1 // license:BSD-3-Clause
2 // copyright-holders:David Haywood, Xing Xing, Andreas Naive
3 /* PGM 2 hardware.
4
5 Motherboard is bare bones stuff, and does not contain any ROMs.
6 The IGS036 used by the games is an ARM based CPU, like IGS027A used on PGM1 it has internal ROM.
7 Decryption should be correct in most cases.
8 The ARM appears to be ARMv5T, probably an ARM9.
9
10 PGM2 Motherboard Components:
11
12 IS61LV25616AL(SRAM)
13 IGS037(GFX PROCESSOR)
14 YMZ774-S(SOUND)
15 R5F21256SN(extra MCU for ICcard communication)
16 - Appears to be referred to by the games as MPU
17
18 Cartridges
19 IGS036 (MAIN CPU) (differs per game, internal code)
20 ROMs
21 Custom program ROM module (KOV3 only)
22 - on some games ROM socket contains Flash ROM + SRAM
23
24 QFP100 chip (Xlinx CPLD)
25
26 Single PCB versions of some of the titles were also available
27
28 Only 5 Games were released for this platform, 3 of which are just updates / re-releases of older titles!
29 The platform has since been superseded by PGM3, see pgm3.cpp
30
31 Oriental Legend 2
32 The King of Fighters '98 - Ultimate Match - Hero
33 Knights of Valour 2 New Legend
34 Dodonpachi Daioujou Tamashii
35 Knights of Valour 3
36
37 These were only released as single board PGM2 based hardware, seen for sale in Japan for around $250-$300
38
39 Jigsaw World Arena
40 Puzzle of Ocha / Ochainu No Pazuru
41
42
43 ToDo (emulation issues):
44
45 Support remaining games (need IGS036 dumps)
46 Identify which regions each game was released in and either dump alt. internal ROMs for each region, or
47 create them until that can be done.
48 properly implement RTC (integrated into the CPU)
49 Verify Sprite Zoom (check exactly which pixels are doubled / missed on hardware for flipped , non-flipped cases etc.)
50 Fix Save States (is this a driver problem or an ARM core problem, they don't work unless you get through the startup tests)
51 Determine motherboard card reader MCU internal ROM size and add as NO_DUMP to the sets
52 See if kov2nl needs another idle skip, after Game Over there is a period where the current one is ineffective
53
54 Debug features (require DIP SW1:8 On and SW1:1 Off):
55 - QC TEST mode: hold P1 A+B during boot
56 - Debug/Cheat mode: hold P1 B+C during boot
57 orleg2 and kov2nl: when ingame pressing P1 Start skips to next location, where might be more unknown debug features.
58
59
60 Holographic Stickers
61
62 The IGS036 CPUs have holographic stickers on them, there is a number printed on each sticker but it doesn't seem connected to the
63 game code / revision contained within, it might just be to mark the date the board was produced as it seems to coincide with the
64 design of the hologram. For reference the ones being used for dumping are
65
66 Dodonpachi Daioujou Tamashi (China) - W10
67 King of Fighter 98 UMH (China) - C11
68 Knights of Valour 2 (China) - V21
69 Knights of Valour 3 (China) - V21
70 Oriental Legend 2 (Oversea) - V21
71 Oriental Legend 2 (China) - A8
72
73 GPU registers, located at 301200xx, 16bit access.
74 00 - bg scroll x
75 02 - bg scroll y
76 04 - zoom something, 0F-7F, default 1F
77 06 - zoom something, 0F-7F, default 1F
78 08 - fg scroll x
79 0a - fg scroll y
80 0e - resolution, 0 - low (kof98umh), 1 - high (rest of games), 2 - higher (kov3)
81 10 - ? orleg2 - 0x13, kov2nl, kov3, kof98umh, ddpdojt - 0x14 at init
82 14 - sprite enable ? set to 0 before spriteram update, to 1 after
83 16 - set to 1 before access to vrams/palettes, reset after. bits: 0 - bg RAM and palette, 1 - fg RAM and palette, 2 - sprite palette.
84 18 - vblank ack
85 1a - ? 0 at init
86 1c - ? orleg2 - 5, kov2nl, kov3, kof98umh, ddpdojt - 7 at init
87 1e - ? 2 at init
88 32 - shared RAM bank
89 34, 36 - ? 0 at init
90 38, 3a - sprite mask xor key
91
92 */
93
94 #include "emu.h"
95 #include "includes/pgm2.h"
96
97 // checked on startup, or doesn't boot
unk_startup_r()98 u32 pgm2_state::unk_startup_r()
99 {
100 logerror("%s: unk_startup_r\n", machine().describe_context().c_str());
101 return 0x00000180;
102 }
103
rtc_r()104 u32 pgm2_state::rtc_r()
105 {
106 // write to FFFFFD20 if bit 18 set (0x40000) probably reset this RTC timer
107 // TODO: somehow hook here current time/date, which is a bit complicated because value is relative, later to it added "base time" stored in SRAM
108 return machine().time().seconds();
109 }
110
encryption_r(offs_t offset)111 u8 pgm2_state::encryption_r(offs_t offset)
112 {
113 return m_encryption_table[offset];
114 }
115
encryption_w(offs_t offset,u8 data)116 void pgm2_state::encryption_w(offs_t offset, u8 data)
117 {
118 m_encryption_table[offset] = data;
119 }
120
sprite_encryption_w(offs_t offset,u32 data,u32 mem_mask)121 void pgm2_state::sprite_encryption_w(offs_t offset, u32 data, u32 mem_mask)
122 {
123 COMBINE_DATA(&m_spritekey);
124
125 if (!m_sprite_predecrypted)
126 m_realspritekey = bitswap<32>(m_spritekey ^ 0x90055555, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31);
127 }
128
device_post_load()129 void pgm2_state::device_post_load()
130 {
131 // make sure the encrypted area is in the correct state after we load a savestate because we don't want to have to save the whole rom.
132
133 memcpy(m_mainrom->base(), &m_encrypted_copy[0], m_mainrom->bytes());
134
135 if (m_has_decrypted_kov3_module)
136 {
137 decrypt_kov3_module(module_key->addr_xor, module_key->data_xor);
138 }
139
140 if (m_has_decrypted)
141 {
142 igs036_decryptor decrypter(m_encryption_table);
143
144 if (m_romboard_ram)
145 {
146 decrypter.decrypter_rom((u16*)m_mainrom->base(), m_mainrom->bytes(), m_romboard_ram.bytes());
147 }
148 else
149 {
150 decrypter.decrypter_rom((u16*)m_mainrom->base(), m_mainrom->bytes(), 0);
151 }
152 }
153 }
154
encryption_do_w(u32 data)155 void pgm2_state::encryption_do_w(u32 data)
156 {
157 igs036_decryptor decrypter(m_encryption_table);
158 if (m_romboard_ram)
159 {
160 decrypter.decrypter_rom((u16*)&m_romboard_ram[0], m_romboard_ram.bytes(), 0);
161 decrypter.decrypter_rom((u16*)m_mainrom->base(), m_mainrom->bytes(), m_romboard_ram.bytes()); // assume the rom at 0x0200000 also gets decrypted as if it was at 0x0200000 even if it isn't used (the game has already copied it to RAM where it properly decrypted)
162 }
163 else
164 {
165 decrypter.decrypter_rom((u16*)m_mainrom->base(), m_mainrom->bytes(), 0);
166 }
167 m_has_decrypted = true;
168 }
169
170
share_bank_w(offs_t offset,u16 data,u16 mem_mask)171 void pgm2_state::share_bank_w(offs_t offset, u16 data, u16 mem_mask)
172 {
173 COMBINE_DATA(&m_share_bank);
174 }
175
shareram_r(offs_t offset)176 u8 pgm2_state::shareram_r(offs_t offset)
177 {
178 return m_shareram[offset + (m_share_bank & 1) * 128];
179 }
shareram_w(offs_t offset,u8 data)180 void pgm2_state::shareram_w(offs_t offset, u8 data)
181 {
182 m_shareram[offset + (m_share_bank & 1) * 128] = data;
183 }
184
185
TIMER_DEVICE_CALLBACK_MEMBER(pgm2_state::mcu_interrupt)186 TIMER_DEVICE_CALLBACK_MEMBER(pgm2_state::mcu_interrupt)
187 {
188 m_arm_aic->set_irq(3, ASSERT_LINE);
189 }
190
191 // "MPU" MCU HLE starts here
192 // command delays are far from correct, might not work in other games
193 // command results probably incorrect (except for explicit checked bytes)
mcu_command(bool is_command)194 void pgm2_state::mcu_command(bool is_command)
195 {
196 u8 const cmd = m_mcu_regs[0] & 0xff;
197 // if (is_command && cmd != 0xf6)
198 // logerror("MCU command %08x %08x\n", m_mcu_regs[0], m_mcu_regs[1]);
199
200 if (is_command)
201 {
202 m_mcu_last_cmd = cmd;
203 u8 status = 0xf7; // "command accepted" status
204 int delay = 1;
205
206 u8 arg1 = m_mcu_regs[0] >> 8;
207 u8 arg2 = m_mcu_regs[0] >> 16;
208 u8 arg3 = m_mcu_regs[0] >> 24;
209 switch (cmd)
210 {
211 case 0xf6: // get result
212 m_mcu_regs[3] = m_mcu_result0;
213 m_mcu_regs[4] = m_mcu_result1;
214 m_mcu_last_cmd = 0;
215 break;
216 case 0xe0: // command port test
217 m_mcu_result0 = m_mcu_regs[0];
218 m_mcu_result1 = m_mcu_regs[1];
219 break;
220 case 0xe1: // shared RAM access (unimplemented)
221 {
222 // MCU access to RAM shared at 0x30100000, 2x banks, in the same time CPU and MCU access different banks
223 u8 mode = m_mcu_regs[0] >> 16; // 0 - ???, 1 - read, 2 - write
224 u8 data = m_mcu_regs[0] >> 24;
225 if (mode == 2)
226 {
227 // where is offset ? so far assume this command fill whole page
228 memset(&m_shareram[(~m_share_bank & 1) * 128], data, 128);
229 }
230 m_mcu_result0 = cmd;
231 m_mcu_result1 = 0;
232 }
233 break;
234 // C0-C9 commands is IC Card RW comms
235 case 0xc0: // insert card or/and check card presence. result: F7 - ok, F4 - no card
236 if (m_memcard[arg1 & 3]->present() == -1)
237 status = 0xf4;
238 m_mcu_result0 = cmd;
239 break;
240 case 0xc1: // check ready/busy ?
241 if (m_memcard[arg1 & 3]->present() == -1)
242 status = 0xf4;
243 m_mcu_result0 = cmd;
244 break;
245 case 0xc2: // read data to shared RAM
246 for (int i = 0; i < arg3; i++)
247 {
248 if (m_memcard[arg1 & 3]->present() != -1)
249 m_shareram[i + (~m_share_bank & 1) * 128] = m_memcard[arg1 & 3]->read(arg2 + i);
250 else
251 status = 0xf4;
252 }
253 m_mcu_result0 = cmd;
254 break;
255 case 0xc3: // save data from shared RAM
256 for (int i = 0; i < arg3; i++)
257 {
258 if (m_memcard[arg1 & 3]->present() != -1)
259 m_memcard[arg1 & 3]->write(arg2 + i, m_shareram[i + (~m_share_bank & 1) * 128]);
260 else
261 status = 0xf4;
262 }
263 m_mcu_result0 = cmd;
264 break;
265 case 0xc4: // presumable read security mem (password only?)
266 if (m_memcard[arg1 & 3]->present() != -1)
267 {
268 m_mcu_result1 = m_memcard[arg1 & 3]->read_sec(1) |
269 (m_memcard[arg1 & 3]->read_sec(2) << 8) |
270 (m_memcard[arg1 & 3]->read_sec(3) << 16);
271 }
272 else
273 status = 0xf4;
274 m_mcu_result0 = cmd;
275 break;
276 case 0xc5: // write security mem
277 if (m_memcard[arg1 & 3]->present() != -1)
278 m_memcard[arg1 & 3]->write_sec(arg2 & 3, arg3);
279 else
280 status = 0xf4;
281 m_mcu_result0 = cmd;
282 break;
283 case 0xc6: // presumable write protection mem
284 if (m_memcard[arg1 & 3]->present() != -1)
285 m_memcard[arg1 & 3]->write_prot(arg2 & 3, arg3);
286 else
287 status = 0xf4;
288 m_mcu_result0 = cmd;
289 break;
290 case 0xc7: // read protection mem
291 if (m_memcard[arg1 & 3]->present() != -1)
292 {
293 m_mcu_result1 = m_memcard[arg1 & 3]->read_prot(0) |
294 (m_memcard[arg1 & 3]->read_prot(1) << 8) |
295 (m_memcard[arg1 & 3]->read_prot(2) << 16) |
296 (m_memcard[arg1 & 3]->read_prot(3) << 24);
297 }
298 else
299 status = 0xf4;
300 m_mcu_result0 = cmd;
301 break;
302 case 0xc8: // write data mem
303 if (m_memcard[arg1 & 3]->present() != -1)
304 m_memcard[arg1 & 3]->write(arg2, arg3);
305 else
306 status = 0xf4;
307 m_mcu_result0 = cmd;
308 break;
309 case 0xc9: // card authentication
310 if (m_memcard[arg1 & 3]->present() != -1)
311 m_memcard[arg1 & 3]->auth(arg2, arg3, m_mcu_regs[1] & 0xff);
312 else
313 status = 0xf4;
314 m_mcu_result0 = cmd;
315 break;
316 default:
317 logerror("MCU unknown command %08x %08x\n", m_mcu_regs[0], m_mcu_regs[1]);
318 status = 0xf4; // error
319 break;
320 }
321 m_mcu_regs[3] = (m_mcu_regs[3] & 0xff00ffff) | (status << 16);
322 m_mcu_timer->adjust(attotime::from_msec(delay));
323 }
324 else // next step
325 {
326 if (m_mcu_last_cmd)
327 {
328 m_mcu_regs[3] = (m_mcu_regs[3] & 0xff00ffff) | 0x00F20000; // set "command done and return data" status
329 m_mcu_timer->adjust(attotime::from_usec(100));
330 m_mcu_last_cmd = 0;
331 }
332 }
333 }
334
mcu_r(offs_t offset)335 u32 pgm2_state::mcu_r(offs_t offset)
336 {
337 return m_mcu_regs[(offset >> 15) & 7];
338 }
339
mcu_w(offs_t offset,u32 data,u32 mem_mask)340 void pgm2_state::mcu_w(offs_t offset, u32 data, u32 mem_mask)
341 {
342 int reg = (offset >> 15) & 7;
343 COMBINE_DATA(&m_mcu_regs[reg]);
344
345 if (reg == 2 && m_mcu_regs[2]) // irq to mcu
346 mcu_command(true);
347 if (reg == 5 && m_mcu_regs[5]) // ack to mcu (written at the end of irq handler routine)
348 {
349 mcu_command(false);
350 m_arm_aic->set_irq(3, CLEAR_LINE);
351 }
352 }
353
vbl_ack_w(u16 data)354 void pgm2_state::vbl_ack_w(u16 data)
355 {
356 m_arm_aic->set_irq(12, CLEAR_LINE);
357 }
358
unk30120014_w(offs_t offset,u16 data)359 void pgm2_state::unk30120014_w(offs_t offset, u16 data)
360 {
361 if (offset == 0)
362 {
363 // 0/1 toggles (maybe sprite dma triggers?)
364 }
365 else
366 {
367 // interesting data
368 //logerror("unk30120014_w %d %04x\n", offset, data);
369 }
370 }
371
372 /*
373 KOV3 ROM board uses special module intead of program ROM, tiny PCB with IC stamped "HW1" (might be FPGA, CPLD or ASIC) and BGA Flash ROM stamped "IG-L".
374 This module uses few pins for serial comms (wired to IGS036 GPIO), it can not be dumped as regular ROM until special unlock procedure (return weird data pattern while locked).
375
376 In case of KOV3 unlock sequence is:
377 1) send via serial 0x0d and 64bit xor_value, result must be A3A3A3A36D6D6D6D
378 2) send via serial 0x25 and 64bit xor_value, result is 64bit key^xor_value
379 3) read first 10h bytes from ROM area (at this point ROM area read as scrambled or random data)
380 4) write "key" to ROM area, using 2x 16bit writes, offsets and data is bitfields of 64bit key:
381 u32 key0, key1;
382 u16 *rom = (u16*)0x10000000;
383 rom[((key0 & 0x3f) << 16) | (key1 >> 16)] = key1 & 0xffff;
384 rom[key0 >> 22] = (key0 >> 6) & 0xffff;
385 it is possible, 22bit address xor value derived from 1st write offset.
386 meaning of other 10bit offset and 2x data words is not clear - each of them can be either "key bits" or "magic word" expected by security device.
387 5) write static sequence of 4x words to ROM area, which switch module to special mode - next 4x reads will return checksum^key parts instead of rom data.
388 6) read checksum from ROM area 10000002-10000009
389 7) read first 10h bytes from ROM area and check they are not same as was at step 3)
390 8) perform whole ROM summing, result must match key^checksum read at step 6)
391
392 It is not clear if/how real address/data xor values derived from written "key",
393 or security chip just waiting to be be written magic value at specific address in ROM area, and if this happen enable descrambling using hardcoded values.
394 */
395
module_data_r()396 int pgm2_state::module_data_r()
397 {
398 return module_out_latch ? ASSERT_LINE : CLEAR_LINE;
399 }
module_data_w(int state)400 void pgm2_state::module_data_w(int state)
401 {
402 module_in_latch = (state == ASSERT_LINE) ? 1 : 0;
403 }
module_clk_w(int state)404 void pgm2_state::module_clk_w(int state)
405 {
406 if (module_prev_state != state && state == CLEAR_LINE)
407 {
408 if (module_clk_cnt < 80)
409 {
410 s8 const offs = module_clk_cnt / 8;
411 u8 const bit = (module_clk_cnt & 7) ^ 7;
412 module_rcv_buf[offs] &= ~(1 << bit);
413 module_rcv_buf[offs] |= module_in_latch << bit;
414
415 ++module_clk_cnt;
416 if (module_clk_cnt >= 80)
417 {
418 switch (module_rcv_buf[0])
419 {
420 case 0x0d: // init or status check
421 module_send_buf[0] = module_send_buf[1] = module_send_buf[2] = module_send_buf[3] = 0xa3;
422 module_send_buf[4] = module_send_buf[5] = module_send_buf[6] = module_send_buf[7] = 0x6d;
423 break;
424 case 0x25: // get key
425 for (int i = 0; i < 8; i++)
426 module_send_buf[i] = module_key->key[i ^ 3] ^ module_rcv_buf[i + 1];
427 break;
428 default:
429 logerror("unknown FPGA command %02X!\n", module_rcv_buf[0]);
430 break;
431 }
432
433 module_send_buf[8] = 0;
434 for (int i = 0; i < 8; i++) // sum reply bytes
435 module_send_buf[8] += module_send_buf[i];
436 }
437 }
438 else
439 {
440 s8 const offs = (module_clk_cnt - 80) / 8;
441 u8 const bit = (module_clk_cnt & 7) ^ 7;
442 module_out_latch = BIT(module_send_buf[offs], bit);
443 ++module_clk_cnt;
444 if (module_clk_cnt >= 152)
445 module_clk_cnt = 0;
446 }
447 }
448 module_prev_state = state;
449 }
450
module_rom_r(offs_t offset)451 u16 pgm2_state::module_rom_r(offs_t offset)
452 {
453 if (module_sum_read && offset > 0 && offset < 5) // checksum read mode
454 {
455 if (offset == 4)
456 module_sum_read = false;
457 u32 const offs = ((offset - 1) * 2) ^ 2;
458 return (module_key->sum[offs] ^ module_key->key[offs]) | ((module_key->sum[offs + 1] ^ module_key->key[offs + 1]) << 8);
459 }
460
461 return ((u16 *)m_mainrom->base())[offset];
462 }
463
module_rom_w(offs_t offset,u16 data)464 void pgm2_state::module_rom_w(offs_t offset, u16 data)
465 {
466 //logerror("module write %04X at %08X\n", data, offset);
467 u32 const dec_val = ((module_key->key[0] | (module_key->key[1] << 8) | (module_key->key[2] << 16)) >> 6) & 0xffff;
468 if (data == dec_val)
469 {
470 // might be wrong and normal data access enabled only after whole sequence complete
471 decrypt_kov3_module(module_key->addr_xor, module_key->data_xor);
472 }
473 else
474 switch (data)
475 {
476 // following might be wrong, and trigger is address or both
477 case 0x00c2: // checksum read mode enable, step 1 and 4
478 module_sum_read = true;
479 if (offset != 0xe5a7 && offset != 0xa521)
480 popmessage("module write %04X at %08X\n", data, offset);
481 break;
482 case 0x0084: // checksum read mode enable, step 2 and 3
483 if (offset != 0x5e7a && offset != 0x5a12)
484 popmessage("module write %04X at %08X\n", data, offset);
485 break;
486 default:
487 logerror("module write %04X at %08X\n", data, offset);
488 break;
489 }
490 }
491
492 // very primitive Atmel ARM PIO simulation, should be improved and devicified
pio_sodr_w(offs_t offset,u32 data,u32 mem_mask)493 void pgm2_state::pio_sodr_w(offs_t offset, u32 data, u32 mem_mask)
494 {
495 m_pio_out_data |= data & mem_mask;
496 module_data_w((m_pio_out_data & 0x100) ? ASSERT_LINE : CLEAR_LINE);
497 module_clk_w((m_pio_out_data & 0x200) ? ASSERT_LINE : CLEAR_LINE);
498 }
pio_codr_w(offs_t offset,u32 data,u32 mem_mask)499 void pgm2_state::pio_codr_w(offs_t offset, u32 data, u32 mem_mask)
500 {
501 m_pio_out_data &= ~(data & mem_mask);
502 module_data_w((m_pio_out_data & 0x100) ? ASSERT_LINE : CLEAR_LINE);
503 module_clk_w((m_pio_out_data & 0x200) ? ASSERT_LINE : CLEAR_LINE);
504 }
pio_pdsr_r()505 u32 pgm2_state::pio_pdsr_r()
506 {
507 return (module_data_r() == ASSERT_LINE ? 1 : 0) << 8; // fpga data read and status (bit 7, must be 0)
508 }
509
pgm2_map(address_map & map)510 void pgm2_state::pgm2_map(address_map &map)
511 {
512 map(0x00000000, 0x00003fff).rom(); //.region("mainrom", 0x00000); // internal ROM
513
514 map(0x02000000, 0x0200ffff).ram().share("sram"); // 'battery RAM' (in CPU?)
515
516 map(0x03600000, 0x036bffff).rw(FUNC(pgm2_state::mcu_r), FUNC(pgm2_state::mcu_w));
517
518 map(0x03900000, 0x03900003).portr("INPUTS0");
519 map(0x03a00000, 0x03a00003).portr("INPUTS1");
520
521 map(0x20000000, 0x2007ffff).ram().share("mainram");
522
523 map(0x30000000, 0x30001fff).ram().share("sp_videoram"); // spriteram ('move' RAM in test mode)
524
525 map(0x30020000, 0x30021fff).ram().w(FUNC(pgm2_state::bg_videoram_w)).share("bg_videoram");
526 map(0x30040000, 0x30045fff).ram().w(FUNC(pgm2_state::fg_videoram_w)).share("fg_videoram");
527
528 map(0x30060000, 0x30063fff).ram().w(m_sp_palette, FUNC(palette_device::write32)).share("sp_palette");
529
530 map(0x30080000, 0x30081fff).ram().w(m_bg_palette, FUNC(palette_device::write32)).share("bg_palette");
531
532 map(0x300a0000, 0x300a07ff).ram().w(m_tx_palette, FUNC(palette_device::write32)).share("tx_palette");
533
534 map(0x300c0000, 0x300c01ff).ram().share("sp_zoom"); // sprite zoom table - it uploads the same data 4x, maybe xshrink,xgrow,yshrink,ygrow or just redundant mirrors
535
536 /* linescroll RAM - it clears to 0x3bf on startup which is enough bytes for 240 lines if each rowscroll value was 8 bytes, but each row is 4,
537 so only half of this is used? or tx can do it too (unlikely, as orl2 writes 256 lines of data) maybe just bad mem check bounds on orleg2.
538 It reports pass even if it fails the first byte but if the first byte passes it attempts to test 0x10000 bytes, which is far too big so
539 what is the real size? */
540 map(0x300e0000, 0x300e03ff).ram().share("lineram").mirror(0x000fc00);
541
542 map(0x30100000, 0x301000ff).rw(FUNC(pgm2_state::shareram_r), FUNC(pgm2_state::shareram_w)).umask32(0x00ff00ff);
543
544 map(0x30120000, 0x30120003).ram().share("bgscroll"); // scroll
545 map(0x30120008, 0x3012000b).ram().share("fgscroll");
546 map(0x3012000c, 0x3012000f).ram().share("vidmode");
547 map(0x30120014, 0x30120017).w(FUNC(pgm2_state::unk30120014_w));
548 map(0x30120018, 0x30120019).w(FUNC(pgm2_state::vbl_ack_w));
549 map(0x30120032, 0x30120033).w(FUNC(pgm2_state::share_bank_w));
550 map(0x30120038, 0x3012003b).w(FUNC(pgm2_state::sprite_encryption_w));
551 // there are other 0x301200xx regs
552
553 map(0x40000000, 0x40000003).r("ymz774", FUNC(ymz774_device::read)).w("ymz774", FUNC(ymz774_device::write));
554
555 // internal IGS036 - most of them is standard ATMEL peripherals followed by custom bits
556 // map(0xfffa0000, 0xfffa00ff) TC (Timer Counter) not used, mentioned in disabled / unused code
557 // map(0xffffec00, 0xffffec7f) SMC (Static Memory Controller)
558 // map(0xffffee00, 0xffffee57) MATRIX (Bus Matrix)
559 map(0xfffff000, 0xfffff14b).m(m_arm_aic, FUNC(arm_aic_device::regs_map));
560 // map(0xfffff200, 0xfffff247) DBGU (Debug Unit)
561 // map(0xfffff400, 0xfffff4af) PIO (Parallel Input Output Controller)
562 map(0xfffff430, 0xfffff437).nopw(); // often
563 // map(0xfffffd00, 0xfffffd0b) RSTC (Reset Controller)
564 // map(0xfffffd20, 0xfffffd2f) RTTC (Real Time Timer)
565 map(0xfffffd28, 0xfffffd2b).r(FUNC(pgm2_state::rtc_r));
566 // map(0xfffffd40, 0xfffffd4b) WDTC (Watch Dog Timer)
567 // custom IGS036 stuff starts here
568 map(0xfffffa08, 0xfffffa0b).w(FUNC(pgm2_state::encryption_do_w)); // after uploading encryption? table might actually send it or enable external ROM? when read bits0-1 called FUSE 0 and 1, must be 0
569 map(0xfffffa0c, 0xfffffa0f).r(FUNC(pgm2_state::unk_startup_r)); // written 0, then 0x1c, then expected to return (result&0x180)==0x180, then written 0x7c
570 map(0xfffffc00, 0xfffffcff).rw(FUNC(pgm2_state::encryption_r), FUNC(pgm2_state::encryption_w));
571 }
572
573
pgm2_rom_map(address_map & map)574 void pgm2_state::pgm2_rom_map(address_map &map)
575 {
576 pgm2_map(map);
577 map(0x10000000, 0x10ffffff).rom().region("mainrom", 0); // external ROM
578 }
579
pgm2_ram_rom_map(address_map & map)580 void pgm2_state::pgm2_ram_rom_map(address_map &map)
581 {
582 pgm2_map(map);
583 map(0x10000000, 0x101fffff).ram().share("romboard_ram"); // we should also probably decrypt writes once the encryption is enabled, but the game never writes with it turned on anyway
584 map(0x10200000, 0x103fffff).rom().region("mainrom", 0); // external ROM
585 }
586
pgm2_module_rom_map(address_map & map)587 void pgm2_state::pgm2_module_rom_map(address_map &map)
588 {
589 pgm2_rom_map(map);
590 map(0x10000000, 0x107fffff).w(FUNC(pgm2_state::module_rom_w));
591 map(0x10000000, 0x1000000f).r(FUNC(pgm2_state::module_rom_r));
592 map(0xfffff430, 0xfffff433).w(FUNC(pgm2_state::pio_sodr_w));
593 map(0xfffff434, 0xfffff437).w(FUNC(pgm2_state::pio_codr_w));
594 map(0xfffff43c, 0xfffff43f).r(FUNC(pgm2_state::pio_pdsr_r));
595 }
596
597 static INPUT_PORTS_START( pgm2 )
598 PORT_START("INPUTS0")
599 PORT_BIT( 0x00000001, IP_ACTIVE_LOW, IPT_JOYSTICK_UP ) PORT_PLAYER(1)
600 PORT_BIT( 0x00000002, IP_ACTIVE_LOW, IPT_JOYSTICK_DOWN ) PORT_PLAYER(1)
601 PORT_BIT( 0x00000004, IP_ACTIVE_LOW, IPT_JOYSTICK_LEFT ) PORT_PLAYER(1)
602 PORT_BIT( 0x00000008, IP_ACTIVE_LOW, IPT_JOYSTICK_RIGHT ) PORT_PLAYER(1)
603 PORT_BIT( 0x00000010, IP_ACTIVE_LOW, IPT_BUTTON1 ) PORT_PLAYER(1)
604 PORT_BIT( 0x00000020, IP_ACTIVE_LOW, IPT_BUTTON2 ) PORT_PLAYER(1)
605 PORT_BIT( 0x00000040, IP_ACTIVE_LOW, IPT_BUTTON3 ) PORT_PLAYER(1)
606 PORT_BIT( 0x00000080, IP_ACTIVE_LOW, IPT_BUTTON4 ) PORT_PLAYER(1)
607 PORT_BIT( 0x00000100, IP_ACTIVE_LOW, IPT_UNUSED )
608 PORT_BIT( 0x00000200, IP_ACTIVE_LOW, IPT_UNUSED )
609 PORT_BIT( 0x00000400, IP_ACTIVE_LOW, IPT_JOYSTICK_UP ) PORT_PLAYER(2)
610 PORT_BIT( 0x00000800, IP_ACTIVE_LOW, IPT_JOYSTICK_DOWN ) PORT_PLAYER(2)
611 PORT_BIT( 0x00001000, IP_ACTIVE_LOW, IPT_JOYSTICK_LEFT ) PORT_PLAYER(2)
612 PORT_BIT( 0x00002000, IP_ACTIVE_LOW, IPT_JOYSTICK_RIGHT ) PORT_PLAYER(2)
613 PORT_BIT( 0x00004000, IP_ACTIVE_LOW, IPT_BUTTON1 ) PORT_PLAYER(2)
614 PORT_BIT( 0x00008000, IP_ACTIVE_LOW, IPT_BUTTON2 ) PORT_PLAYER(2)
615 PORT_BIT( 0x00010000, IP_ACTIVE_LOW, IPT_BUTTON3 ) PORT_PLAYER(2)
616 PORT_BIT( 0x00020000, IP_ACTIVE_LOW, IPT_BUTTON4 ) PORT_PLAYER(2)
617 PORT_BIT( 0x00040000, IP_ACTIVE_LOW, IPT_UNUSED )
618 PORT_BIT( 0x00080000, IP_ACTIVE_LOW, IPT_UNUSED )
619 PORT_BIT( 0x00100000, IP_ACTIVE_LOW, IPT_JOYSTICK_UP ) PORT_PLAYER(3)
620 PORT_BIT( 0x00200000, IP_ACTIVE_LOW, IPT_JOYSTICK_DOWN ) PORT_PLAYER(3)
621 PORT_BIT( 0x00400000, IP_ACTIVE_LOW, IPT_JOYSTICK_LEFT ) PORT_PLAYER(3)
622 PORT_BIT( 0x00800000, IP_ACTIVE_LOW, IPT_JOYSTICK_RIGHT ) PORT_PLAYER(3)
623 PORT_BIT( 0x01000000, IP_ACTIVE_LOW, IPT_BUTTON1 ) PORT_PLAYER(3)
624 PORT_BIT( 0x02000000, IP_ACTIVE_LOW, IPT_BUTTON2 ) PORT_PLAYER(3)
625 PORT_BIT( 0x04000000, IP_ACTIVE_LOW, IPT_BUTTON3 ) PORT_PLAYER(3)
626 PORT_BIT( 0x08000000, IP_ACTIVE_LOW, IPT_BUTTON4 ) PORT_PLAYER(3)
627 PORT_BIT( 0x10000000, IP_ACTIVE_LOW, IPT_UNUSED )
628 PORT_BIT( 0x20000000, IP_ACTIVE_LOW, IPT_UNUSED )
629 PORT_BIT( 0x40000000, IP_ACTIVE_LOW, IPT_UNUSED )
630 PORT_BIT( 0x80000000, IP_ACTIVE_LOW, IPT_UNUSED )
631
632 PORT_START("INPUTS1")
633 PORT_BIT( 0x00000001, IP_ACTIVE_LOW, IPT_JOYSTICK_UP ) PORT_PLAYER(4)
634 PORT_BIT( 0x00000002, IP_ACTIVE_LOW, IPT_JOYSTICK_DOWN ) PORT_PLAYER(4)
635 PORT_BIT( 0x00000004, IP_ACTIVE_LOW, IPT_JOYSTICK_LEFT ) PORT_PLAYER(4)
636 PORT_BIT( 0x00000008, IP_ACTIVE_LOW, IPT_JOYSTICK_RIGHT ) PORT_PLAYER(4)
637 PORT_BIT( 0x00000010, IP_ACTIVE_LOW, IPT_BUTTON1 ) PORT_PLAYER(4)
638 PORT_BIT( 0x00000020, IP_ACTIVE_LOW, IPT_BUTTON2 ) PORT_PLAYER(4)
639 PORT_BIT( 0x00000040, IP_ACTIVE_LOW, IPT_BUTTON3 ) PORT_PLAYER(4)
640 PORT_BIT( 0x00000080, IP_ACTIVE_LOW, IPT_BUTTON4 ) PORT_PLAYER(4)
641 PORT_BIT( 0x00000100, IP_ACTIVE_LOW, IPT_UNUSED )
642 PORT_BIT( 0x00000200, IP_ACTIVE_LOW, IPT_UNUSED )
643 PORT_BIT( 0x00000400, IP_ACTIVE_LOW, IPT_START1 )
644 PORT_BIT( 0x00000800, IP_ACTIVE_LOW, IPT_START2 )
645 PORT_BIT( 0x00001000, IP_ACTIVE_LOW, IPT_START3 )
646 PORT_BIT( 0x00002000, IP_ACTIVE_LOW, IPT_START4 )
647 PORT_BIT( 0x00004000, IP_ACTIVE_LOW, IPT_COIN1 )
648 PORT_BIT( 0x00008000, IP_ACTIVE_LOW, IPT_COIN2 )
649 PORT_BIT( 0x00010000, IP_ACTIVE_LOW, IPT_COIN3 )
650 PORT_BIT( 0x00020000, IP_ACTIVE_LOW, IPT_COIN4 )
651 PORT_BIT( 0x00040000, IP_ACTIVE_LOW, IPT_SERVICE1 ) PORT_NAME("Test Key P1 & P2") // test key p1+p2
652 PORT_BIT( 0x00080000, IP_ACTIVE_LOW, IPT_SERVICE2 ) PORT_NAME("Test Key P3 & P4") // test key p3+p4
653 PORT_BIT( 0x00100000, IP_ACTIVE_LOW, IPT_SERVICE3 ) PORT_NAME("Service P1 & P2") // service key p1+p2
654 PORT_BIT( 0x00200000, IP_ACTIVE_LOW, IPT_SERVICE4 ) PORT_NAME("Service P3 & P4") // service key p3+p4
655 PORT_BIT( 0x00400000, IP_ACTIVE_LOW, IPT_UNUSED )
656 PORT_BIT( 0x00800000, IP_ACTIVE_LOW, IPT_UNUSED )
657
658 PORT_SERVICE( 0x01000000, IP_ACTIVE_LOW ) PORT_DIPLOCATION("SW1:1")
659 PORT_DIPNAME( 0x02000000, 0x02000000, "Music" ) PORT_DIPLOCATION("SW1:2")
DEF_STR(Off)660 PORT_DIPSETTING( 0x00000000, DEF_STR( Off ) )
661 PORT_DIPSETTING( 0x02000000, DEF_STR( On ) )
662 PORT_DIPNAME( 0x04000000, 0x04000000, "Voice" ) PORT_DIPLOCATION("SW1:3")
663 PORT_DIPSETTING( 0x00000000, DEF_STR( Off ) )
664 PORT_DIPSETTING( 0x04000000, DEF_STR( On ) )
665 PORT_DIPNAME( 0x08000000, 0x08000000, "Free" ) PORT_DIPLOCATION("SW1:4")
666 PORT_DIPSETTING( 0x08000000, DEF_STR( Off ) )
667 PORT_DIPSETTING( 0x00000000, DEF_STR( On ) )
668 PORT_DIPNAME( 0x10000000, 0x10000000, "Stop" ) PORT_DIPLOCATION("SW1:5")
669 PORT_DIPSETTING( 0x10000000, DEF_STR( Off ) )
670 PORT_DIPSETTING( 0x00000000, DEF_STR( On ) )
671 PORT_DIPNAME( 0x20000000, 0x20000000, DEF_STR( Unused ) ) PORT_DIPLOCATION("SW1:6")
672 PORT_DIPSETTING( 0x20000000, DEF_STR( Off ) )
673 PORT_DIPSETTING( 0x00000000, DEF_STR( On ) )
674 PORT_DIPNAME( 0x40000000, 0x40000000, DEF_STR( Unused ) ) PORT_DIPLOCATION("SW1:7")
675 PORT_DIPSETTING( 0x40000000, DEF_STR( Off ) )
676 PORT_DIPSETTING( 0x00000000, DEF_STR( On ) )
677 PORT_DIPNAME( 0x80000000, 0x80000000, "Debug" ) PORT_DIPLOCATION("SW1:8")
678 PORT_DIPSETTING( 0x80000000, DEF_STR( Off ) )
679 PORT_DIPSETTING( 0x00000000, DEF_STR( On ) )
680 INPUT_PORTS_END
681
682
683 WRITE_LINE_MEMBER(pgm2_state::irq)
684 {
685 // logerror("irq\n");
686 if (state == ASSERT_LINE) m_maincpu->set_input_line(ARM7_IRQ_LINE, ASSERT_LINE);
687 else m_maincpu->set_input_line(ARM7_IRQ_LINE, CLEAR_LINE);
688 }
689
machine_start()690 void pgm2_state::machine_start()
691 {
692 save_item(NAME(m_encryption_table));
693 save_item(NAME(m_has_decrypted));
694 save_item(NAME(m_has_decrypted_kov3_module));
695 save_item(NAME(m_spritekey));
696 save_item(NAME(m_realspritekey));
697 save_item(NAME(m_mcu_regs));
698 save_item(NAME(m_mcu_result0));
699 save_item(NAME(m_mcu_result1));
700 save_item(NAME(m_mcu_last_cmd));
701 save_item(NAME(m_shareram));
702 save_item(NAME(m_share_bank));
703 save_item(NAME(m_pio_out_data));
704 save_item(NAME(module_in_latch));
705 save_item(NAME(module_sum_read));
706 save_item(NAME(module_out_latch));
707 save_item(NAME(module_prev_state));
708 save_item(NAME(module_clk_cnt));
709 save_item(NAME(module_rcv_buf));
710 save_item(NAME(module_send_buf));
711 }
712
machine_reset()713 void pgm2_state::machine_reset()
714 {
715 m_spritekey = 0;
716 m_realspritekey = 0;
717 m_mcu_last_cmd = 0;
718 m_share_bank = 0;
719
720 // as the decryption is dynamic controlled by the program, restore the encrypted copy
721 memcpy(m_mainrom->base(), &m_encrypted_copy[0], m_mainrom->bytes());
722
723 m_has_decrypted = false;
724 m_has_decrypted_kov3_module = false;
725
726 m_pio_out_data = 0;
727 module_prev_state = 0;
728 module_sum_read = false;
729 module_clk_cnt = 151; // this needed because of "false" clock pulse happen during gpio init
730 }
731
732 static const gfx_layout tiles32x32x8_layout =
733 {
734 32,32,
735 RGN_FRAC(1,1),
736 7,
737 { 1, 2, 3, 4, 5, 6, 7 },
738 { STEP32(0,8) },
739 { STEP32(0,8*32) },
740 256*32
741 };
742
743 static GFXDECODE_START( pgm2_tx )
744 GFXDECODE_ENTRY( "tiles", 0, gfx_8x8x4_packed_lsb, 0, 0x800/4/0x10 )
745 GFXDECODE_END
746
GFXDECODE_START(pgm2_bg)747 static GFXDECODE_START( pgm2_bg )
748 GFXDECODE_ENTRY( "bgtile", 0, tiles32x32x8_layout, 0, 0x2000/4/0x80 )
749 GFXDECODE_END
750
751 void pgm2_state::pgm2(machine_config &config)
752 {
753 /* basic machine hardware */
754 IGS036(config, m_maincpu, 100000000); // Unknown clock / divider
755 m_maincpu->set_addrmap(AS_PROGRAM, &pgm2_state::pgm2_rom_map);
756
757 TIMER(config, m_mcu_timer, 0).configure_generic(FUNC(pgm2_state::mcu_interrupt));
758
759 ARM_AIC(config, m_arm_aic, 0).irq_callback().set(FUNC(pgm2_state::irq));
760
761 /* video hardware */
762 SCREEN(config, m_screen, SCREEN_TYPE_RASTER);
763 m_screen->set_refresh(HZ_TO_ATTOSECONDS(59.08)); // 59.08Hz, 264 total lines @ 15.59KHz
764 m_screen->set_vblank_time(ATTOSECONDS_IN_USEC(0));
765 m_screen->set_size(64*8, 32*8);
766 m_screen->set_visarea(0, 448-1, 0, 224-1);
767 m_screen->set_screen_update(FUNC(pgm2_state::screen_update));
768 m_screen->screen_vblank().set(FUNC(pgm2_state::screen_vblank));
769
770 GFXDECODE(config, m_gfxdecode2, m_tx_palette, pgm2_tx);
771 GFXDECODE(config, m_gfxdecode3, m_bg_palette, pgm2_bg);
772
773 PALETTE(config, m_sp_palette).set_format(palette_device::xRGB_888, 0x4000 / 4); // sprites
774 PALETTE(config, m_tx_palette).set_format(palette_device::xRGB_888, 0x800 / 4); // text
775 PALETTE(config, m_bg_palette).set_format(palette_device::xRGB_888, 0x2000 / 4); // bg
776
777 NVRAM(config, "sram", nvram_device::DEFAULT_ALL_0);
778
779 SPEAKER(config, "lspeaker").front_left();
780 SPEAKER(config, "rspeaker").front_right();
781
782 ymz774_device &ymz774(YMZ774(config, "ymz774", 16384000)); // is clock correct ?
783 ymz774.add_route(0, "lspeaker", 1.0);
784 ymz774.add_route(1, "rspeaker", 1.0);
785
786 PGM2_MEMCARD(config, m_memcard[0], 0);
787 PGM2_MEMCARD(config, m_memcard[1], 0);
788 PGM2_MEMCARD(config, m_memcard[2], 0);
789 PGM2_MEMCARD(config, m_memcard[3], 0);
790 }
791
792 // not strictly needed as the video code supports changing on the fly, but makes recording easier etc.
pgm2_lores(machine_config & config)793 void pgm2_state::pgm2_lores(machine_config &config)
794 {
795 pgm2(config);
796 m_screen->set_refresh(HZ_TO_ATTOSECONDS(15625.0/264.0)); // not verified
797 m_screen->set_visarea(0, 320-1, 0, 240-1);
798 }
799
pgm2_hires(machine_config & config)800 void pgm2_state::pgm2_hires(machine_config &config)
801 {
802 pgm2(config);
803 m_maincpu->set_addrmap(AS_PROGRAM, &pgm2_state::pgm2_module_rom_map);
804 m_screen->set_visarea(0, 512-1, 0, 240-1);
805 }
806
pgm2_ramrom(machine_config & config)807 void pgm2_state::pgm2_ramrom(machine_config &config)
808 {
809 pgm2(config);
810 m_maincpu->set_addrmap(AS_PROGRAM, &pgm2_state::pgm2_ram_rom_map);
811 }
812
813 /* using macros for the video / sound roms because the locations never change between sets, and
814 we're going to have a LOT of clones to cover all the internal rom regions and external rom revision
815 combinations, so it keeps things readable */
816
817 // Oriental Legend 2
818
819 #define ORLEG2_VIDEO_SOUND_ROMS \
820 ROM_REGION( 0x200000, "tiles", ROMREGION_ERASE00 ) \
821 ROM_LOAD( "ig-a_text.u4", 0x00000000, 0x0200000, CRC(fa444c32) SHA1(31e5e3efa92d52bf9ab97a0ece51e3b77f52ce8a) ) \
822 \
823 ROM_REGION( 0x1000000, "bgtile", 0 ) \
824 ROM_LOAD32_WORD( "ig-a_bgl.u35", 0x00000000, 0x0800000, CRC(083a8315) SHA1(0dba25e132fbb12faa59ced648c27b881dc73478) ) \
825 ROM_LOAD32_WORD( "ig-a_bgh.u36", 0x00000002, 0x0800000, CRC(e197221d) SHA1(5574b1e3da4b202db725be906dd868edc2fd4634) ) \
826 \
827 ROM_REGION( 0x2000000, "sprites_mask", 0 ) /* 1bpp sprite mask data (packed) */ \
828 ROM_LOAD32_WORD( "ig-a_bml.u12", 0x00000000, 0x1000000, CRC(113a331c) SHA1(ee6b31bb2b052cc8799573de0d2f0a83f0ab4f6a) ) \
829 ROM_LOAD32_WORD( "ig-a_bmh.u16", 0x00000002, 0x1000000, CRC(fbf411c8) SHA1(5089b5cc9bbf6496ef1367c6255e63e9ab895117) ) \
830 \
831 ROM_REGION( 0x4000000, "sprites_colour", 0 ) /* sprite colour data (6bpp data, 2 bits unused except for 4 bytes that are randomly 0xff - check dump?) */ \
832 ROM_LOAD32_WORD( "ig-a_cgl.u18", 0x00000000, 0x2000000, CRC(43501fa6) SHA1(58ccce6d393964b771fec3f5c583e3ede57482a3) ) \
833 ROM_LOAD32_WORD( "ig-a_cgh.u26", 0x00000002, 0x2000000, CRC(7051d020) SHA1(3d9b24c6fda4c9699bb9f00742e0888059b623e1) ) \
834 \
835 ROM_REGION( 0x1000000, "ymz774", ROMREGION_ERASEFF ) /* ymz774 */ \
836 ROM_LOAD16_WORD_SWAP( "ig-a_sp.u2", 0x00000000, 0x1000000, CRC(8250688c) SHA1(d2488477afc528aeee96826065deba2bce4f0a7d) ) \
837 \
838 ROM_REGION( 0x10000, "sram", 0 ) \
839 ROM_LOAD( "xyj2_nvram", 0x00000000, 0x10000, CRC(ccccc71c) SHA1(585b5ccbf89dd28d8532da785d7c8af12f31c6d6) )
840
841 /*
842 External program revisions are CONFIRMED to be the same between regions, even if the label changes (localized game title + country specific extension code)
843
844 Confirmed country codes used on labels
845 FA = Oversea
846 CN = China
847 JP = Japan
848 TW = Taiwan
849
850 */
851
852 #define ORLEG2_PROGRAM_104(prefix, extension) \
853 ROM_REGION32_LE( 0x1000000, "mainrom", 0 ) \
854 ROM_LOAD( #prefix "_v104" #extension ".u7", 0x000000, 0x800000, CRC(7c24a4f5) SHA1(3cd9f9264ef2aad0869afdf096e88eb8d74b2570) ) // V104 08-03-03 13:25:37
855
856 #define ORLEG2_PROGRAM_103(prefix, extension) \
857 ROM_REGION32_LE( 0x1000000, "mainrom", 0 ) \
858 ROM_LOAD( #prefix "_v103" #extension ".u7", 0x000000, 0x800000, CRC(21c1fae8) SHA1(36eeb7a5e8dc8ee7c834f3ff1173c28cf6c2f1a3) ) // V103 08-01-30 14:45:17
859
860 #define ORLEG2_PROGRAM_101(prefix, extension) \
861 ROM_REGION32_LE( 0x1000000, "mainrom", 0 ) \
862 ROM_LOAD( #prefix "_v101" #extension ".u7", 0x000000, 0x800000, CRC(45805b53) SHA1(f2a8399c821b75fadc53e914f6f318707e70787c) ) // V101 07-12-24 09:32:32
863
864 /*
865 Internal ROMs for CHINA, JAPAN and OVERSEA are confirmed to differ by just the region byte, other regions not yet verified.
866 label is a localized version of the game title and the country code (see above)
867 For OVERSEA this is "O/L2", but we omit the / due to naming rules
868 For the CHINA version this uses the Chinese characters
869 */
870
871 #define ORLEG2_INTERNAL_CHINA \
872 ROM_REGION( 0x04000, "maincpu", 0 ) \
873 ROM_LOAD( "xyj2_cn.igs036", 0x00000000, 0x0004000, CRC(bcce7641) SHA1(c3b5cf6e9f6eae09b6785314777a52b34c3c7657) ) /* Core V100 China */ \
874 ROM_REGION( 0x108, "default_card", 0 ) \
875 ROM_LOAD( "blank_orleg2_china_card.pg2", 0x000, 0x108, CRC(dc29556f) SHA1(2335cc7af25d4dd9763c6944d3f0eb50276de80a) )
876
877 #define ORLEG2_INTERNAL_OVERSEAS \
878 ROM_REGION( 0x04000, "maincpu", 0 ) \
879 ROM_LOAD( "ol2_fa.igs036", 0x00000000, 0x0004000, CRC(cc4d398a) SHA1(c50bcc81f02cd5aa8ad157d73209dc53bdedc023) ) // Core V100 Oversea
880
881 #define ORLEG2_INTERNAL_JAPAN \
882 ROM_REGION( 0x04000, "maincpu", 0 ) \
883 ROM_LOAD( "ol2_a10.igs036", 0x00000000, 0x0004000, CRC(69375284) SHA1(a120c6a3d8d7898cc3ca508abea78e5e54090c66) ) // Core V100 Japan
884
ROM_START(orleg2)885 ROM_START( orleg2 )
886 ORLEG2_INTERNAL_OVERSEAS
887 ORLEG2_PROGRAM_104(ol2,fa)
888 ORLEG2_VIDEO_SOUND_ROMS
889 ROM_END
890
891 ROM_START( orleg2_103 )
892 ORLEG2_INTERNAL_OVERSEAS
893 ORLEG2_PROGRAM_103(ol2,fa)
894 ORLEG2_VIDEO_SOUND_ROMS
895 ROM_END
896
897 ROM_START( orleg2_101 )
898 ORLEG2_INTERNAL_OVERSEAS
899 ORLEG2_PROGRAM_101(ol2,fa)
900 ORLEG2_VIDEO_SOUND_ROMS
901 ROM_END
902
903 ROM_START( orleg2_104cn )
904 ORLEG2_INTERNAL_CHINA
905 ORLEG2_PROGRAM_104(xyj2,cn)
906 ORLEG2_VIDEO_SOUND_ROMS
907 ROM_END
908
909 ROM_START( orleg2_103cn )
910 ORLEG2_INTERNAL_CHINA
911 ORLEG2_PROGRAM_103(xyj2,cn)
912 ORLEG2_VIDEO_SOUND_ROMS
913 ROM_END
914
915 ROM_START( orleg2_101cn )
916 ORLEG2_INTERNAL_CHINA
917 ORLEG2_PROGRAM_101(xyj2,cn)
918 ORLEG2_VIDEO_SOUND_ROMS
919 ROM_END
920
921 ROM_START( orleg2_104jp )
922 ORLEG2_INTERNAL_JAPAN
923 ORLEG2_PROGRAM_104(ol2,a10)
924 ORLEG2_VIDEO_SOUND_ROMS
925 ROM_END
926
927 ROM_START( orleg2_103jp )
928 ORLEG2_INTERNAL_JAPAN
929 ORLEG2_PROGRAM_103(ol2,a10)
930 ORLEG2_VIDEO_SOUND_ROMS
931 ROM_END
932
933 ROM_START( orleg2_101jp )
934 ORLEG2_INTERNAL_JAPAN
935 ORLEG2_PROGRAM_101(ol2,a10)
936 ORLEG2_VIDEO_SOUND_ROMS
937 ROM_END
938
939 // Knights of Valour 2 New Legend
940
941 #define KOV2NL_VIDEO_SOUND_ROMS \
942 ROM_REGION( 0x200000, "tiles", ROMREGION_ERASE00 ) \
943 ROM_LOAD( "ig-a3_text.u4", 0x00000000, 0x0200000, CRC(214530ff) SHA1(4231a02054b0345392a077042b95779fd45d6c22) ) \
944 \
945 ROM_REGION( 0x1000000, "bgtile", 0 ) \
946 ROM_LOAD32_WORD( "ig-a3_bgl.u35", 0x00000000, 0x0800000, CRC(2d46b1f6) SHA1(ea8c805eda6292e86a642e9633d8fee7054d10b1) ) \
947 ROM_LOAD32_WORD( "ig-a3_bgh.u36", 0x00000002, 0x0800000, CRC(df710c36) SHA1(f826c3f496c4f17b46d18af1d8e02cac7b7027ac) ) \
948 \
949 ROM_REGION( 0x2000000, "sprites_mask", 0 ) /* 1bpp sprite mask data */ \
950 ROM_LOAD32_WORD( "ig-a3_bml.u12", 0x00000000, 0x1000000, CRC(0bf63836) SHA1(b8e4f1951f8074b475b795bd7840c5a375b6f5ef) ) \
951 ROM_LOAD32_WORD( "ig-a3_bmh.u16", 0x00000002, 0x1000000, CRC(4a378542) SHA1(5d06a8a8796285a786ebb690c34610f923ef5570) ) \
952 \
953 ROM_REGION( 0x4000000, "sprites_colour", 0 ) /* sprite colour data */ \
954 ROM_LOAD32_WORD( "ig-a3_cgl.u18", 0x00000000, 0x2000000, CRC(8d923e1f) SHA1(14371cf385dd8857017d3111cd4710f4291b1ae2) ) \
955 ROM_LOAD32_WORD( "ig-a3_cgh.u26", 0x00000002, 0x2000000, CRC(5b6fbf3f) SHA1(d1f52e230b91ee6cde939d7c2b74da7fd6527e73) ) \
956 \
957 ROM_REGION( 0x2000000, "ymz774", ROMREGION_ERASEFF ) /* ymz774 */ \
958 ROM_LOAD16_WORD_SWAP( "ig-a3_sp.u37", 0x00000000, 0x2000000, CRC(45cdf422) SHA1(8005d284bcee73cff37a147fcd1c3e9f039a7203) ) \
959 \
960 ROM_REGION(0x10000, "sram", 0) \
961 ROM_LOAD("gsyx_nvram", 0x00000000, 0x10000, CRC(22400c16) SHA1(f775a16299c30f2ce23d683161b910e06eff37c1) )
962
963 #define KOV2NL_PROGRAM_302(prefix, extension) \
964 ROM_REGION32_LE( 0x1000000, "mainrom", 0 ) \
965 ROM_LOAD( #prefix "_v302" #extension ".u7", 0x00000000, 0x0800000, CRC(b19cf540) SHA1(25da5804bbfd7ef2cdf5cc5aabaa803d18b98929) ) // V302 08-12-03 15:27:34
966
967 #define KOV2NL_PROGRAM_301(prefix, extension) \
968 ROM_REGION32_LE( 0x1000000, "mainrom", 0 ) \
969 ROM_LOAD( #prefix "_v301" #extension ".u7", 0x000000, 0x800000, CRC(c4595c2c) SHA1(09e379556ef76f81a63664f46d3f1415b315f384) ) // V301 08-09-09 09:44:53
970
971 #define KOV2NL_PROGRAM_300(prefix, extension) \
972 ROM_REGION32_LE( 0x1000000, "mainrom", 0 ) \
973 ROM_LOAD( #prefix "_v300" #extension ".u7", 0x000000, 0x800000, CRC(08da7552) SHA1(303b97d7694405474c8133a259303ccb49db48b1) ) // V300 08-08-06 18:21:23
974
975
976 // Region 0x00 - China
977 #define KOV2NL_INTERNAL_CHINA \
978 ROM_REGION( 0x04000, "maincpu", 0 ) \
979 ROM_LOAD( "gsyx_igs036_china.rom", 0x00000000, 0x0004000, CRC(e09fe4ce) SHA1(c0cac64ef8727cbe79d503ec4df66ddb6f2c925e) ) /* Core V100 China */ \
980 ROM_REGION( 0x108, "default_card", 0 ) \
981 ROM_LOAD( "blank_gsyx_china.pg2", 0x000, 0x108, CRC(02842ae8) SHA1(a6cda633b09a706039a79b73db2c258094826f85) )
982
983 // Region 0x01 - Taiwan CRC(b3ca3124) SHA1(793d3bdc4bfccb892eb51c351c4ccd103ee9b7ce)
984 // uses cards with CRC(1155f01f) SHA1(60f7bed1461b362a3da687503cd72ed2d5e96f30) (same as Oversea, Korea)
985
986 // Region 0x02 - Japan CRC(46344f1a) SHA1(fbe846be4a39e8a4c41417858311faaaebf67cb9)
987 // uses cards with CRC(0d63cb64) SHA1(957cce2d47f3369bc4f98b1652ba8639c08fb9bd) (unique)
988
989 // Region 0x03 - Korea CRC(15619af0) SHA1(619e58e13c4d4351e8a4359a1df1eb9952326e84)
990 // uses cards with CRC(1155f01f) SHA1(60f7bed1461b362a3da687503cd72ed2d5e96f30) (same as Oversea, Taiwan)
991 // (incomplete / partial translation, shows Oversea disclaimer and corrupt text on some screens, so likely unreleased or needs newer mainprg)
992
993 // Region 0x04 - Hong Kong CRC(76b9b527) SHA1(e77a7b59aca221b5d04dcd1ffc632114be7e5647)
994 // uses cards with CRC(02842ae8) SHA1(a6cda633b09a706039a79b73db2c258094826f85) (same as China)
995
996 // Region 0x05 - Overseas
997 #define KOV2NL_INTERNAL_OVERSEA \
998 ROM_REGION( 0x04000, "maincpu", 0 ) \
999 ROM_LOAD( "kov2nl_igs036_oversea.rom", 0x00000000, 0x0004000, CRC(25ec60cd) SHA1(7dd12d2bc642bfa79520676fe5de458ce7d08ef6) ) /* Core V100 oversea */ \
1000 ROM_REGION( 0x108, "default_card", 0 ) \
1001 ROM_LOAD( "blank_kov2nl_overseas_card.pg2", 0x000, 0x108, CRC(1155f01f) SHA1(60f7bed1461b362a3da687503cd72ed2d5e96f30) )
1002
1003
1004 ROM_START( kov2nl )
1005 KOV2NL_INTERNAL_OVERSEA
1006 KOV2NL_PROGRAM_302(kov2nl, fa)
1007 KOV2NL_VIDEO_SOUND_ROMS
1008 ROM_END
1009
1010 ROM_START( kov2nl_301 )
1011 KOV2NL_INTERNAL_OVERSEA
1012 KOV2NL_PROGRAM_301(kov2nl, fa)
1013 KOV2NL_VIDEO_SOUND_ROMS
1014 ROM_END
1015
1016 ROM_START( kov2nl_300 )
1017 KOV2NL_INTERNAL_OVERSEA
1018 KOV2NL_PROGRAM_300(kov2nl, fa)
1019 KOV2NL_VIDEO_SOUND_ROMS
1020 ROM_END
1021
1022
1023 ROM_START( kov2nl_302cn )
1024 KOV2NL_INTERNAL_CHINA
1025 KOV2NL_PROGRAM_302(gsyx, cn)
1026 KOV2NL_VIDEO_SOUND_ROMS
1027 ROM_END
1028
1029 ROM_START( kov2nl_301cn )
1030 KOV2NL_INTERNAL_CHINA
1031 KOV2NL_PROGRAM_301(gsyx, cn)
1032 KOV2NL_VIDEO_SOUND_ROMS
1033 ROM_END
1034
1035 ROM_START( kov2nl_300cn )
1036 KOV2NL_INTERNAL_CHINA
1037 KOV2NL_PROGRAM_300(gsyx, cn)
1038 KOV2NL_VIDEO_SOUND_ROMS
1039 ROM_END
1040
1041 // Dodonpachi Daioujou Tamashii
1042
1043 #define DDPDOJT_VIDEO_SOUND_ROMS \
1044 ROM_REGION( 0x200000, "tiles", ROMREGION_ERASE00 ) \
1045 ROM_LOAD( "ddpdoj_text.u1", 0x00000000, 0x0200000, CRC(f18141d1) SHA1(a16e0a76bc926a158bb92dfd35aca749c569ef50) ) \
1046 \
1047 ROM_REGION( 0x2000000, "bgtile", 0 ) \
1048 ROM_LOAD32_WORD( "ddpdoj_bgl.u23", 0x00000000, 0x1000000, CRC(ff65fdab) SHA1(abdd5ca43599a2daa722547a999119123dd9bb28) ) \
1049 ROM_LOAD32_WORD( "ddpdoj_bgh.u24", 0x00000002, 0x1000000, CRC(bb84d2a6) SHA1(a576a729831b5946287fa8f0d923016f43a9bedb) ) \
1050 \
1051 ROM_REGION( 0x1000000, "sprites_mask", 0 ) /* 1bpp sprite mask data */ \
1052 ROM_LOAD32_WORD( "ddpdoj_mapl0.u13", 0x00000000, 0x800000, CRC(bcfbb0fc) SHA1(9ec478eba9905913cf997bd9b46c70c1ad383630) ) \
1053 ROM_LOAD32_WORD( "ddpdoj_maph0.u15", 0x00000002, 0x800000, CRC(0cc75d4e) SHA1(6d1b5ef0fdebf1e84fa199b939ffa07b810b12c9) ) \
1054 \
1055 ROM_REGION( 0x2000000, "sprites_colour", 0 ) /* sprite colour data */ \
1056 ROM_LOAD32_WORD( "ddpdoj_spa0.u9", 0x00000000, 0x1000000, CRC(1232c1b4) SHA1(ecc1c549ae19d2f052a85fe4a993608aedf49a25) ) \
1057 ROM_LOAD32_WORD( "ddpdoj_spb0.u18", 0x00000002, 0x1000000, CRC(6a9e2cbf) SHA1(8e0a4ea90f5ef534820303d62f0873f8ac9f080e) ) \
1058 \
1059 ROM_REGION( 0x1000000, "ymz774", ROMREGION_ERASEFF ) /* ymz774 */ \
1060 ROM_LOAD16_WORD_SWAP( "ddpdoj_wave0.u12", 0x00000000, 0x1000000, CRC(2b71a324) SHA1(f69076cc561f40ca564d804bc7bd455066f8d77c) ) \
1061 \
1062 ROM_REGION( 0x10000, "sram", 0 ) \
1063 ROM_LOAD( "ddpdojt_sram", 0x00000000, 0x10000, CRC(af99e304) SHA1(e44fed22b902431298748eca84533f8685926afd) )
1064
1065 ROM_START( ddpdojt )
1066 ROM_REGION( 0x04000, "maincpu", 0 )
1067 ROM_LOAD( "ddpdoj_igs036_china.rom", 0x00000000, 0x0004000, CRC(5db91464) SHA1(723d8086285805bd815e62120dfa9a4269bcd932) ) // Core V100 China
1068
1069 ROM_REGION32_LE( 0x0200000, "mainrom", 0 )
1070 ROM_LOAD( "ddpdoj_v201cn.u4", 0x00000000, 0x0200000, CRC(89e4b760) SHA1(9fad1309da31d12a413731b416a8bbfdb304ed9e) ) // V201 10-03-27 17:45:12
1071
1072 DDPDOJT_VIDEO_SOUND_ROMS
1073 ROM_END
1074
1075 // Knights of Valour 3
1076
1077 /*
1078 The Kov3 Program rom is a module consisting of a NOR flash and a FPGA, this provides an extra layer of encryption on top of the usual
1079 that is only unlocked when the correct sequence is recieved from the ARM MCU (IGS036)
1080
1081 Newer gambling games use the same modules.
1082 */
1083
1084 #define KOV3_VIDEO_SOUND_ROMS \
1085 ROM_REGION( 0x200000, "tiles", ROMREGION_ERASE00 ) \
1086 ROM_LOAD( "kov3_text.u1", 0x00000000, 0x0200000, CRC(198b52d6) SHA1(e4502abe7ba01053d16c02114f0c88a3f52f6f40) ) \
1087 \
1088 ROM_REGION( 0x2000000, "bgtile", 0 ) \
1089 ROM_LOAD32_WORD( "kov3_bgl.u6", 0x00000000, 0x1000000, CRC(49a4c5bc) SHA1(26b7da91067bda196252520e9b4893361c2fc675) ) \
1090 ROM_LOAD32_WORD( "kov3_bgh.u7", 0x00000002, 0x1000000, CRC(adc1aff1) SHA1(b10490f0dbef9905cdb064168c529f0b5a2b28b8) ) \
1091 \
1092 ROM_REGION( 0x4000000, "sprites_mask", 0 ) /* 1bpp sprite mask data */ \
1093 ROM_LOAD32_WORD( "kov3_mapl0.u15", 0x00000000, 0x2000000, CRC(9e569bf7) SHA1(03d26e000e9d8e744546be9649628d2130f2ec4c) ) \
1094 ROM_LOAD32_WORD( "kov3_maph0.u16", 0x00000002, 0x2000000, CRC(6f200ad8) SHA1(cd12c136d4f5d424bd7daeeacd5c4127beb3d565) ) \
1095 \
1096 ROM_REGION( 0x8000000, "sprites_colour", 0 ) /* sprite colour data */ \
1097 ROM_LOAD32_WORD( "kov3_spa0.u17", 0x00000000, 0x4000000, CRC(3a1e58a9) SHA1(6ba251407c69ee62f7ea0baae91bc133acc70c6f) ) \
1098 ROM_LOAD32_WORD( "kov3_spb0.u10", 0x00000002, 0x4000000, CRC(90396065) SHA1(01bf9f69d77a792d5b39afbba70fbfa098e194f1) ) \
1099 \
1100 ROM_REGION( 0x4000000, "ymz774", ROMREGION_ERASEFF ) /* ymz774 */ \
1101 ROM_LOAD16_WORD_SWAP( "kov3_wave0.u13", 0x00000000, 0x4000000, CRC(aa639152) SHA1(2314c6bd05524525a31a2a4668a36a938b924ba4) ) \
1102 \
1103 ROM_REGION( 0x10000, "sram", 0 ) \
1104 ROM_LOAD( "kov3_sram", 0x00000000, 0x10000, CRC(d9608102) SHA1(dec5631642393f4ec76912c81fd60249bb45aa13) )
1105
1106 #define KOV3_INTERNAL_CHINA \
1107 ROM_REGION( 0x04000, "maincpu", 0 ) \
1108 ROM_LOAD( "kov3_igs036_china.rom", 0x00000000, 0x0004000, CRC(c7d33764) SHA1(5cd48f876e637d60391d39ac6e40bf243300cc75) ) /* Core V100 China */ \
1109 ROM_REGION( 0x108, "default_card", 0 ) \
1110 ROM_LOAD( "blank_kov3_china_card.pg2", 0x000, 0x108, CRC(bd5a968f) SHA1(b9045eb70e02afda7810431c592208053d863980) )
1111
1112
1113 ROM_START( kov3 )
1114 KOV3_INTERNAL_CHINA
1115
1116 ROM_REGION32_LE( 0x1000000, "mainrom", 0 )
1117 ROM_LOAD( "kov3_v104cn_raw.bin", 0x00000000, 0x0800000, CRC(1b5cbd24) SHA1(6471d4842a08f404420dea2bd1c8b88798c80fd5) ) // V104 11-12-09 14:29:14
1118
1119 KOV3_VIDEO_SOUND_ROMS
1120 ROM_END
1121
1122 ROM_START( kov3_102 )
1123 KOV3_INTERNAL_CHINA
1124
1125 ROM_REGION32_LE( 0x1000000, "mainrom", 0 )
1126 ROM_LOAD( "kov3_v102cn_raw.bin", 0x00000000, 0x0800000, CRC(61d0dabd) SHA1(959b22ef4e342ca39c2386549ac7274f9d580ab8) ) // V102 11-11-01 18:56:07
1127
1128 KOV3_VIDEO_SOUND_ROMS
1129 ROM_END
1130
1131 ROM_START( kov3_101 )
1132 KOV3_INTERNAL_CHINA
1133
1134 ROM_REGION32_LE( 0x1000000, "mainrom", 0 )
1135 ROM_LOAD( "kov3_v101.bin", 0x00000000, 0x0800000, BAD_DUMP CRC(d6664449) SHA1(64d912425f018c3531951019b33e909657724547) ) // V101 11-10-03 14:37:29; dump was not raw, manually xored with fake value
1136
1137 KOV3_VIDEO_SOUND_ROMS
1138 ROM_END
1139
1140 ROM_START( kov3_100 )
1141 KOV3_INTERNAL_CHINA
1142
1143 ROM_REGION32_LE( 0x1000000, "mainrom", 0 )
1144 ROM_LOAD( "kov3_v100cn_raw.bin", 0x00000000, 0x0800000, CRC(93bca924) SHA1(ecaf2c4676eb3d9f5e4fdbd9388be41e51afa0e4) ) // V100 11-09-14 15:13:14
1145
1146 KOV3_VIDEO_SOUND_ROMS
1147 ROM_END
1148
1149 /* King of Fighters '98: Ultimate Match HERO
1150
1151 device types were as follows
1152
1153 kof98umh_v100cn.u4 SAMSUNG K8Q2815UQB
1154 ig-d3_text.u1 cFeon EN29LV160AB
1155 all others: SPANSION S99-50070
1156
1157 */
1158
1159 #define KOF98UMH_VIDEO_SOUND_ROMS \
1160 ROM_REGION( 0x200000, "tiles", ROMREGION_ERASE00 ) \
1161 ROM_LOAD( "ig-d3_text.u1", 0x00000000, 0x0200000, CRC(9a0ea82e) SHA1(7844fd7e46c3fbb2164060f160da528254fd177e) ) \
1162 \
1163 ROM_REGION( 0x2000000, "bgtile", ROMREGION_ERASE00 ) \
1164 /* bgl/bgh unpopulated (no background tilemap) */ \
1165 \
1166 ROM_REGION( 0x08000000, "sprites_mask", 0 ) /* 1bpp sprite mask data */ \
1167 ROM_LOAD32_WORD( "ig-d3_mapl0.u13", 0x00000000, 0x4000000, CRC(5571d63e) SHA1(dad73797a35738013d82e3b8ca96fa001ec56f69) ) \
1168 ROM_LOAD32_WORD( "ig-d3_maph0.u15", 0x00000002, 0x4000000, CRC(0da7b1b8) SHA1(87741242bd827eca3788b490df6dcb65f7a89733) ) \
1169 \
1170 ROM_REGION( 0x20000000, "sprites_colour", 0 ) /* sprite colour data - some byte are 0x40 or even 0xff, but verified on 2 boards */ \
1171 ROM_LOAD32_WORD( "ig-d3_spa0.u9", 0x00000000, 0x4000000, CRC(cfef8f7d) SHA1(54f58d1b9eb7d2e4bbe13fbdfd98f5b14ce2086b) ) \
1172 ROM_LOAD32_WORD( "ig-d3_spb0.u18", 0x00000002, 0x4000000, CRC(f199d5c8) SHA1(91f5e8efd1f6a9e5aada51afdf5a8f52bac24185) ) \
1173 /* spa1/spb1 unpopulated */ \
1174 ROM_LOAD32_WORD( "ig-d3_spa2.u10", 0x10000000, 0x4000000, CRC(03bfd35c) SHA1(814998cd5ee01c9da775b73f7a0ba4216fe4970e) ) \
1175 ROM_LOAD32_WORD( "ig-d3_spb2.u20", 0x10000002, 0x4000000, CRC(9aaa840b) SHA1(3c6078d53bb5eca5c501540214287dd102102ea1) ) \
1176 /* spa3/spb3 unpopulated */ \
1177 \
1178 ROM_REGION( 0x08000000, "ymz774", ROMREGION_ERASEFF ) /* ymz774 */ \
1179 ROM_LOAD16_WORD_SWAP( "ig-d3_wave0.u12", 0x00000000, 0x4000000, CRC(edf2332d) SHA1(7e01c7e03e515814d7de117c265c3668d32842fa) ) \
1180 ROM_LOAD16_WORD_SWAP( "ig-d3_wave1.u11", 0x04000000, 0x4000000, CRC(62321b20) SHA1(a388c8a2489430fbe92fb26b3ef81c66ce97f318) ) \
1181 \
1182 ROM_REGION( 0x10000, "sram", 0 ) \
1183 ROM_LOAD( "kof98umh_sram", 0x00000000, 0x10000, CRC(60460ed9) SHA1(55cd8de37cee04ff7ad940fb52f8fb8db042c26e) )
1184
1185
1186 ROM_START( kof98umh )
1187 ROM_REGION( 0x04000, "maincpu", 0 )
1188 ROM_LOAD( "kof98umh_internal_rom.bin", 0x00000000, 0x0004000, CRC(3ed2e50f) SHA1(35310045d375d9dda36c325e35257123a7b5b8c7) ) // Core V100 China
1189
1190 ROM_REGION32_LE( 0x1000000, "mainrom", 0 )
1191 ROM_LOAD( "kof98umh_v100cn.u4", 0x00000000, 0x1000000, CRC(2ea91e3b) SHA1(5a586bb99cc4f1b02e0db462d5aff721512e0640) ) // V100 09-08-23 17:52:03
1192
1193 KOF98UMH_VIDEO_SOUND_ROMS
1194 ROM_END
1195
1196 static void iga_u16_decode(u16 *rom, int len, int ixor)
1197 {
1198 int i;
1199
1200 for (i = 1; i < len / 2; i+=2)
1201 {
1202 u16 x = ixor;
1203
1204 if ( (i>>1) & 0x000001) x ^= 0x0010;
1205 if ( (i>>1) & 0x000002) x ^= 0x2004;
1206 if ( (i>>1) & 0x000004) x ^= 0x0801;
1207 if ( (i>>1) & 0x000008) x ^= 0x0300;
1208 if ( (i>>1) & 0x000010) x ^= 0x0080;
1209 if ( (i>>1) & 0x000020) x ^= 0x0020;
1210 if ( (i>>1) & 0x000040) x ^= 0x4008;
1211 if ( (i>>1) & 0x000080) x ^= 0x1002;
1212 if ( (i>>1) & 0x000100) x ^= 0x0400;
1213 if ( (i>>1) & 0x000200) x ^= 0x0040;
1214 if ( (i>>1) & 0x000400) x ^= 0x8000;
1215
1216 rom[i] ^= x;
1217 rom[i] = bitswap<16>(rom[i], 8,9,10,11,12,13,14,15,0,1,2,3,4,5,6,7);
1218 }
1219 }
1220
iga_u12_decode(u16 * rom,int len,int ixor)1221 static void iga_u12_decode(u16* rom, int len, int ixor)
1222 {
1223 int i;
1224
1225 for (i = 0; i < len / 2; i+=2)
1226 {
1227 u16 x = ixor;
1228
1229 if ( (i>>1) & 0x000001) x ^= 0x9004;
1230 if ( (i>>1) & 0x000002) x ^= 0x0028;
1231 if ( (i>>1) & 0x000004) x ^= 0x0182;
1232 if ( (i>>1) & 0x000008) x ^= 0x0010;
1233 if ( (i>>1) & 0x000010) x ^= 0x2040;
1234 if ( (i>>1) & 0x000020) x ^= 0x0801;
1235 if ( (i>>1) & 0x000040) x ^= 0x0000;
1236 if ( (i>>1) & 0x000080) x ^= 0x0000;
1237 if ( (i>>1) & 0x000100) x ^= 0x4000;
1238 if ( (i>>1) & 0x000200) x ^= 0x0600;
1239 if ( (i>>1) & 0x000400) x ^= 0x0000;
1240
1241 rom[i] ^= x;
1242 rom[i] = bitswap<16>(rom[i], 8,9,10,11,12,13,14,15,0,1,2,3,4,5,6,7);
1243 }
1244 }
1245
sprite_colour_decode(u16 * rom,int len)1246 static void sprite_colour_decode(u16* rom, int len)
1247 {
1248 int i;
1249
1250 for (i = 0; i < len / 2; i++)
1251 {
1252 rom[i] = bitswap<16>(rom[i], 15, 14, /* unused - 6bpp */
1253 13, 12, 11,
1254 5, 4, 3,
1255 7, 6, /* unused - 6bpp */
1256 10, 9, 8,
1257 2, 1, 0 );
1258 }
1259 }
1260
orleg2_speedup_r()1261 u32 pgm2_state::orleg2_speedup_r()
1262 {
1263 u32 const pc = m_maincpu->pc();
1264 if ((pc == 0x1002faec) || (pc == 0x1002f9b8))
1265 {
1266 if ((m_mainram[0x20114 / 4] == 0x00) && (m_mainram[0x20118 / 4] == 0x00))
1267 m_maincpu->spin_until_interrupt();
1268 }
1269 /*else
1270 {
1271 logerror("pc is %08x\n", pc);
1272 }*/
1273
1274 return m_mainram[0x20114 / 4];
1275 }
1276
kov2nl_speedup_r()1277 u32 pgm2_state::kov2nl_speedup_r()
1278 {
1279 u32 const pc = m_maincpu->pc();
1280
1281 if ((pc == 0x10053a94) || (pc == 0x1005332c) || (pc == 0x1005327c))
1282 {
1283 if ((m_mainram[0x20470 / 4] == 0x00) && (m_mainram[0x20474 / 4] == 0x00))
1284 m_maincpu->spin_until_interrupt();
1285 }
1286 /*
1287 else
1288 {
1289 logerror("pc is %08x\n", pc);
1290 }
1291 */
1292
1293 return m_mainram[0x20470 / 4];
1294 }
1295
kof98umh_speedup_r()1296 u32 pgm2_state::kof98umh_speedup_r()
1297 {
1298 u32 const pc = m_maincpu->pc();
1299
1300 if (pc == 0x100028f6)
1301 {
1302 if ((m_mainram[0x00060 / 4] == 0x00) && (m_mainram[0x00064 / 4] == 0x00))
1303 m_maincpu->spin_until_interrupt();
1304 }
1305 /*
1306 else
1307 {
1308 logerror("pc is %08x\n", pc);
1309 }
1310 */
1311
1312 return m_mainram[0x00060 / 4];
1313 }
1314
kov3_speedup_r()1315 u32 pgm2_state::kov3_speedup_r()
1316 {
1317 u32 const pc = m_maincpu->pc();
1318
1319 if ((pc == 0x1000729a) || (pc == 0x1000729e))
1320 {
1321 if ((m_mainram[0x000b4 / 4] == 0x00) && (m_mainram[0x000b8 / 4] == 0x00))
1322 m_maincpu->spin_until_interrupt();
1323 }
1324 /*
1325 else
1326 {
1327 logerror("pc is %08x\n", pc);
1328 }
1329 */
1330
1331 return m_mainram[0x000b4 / 4];
1332 }
1333
1334
1335
1336
ddpdojt_speedup_r()1337 u32 pgm2_state::ddpdojt_speedup_r()
1338 {
1339 u32 const pc = m_maincpu->pc();
1340
1341 if (pc == 0x10001a7e)
1342 {
1343 if ((m_mainram[0x00060 / 4] == 0x00) && (m_mainram[0x00064 / 4] == 0x00))
1344 m_maincpu->spin_until_interrupt();
1345 }
1346 /*
1347 else
1348 {
1349 logerror("pc is %08x\n", pc);
1350 }
1351 */
1352
1353 return m_mainram[0x00060 / 4];
1354 }
1355
ddpdojt_speedup2_r()1356 u32 pgm2_state::ddpdojt_speedup2_r()
1357 {
1358 u32 const pc = m_maincpu->pc();
1359
1360 if (pc == 0x1008fefe || pc == 0x1008fbe8)
1361 {
1362 if ((m_mainram[0x21e04 / 4] & 0x00ff0000) != 0) // not sure if this endian safe ?
1363 m_maincpu->spin_until_interrupt();
1364 }
1365 /*
1366 else
1367 {
1368 logerror("pc is %08x\n", pc);
1369 }
1370 */
1371
1372 return m_mainram[0x21e04 / 4];
1373 }
1374
1375
1376 // for games with the internal ROMs fully dumped that provide the sprite key and program rom key at runtime
common_encryption_init()1377 void pgm2_state::common_encryption_init()
1378 {
1379 // store off a copy of the encrypted rom so we can restore it later when needed
1380 m_encrypted_copy.resize(m_mainrom->bytes());
1381 memcpy(&m_encrypted_copy[0], m_mainrom->base(), m_mainrom->bytes());
1382
1383 u16 *src = (u16 *)memregion("sprites_mask")->base();
1384
1385 iga_u12_decode(src, memregion("sprites_mask")->bytes(), 0x0000);
1386 iga_u16_decode(src, memregion("sprites_mask")->bytes(), 0x0000);
1387 m_sprite_predecrypted = false;
1388
1389 src = (u16 *)memregion("sprites_colour")->base();
1390 sprite_colour_decode(src, memregion("sprites_colour")->bytes());
1391
1392 m_has_decrypted = false;
1393 }
1394
init_orleg2()1395 void pgm2_state::init_orleg2()
1396 {
1397 common_encryption_init();
1398 m_maincpu->space(AS_PROGRAM).install_read_handler(0x20020114, 0x20020117, read32smo_delegate(*this, FUNC(pgm2_state::orleg2_speedup_r)));
1399 }
1400
init_kov2nl()1401 void pgm2_state::init_kov2nl()
1402 {
1403 common_encryption_init();
1404 m_maincpu->space(AS_PROGRAM).install_read_handler(0x20020470, 0x20020473, read32smo_delegate(*this, FUNC(pgm2_state::kov2nl_speedup_r)));
1405 }
1406
init_ddpdojt()1407 void pgm2_state::init_ddpdojt()
1408 {
1409 common_encryption_init();
1410 m_maincpu->space(AS_PROGRAM).install_read_handler(0x20000060, 0x20000063, read32smo_delegate(*this, FUNC(pgm2_state::ddpdojt_speedup_r)));
1411 m_maincpu->space(AS_PROGRAM).install_read_handler(0x20021e04, 0x20021e07, read32smo_delegate(*this, FUNC(pgm2_state::ddpdojt_speedup2_r)));
1412 }
1413
1414 // currently we don't know how to derive address/data xor values from real keys, so we need both
1415 static const kov3_module_key kov3_104_key = { { 0x40,0xac,0x30,0x00,0x47,0x49,0x00,0x00 } ,{ 0xeb,0x7d,0x8d,0x90,0x2c,0xf4,0x09,0x82 }, 0x18ec71, 0xb89d }; // fake zero-key
1416 static const kov3_module_key kov3_102_key = { { 0x49,0xac,0xb0,0xec,0x47,0x49,0x95,0x38 } ,{ 0x09,0xbd,0xf1,0x31,0xe6,0xf0,0x65,0x2b }, 0x021d37, 0x81d0 };
1417 static const kov3_module_key kov3_101_key = { { 0xc1,0x2c,0xc1,0xe5,0x3c,0xc1,0x59,0x9e } ,{ 0xf2,0xb2,0xf0,0x89,0x37,0xf2,0xc7,0x0b }, 0, 0xffff }; // real xor values is unknown
1418 static const kov3_module_key kov3_100_key = { { 0x40,0xac,0x30,0x00,0x47,0x49,0x00,0x00 } ,{ 0x96,0xf0,0x91,0xe1,0xb3,0xf1,0xef,0x90 }, 0x3e8aa8, 0xc530 }; // fake zero-key
1419
init_kov3()1420 void pgm2_state::init_kov3()
1421 {
1422 common_encryption_init();
1423 m_maincpu->space(AS_PROGRAM).install_read_handler(0x200000b4, 0x200000b7, read32smo_delegate(*this, FUNC(pgm2_state::kov3_speedup_r)));
1424 }
1425
decrypt_kov3_module(u32 addrxor,u16 dataxor)1426 void pgm2_state::decrypt_kov3_module(u32 addrxor, u16 dataxor)
1427 {
1428 u16 *src = (u16 *)m_mainrom->base();
1429 u32 size = m_mainrom->bytes();
1430
1431 std::vector<u16> buffer(size/2);
1432
1433 for (int i = 0; i < size/2; i++)
1434 buffer[i] = src[i^addrxor]^dataxor;
1435
1436 memcpy(src, &buffer[0], size);
1437
1438 m_has_decrypted_kov3_module = true;
1439 }
1440
init_kov3_104()1441 void pgm2_state::init_kov3_104()
1442 {
1443 module_key = &kov3_104_key;
1444 init_kov3();
1445 }
1446
init_kov3_102()1447 void pgm2_state::init_kov3_102()
1448 {
1449 module_key = &kov3_102_key;
1450 init_kov3();
1451 }
1452
init_kov3_101()1453 void pgm2_state::init_kov3_101()
1454 {
1455 module_key = &kov3_101_key;
1456 init_kov3();
1457 }
1458
init_kov3_100()1459 void pgm2_state::init_kov3_100()
1460 {
1461 module_key = &kov3_100_key;
1462 init_kov3();
1463 }
1464
init_kof98umh()1465 void pgm2_state::init_kof98umh()
1466 {
1467 common_encryption_init();
1468 m_maincpu->space(AS_PROGRAM).install_read_handler(0x20000060, 0x20000063, read32smo_delegate(*this, FUNC(pgm2_state::kof98umh_speedup_r)));
1469 }
1470
1471
1472
1473
1474
1475 /* PGM2 */
1476
1477 //华通电子/Huatong Electronics (distributor of orleg2, kov2nl in china) = 华通科技/Huatong Technology (distributor of kov3 in china),
1478 //Same company but they changed name.
1479
1480 // Oriental Legend 2 - should be a V102 and V100 too
1481 //西游释厄传2/Xīyóu shì è chuán 2 (China; Simplified Chinese)
1482 //西遊釋厄傳2/Saiyū Shakuyakuden 2 (Japan; Traditional Chinese - Taiwan(undumped) too?)
1483 GAME( 2007, orleg2, 0, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS", "Oriental Legend 2 (V104, Oversea)", MACHINE_SUPPORTS_SAVE ) /* Overseas sets of OL2 do not use the card reader */
1484 GAME( 2007, orleg2_103, orleg2, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS", "Oriental Legend 2 (V103, Oversea)", MACHINE_SUPPORTS_SAVE )
1485 GAME( 2007, orleg2_101, orleg2, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS", "Oriental Legend 2 (V101, Oversea)", MACHINE_SUPPORTS_SAVE )
1486
1487 GAME( 2007, orleg2_104cn, orleg2, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS (Huatong license)", "Xiyou Shi E Chuan 2 (V104, China)", MACHINE_SUPPORTS_SAVE )
1488 GAME( 2007, orleg2_103cn, orleg2, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS (Huatong license)", "Xiyou Shi E Chuan 2 (V103, China)", MACHINE_SUPPORTS_SAVE )
1489 GAME( 2007, orleg2_101cn, orleg2, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS (Huatong license)", "Xiyou Shi E Chuan 2 (V101, China)", MACHINE_SUPPORTS_SAVE )
1490
1491 GAME( 2007, orleg2_104jp, orleg2, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS (Alta license)", "Saiyuu Shakuyakuden 2 (V104, Japan)", MACHINE_SUPPORTS_SAVE )
1492 GAME( 2007, orleg2_103jp, orleg2, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS (Alta license)", "Saiyuu Shakuyakuden 2 (V103, Japan)", MACHINE_SUPPORTS_SAVE )
1493 GAME( 2007, orleg2_101jp, orleg2, pgm2, pgm2, pgm2_state, init_orleg2, ROT0, "IGS (Alta license)", "Saiyuu Shakuyakuden 2 (V101, Japan)", MACHINE_SUPPORTS_SAVE )
1494
1495 // Knights of Valour 2 New Legend
1496 //三國戰紀2撗掃于軍 New Legend/Sānguó zhàn jì 2 Guàng sǎo yú jūn New Legend (Oversea; Mixed Traditional and Simplified Chinese)
1497 //三國戰紀2盖世英雄/Sānguó zhàn jì 2 Gàishì yīngxióng (China; Mixed Traditional and Simplified Chinese)
1498 //三國戰紀2乱世英雄/Sangoku-Senki 2 Ranse Eiyū (Japan; Mixed Traditional and Simplified Chinese - Undumped)
1499 GAME( 2008, kov2nl, 0, pgm2, pgm2, pgm2_state, init_kov2nl, ROT0, "IGS", "Knights of Valour 2 New Legend / Sanguo Zhan Ji 2 Guang Sao Yu Jun (V302, Oversea)", MACHINE_SUPPORTS_SAVE )
1500 GAME( 2008, kov2nl_301, kov2nl, pgm2, pgm2, pgm2_state, init_kov2nl, ROT0, "IGS", "Knights of Valour 2 New Legend / Sanguo Zhan Ji 2 Guang Sao Yu Jun (V301, Oversea)", MACHINE_SUPPORTS_SAVE )
1501 GAME( 2008, kov2nl_300, kov2nl, pgm2, pgm2, pgm2_state, init_kov2nl, ROT0, "IGS", "Knights of Valour 2 New Legend / Sanguo Zhan Ji 2 Guang Sao Yu Jun (V300, Oversea)", MACHINE_SUPPORTS_SAVE )
1502
1503 GAME( 2008, kov2nl_302cn, kov2nl, pgm2, pgm2, pgm2_state, init_kov2nl, ROT0, "IGS (Huatong license)", "Sanguo Zhan Ji 2 Gaishi Yingxiong (V302, China)", MACHINE_SUPPORTS_SAVE )
1504 GAME( 2008, kov2nl_301cn, kov2nl, pgm2, pgm2, pgm2_state, init_kov2nl, ROT0, "IGS (Huatong license)", "Sanguo Zhan Ji 2 Gaishi Yingxiong (V301, China)", MACHINE_SUPPORTS_SAVE )
1505 GAME( 2008, kov2nl_300cn, kov2nl, pgm2, pgm2, pgm2_state, init_kov2nl, ROT0, "IGS (Huatong license)", "Sanguo Zhan Ji 2 Gaishi Yingxiong (V300, China)", MACHINE_SUPPORTS_SAVE )
1506
1507
1508 // Dodonpachi Daioujou Tamashii - should be a V200 too
1509 GAME( 2010, ddpdojt, 0, pgm2_ramrom, pgm2, pgm2_state, init_ddpdojt, ROT270, "IGS / Cave (Tong Li Animation license)", "DoDonPachi Dai-Ou-Jou Tamashii (V201, China)", MACHINE_SUPPORTS_SAVE )
1510
1511 // Knights of Valour 3 - should be a V103 and V101 too
1512 //三国战纪3/Sānguó zhàn jì 3 (Simplified Chinese)
1513 GAME( 2011, kov3, 0, pgm2_hires, pgm2, pgm2_state, init_kov3_104, ROT0, "IGS (Huatong license)", "Knights of Valour 3 / Sanguo Zhan Ji 3 (V104, China, Hong Kong, Taiwan)", MACHINE_SUPPORTS_SAVE )
1514 GAME( 2011, kov3_102, kov3, pgm2_hires, pgm2, pgm2_state, init_kov3_102, ROT0, "IGS (Huatong license)", "Knights of Valour 3 / Sanguo Zhan Ji 3 (V102, China, Hong Kong, Taiwan)", MACHINE_SUPPORTS_SAVE )
1515 GAME( 2011, kov3_101, kov3, pgm2_hires, pgm2, pgm2_state, init_kov3_101, ROT0, "IGS (Huatong license)", "Knights of Valour 3 / Sanguo Zhan Ji 3 (V101, China, Hong Kong, Taiwan)", MACHINE_SUPPORTS_SAVE )
1516 GAME( 2011, kov3_100, kov3, pgm2_hires, pgm2, pgm2_state, init_kov3_100, ROT0, "IGS (Huatong license)", "Knights of Valour 3 / Sanguo Zhan Ji 3 (V100, China, Hong Kong, Taiwan)", MACHINE_SUPPORTS_SAVE )
1517
1518 // King of Fighters '98: Ultimate Match Hero
1519 GAME( 2009, kof98umh, 0, pgm2_lores, pgm2, pgm2_state, init_kof98umh, ROT0, "IGS / SNK Playmore / New Channel", "The King of Fighters '98: Ultimate Match HERO (China, V100, 09-08-23)", MACHINE_SUPPORTS_SAVE )
1520
1521 // Jigsaw World Arena
1522
1523 // お茶犬のパズル/Ochaken no Puzzle (V101JP exists but undumped, Puzzle game of Japanese お茶犬/Ochaken franchises)
1524