da07177a2943)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0015a", 0, NO_DUMP) +ROM_END + +ROM_START(psmash3) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0434 / 317-0434-COM + ROM_LOAD("317-0434-com.bin", 0, 0x2000, CRC(70e3b202) SHA1(4925a288f937d54529abe6ef467c9c23674e47f0)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0005a", 0, NO_DUMP) +ROM_END + +ROM_START(vtennis3) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0506 / 317-0506-JPN + ROM_LOAD("317-0506-jpn.bin", 0, 0x2000, NO_DUMP) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0005c", 0, SHA1(1fd689753c4b70dff0286cb7f623ee7fd439db62)) +ROM_END + + +ROM_START(initiad4) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0486E / 317-0486-COM + ROM_LOAD("317-0846-com.bin", 0, 0x2000, NO_DUMP) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0030d", 0, SHA1(e43e6d22fab4eceb81db8309e4634e049d9c41e6)) +ROM_END + +ROM_START(initiad4c) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0486E / 317-0486-COM + ROM_LOAD("317-0846-com.bin", 0, 0x2000, NO_DUMP) + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0030c", 0, SHA1(b1919f28539afec4c4bc52357e5210a090b5ae32)) +ROM_END + +ROM_START(segartv) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0504 / 317-0504-COM + ROM_LOAD("317-0504-com.bin", 0, 0x2000, CRC(ae7eaea8) SHA1(187e417e0b5543d95245364b547925426aa9f80e)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0044", 0, SHA1(914aa23ece8aaf0f1942f77272b3a87d10f7a7db)) +ROM_END + +ROM_START(hotdex) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0550 / 317-0550-JPN + ROM_LOAD("317-0550-jpn.bin", 0, 0x2000, CRC(7e247f13) SHA1(d416b0e7742b32eb31443967e84ef93fc9e56dfb)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("hotdex", 0, NO_DUMP) +ROM_END + +ROM_START(rambo) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security 253-5508-0540 / 317-0540-COM + ROM_LOAD("317-0540-com.bin", 0, 0x2000, CRC(fd9a7bc0) SHA1(140b05573e25a41c1237c7a96c8e099efbfd75b8)) + + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0069", 0, SHA1(1f3401b652c45db2b843360aff9cda862c2832c0)) +ROM_END + +ROM_START(hummerxt) + LINDBERGH_BIOS + + ROM_REGION(0x2000, ":pic", 0) // PIC security id unknown + ROM_LOAD("hummerextreme.bin", 0, 0x2000, CRC(524bc69a) SHA1(c79b6bd384196c169e40e623f4c80c8b9eb11f81)) +ROM_END - ROM_REGION(0x400000, ":pci:1e.0:03.0", 0) // Baseboard MPC firmware - ROM_LOAD("fpr-24370b.ic6", 0x000000, 0x400000, CRC(c3b021a4) SHA1(1b6938a50fe0e4ae813864649eb103838c399ac0)) +ROM_START(lbvbiosu) + LINDBERGH_BIOS - ROM_REGION32_LE(0x10000, ":pci:01.0:00.0", 0) // Geforce bios extension (custom or standard?) - ROM_LOAD("vid_bios.u504", 0x00000, 0x10000, CRC(f78d14d7) SHA1(f129787e487984edd23bf344f2e9500c85052275)) + DISK_REGION("dvd") + DISK_IMAGE_READONLY("dvp-0021b", 0, SHA1(362ac028ba19ba4762678953a033034a5ee8ad53)) ROM_END -GAME(1999, lindbios, 0, lindbergh, 0, driver_device, 0, ROT0, "Sega Lindbergh", "Sega Lindbergh Bios", GAME_IS_SKELETON) +GAME(1999, lindbios, 0, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Sega Lindbergh Bios", GAME_IS_BIOS_ROOT) +GAME(2005, hotd4, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "House of the Dead 4 (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2005, vf5, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Virtua Fighter 5 (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2006, abclimax, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "After Burner Climax (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2006, letsgoju, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Let's Go Jungle (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2006, outr2sdx, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Outrun 2 SP SDX", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2006, psmash3, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Power Smash 3 / Virtua Tennis 3 (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2006, vtennis3, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Virtua Tennis 3 (Japan)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2007, initiad4, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Initial D4 (Rev D)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2007, initiad4c, initiad4, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Initial D4 (Rev C)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2007, segartv, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Sega Race-TV (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2008, hotdex, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "House of the Dead EX (Japan)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2008, rambo, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Rambo (Export)", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(2009, hummerxt, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "Hummer Extreme", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) +GAME(200?, lbvbiosu, lindbios, lindbergh, 0, driver_device, 0, ROT0, "Sega", "VBios updater", GAME_NOT_WORKING|GAME_UNEMULATED_PROTECTION|GAME_NO_SOUND) diff --git a/src/mame/mame.lst b/src/mame/mame.lst index dbb309621c0..c160c4d3085 100644 --- a/src/mame/mame.lst +++ b/src/mame/mame.lst @@ -5102,7 +5102,20 @@ ecap // 1999.12 Emergency Call Ambulance - US proto or location test // Sega Lindbergh games lindbios - +hotd4 +vf5 +abclimax +letsgoju +outr2sdx +psmash3 +vtennis3 +initiad4 +initiad4c +segartv +hotdex +rambo +hummerxt +lbvbiosu // Deniam games // they run on Sega System 16 video hardware -- cgit v1.2.3