Welcome!
Final Burn Neo => FBN Development => Topic started by: iq_132 on November 07, 2004, 11:44:48 PM
-
This is for Metal Slug 5 (Original set). Note that the P rom I'm using for this set has the Neo-PVC encryption removed.
It's essentially the bootleg with parts 3 & 4 swapped and a 2 byte difference.
BTW, if you save the RAM from Nebula, the AES patch has already been applied.
// Metal Slug 5
static struct BurnRomInfo mslug5RomDesc[] = {
// These use the neo-pvc code which is currently unemulated
// {"268-p1.bin", 0x400000, 0xd0466792, 0x10}, // 0 68K code
// {"268-p2.bin", 0x400000, 0xfbf6b61e, 0x10}, // 1
// So use a P1 with the neo-pvc protection removed
{"268-p1d.bin",0x800000, 0x2ECC772D, 0x10}, // 0 (Saved from Kawaks' RAM)
{"268-c1.bin", 0x800000, 0x27d59de8, 1}, // 2 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1, 1}, // 3
{"268-c3.bin", 0x800000, 0xb650f098, 1}, // 4
{"268-c4.bin", 0x800000, 0x10499589, 1}, // 5
{"268-c5.bin", 0x800000, 0x19352405, 1}, // 6
{"268-c6.bin", 0x800000, 0xb1531523, 1}, // 7
{"268-c7.bin", 0x800000, 0xfe2c1338, 1}, // 8
{"268-c8.bin", 0x800000, 0xecce3141, 1}, // 9
// {"268-m1.bin", 0x040000, 0x88c11f51, 0x10}, // 10 Z80 code (Encrypted)
{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, // 10
// These use the Neo-PCM2 2002 (Playmore) chip
// {"268-v1.bin", 0x800000, 0x33c6305c, 2}, // 11 Sound data (Encrypted)
// {"268-v2.bin", 0x800000, 0x1afb848e, 2}, // 12
{"268-v1d.bin", 0x800000, 0x14848c5c, 2}, // 11 Sound data
{"268-v2d.bin", 0x800000, 0x696cce3b, 2}, // 12
};
STDROMPICKEXT(mslug5, mslug5, neogeo);
STD_ROM_FN(mslug5);
static void mslug5_patch()
{
// Code by IQ_132 - Thanks to HappyASR for the info
for (int i = 0; i < 0x100000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 0)) == 0x33FC)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0) {
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
}
if (*((unsigned short*)(Neo68KROM01 + i + 0 )) == 0x5247)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6 )) == 0x33c7)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
*((unsigned short*)(Neo68KROM01 + i + 6 )) = 0x5247;
*((unsigned short*)(Neo68KROM01 + i + 8 )) = 0xe14f;
*((unsigned short*)(Neo68KROM01 + i + 10)) = 0xe94f;
}
}
}
*((unsigned short*)(Neo68KROM01 + 0x0122A)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x18434)) = 0xFFF0;
}
static int mslug5Init()
{
pNeoInitCallback=mslug5_patch; // Remove Protections
nNeoProtectionXor = 0x19;
return NeoInit();
}
struct BurnDriver BurnDrvmslug5 = {
{"mslug5", "Metal Slug 5", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", NULL, "neogeo"},
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, mslug5RomInfo, mslug5RomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
This is for the original bootleg metal slug 5 release.
// Metal Slug 5 (Bootleg)
static struct BurnRomInfo mslug5bRomDesc[] = {
//(original release, bootleg)
{"268-p1b.bin", 0x800000, 0x3f1cf3d2, 0x10}, // 0 68K code
{"268-c1d.bin", 0x800000, 0x969c0d62, 1}, // 1 Sprite data
{"268-c2d.bin", 0x800000, 0xc69ae867, 1}, // 2
{"268-c3d.bin", 0x800000, 0xd7beaeaf, 1}, // 3
{"268-c4d.bin", 0x800000, 0xe1b1131b, 1}, // 4 (899fb2af is good CRC)
{"268-c5d.bin", 0x800000, 0x2fa1a5ad, 1}, // 5
{"268-c6d.bin", 0x800000, 0x6de89589, 1}, // 6
{"268-c7d.bin", 0x800000, 0x97bd0c0a, 1}, // 7
{"268-c8d.bin", 0x800000, 0xc0d5bc20, 1}, // 8
{"268-m1.bin", 0x020000, 0x6FA01C9A, 0x10}, // 9 Z80 code
{"268-v1.bin", 0x400000, 0xc3540e0d, 2}, // 10 Sound data
{"268-v2.bin", 0x400000, 0x077bd2f4, 2}, // 11
{"268-v3.bin", 0x400000, 0x39b14567, 2}, // 12
{"268-v4.bin", 0x400000, 0x969ff3b2, 2}, // 13
};
STDROMPICKEXT(mslug5b, mslug5b, neogeo);
STD_ROM_FN(mslug5b);
static void mslug5b_decrypt()
{
// Patch out protections
mslug5_patch();
// Swap 3rd & 4th MB
unsigned char* src = Neo68KROM01+0x200000;
unsigned char* dst = (unsigned char*)malloc(0x200000);
memcpy(dst+0x000000, src+0x100000, 0x100000);
memcpy(dst+0x100000, src+0x000000, 0x100000);
memcpy(src+0x000000, dst+0x000000, 0x200000);
free(dst);
}
static int mslug5bInit()
{
pNeoInitCallback=mslug5b_decrypt; // Remove Protections
nNeoTextROMSize = 0x020000;
return NeoInit();
}
struct BurnDriver BurnDrvmslug5b = {
{"mslug5b", "Metal Slug 5 (Bootleg)", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_GAME_WORKING | BDF_BOOTLEG | BDF_CLONE, 2, HARDWARE_SNK_NEOGEO,
NULL, mslug5bRomInfo, mslug5bRomName, neogeoInputInfo, neogeoDIPInfo,
mslug5bInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
For ms5plus, make sure you have Ferchogtx's nNeoTextROMFixType code in your build. Otherwise, you'll get an error when compiling. (I'll link to the code when it's posted again)
// Metal Slug 5 (Plus)
static struct BurnRomInfo ms5plusRomDesc[] = {
{"268-p1p.bin", 0x100000, 0x106B276F, 0x10}, // 0 68K code // protected
{"268-p2p.bin", 0x200000, 0xD6A458E8, 0x10}, // 1
{"268-p3p.bin", 0x200000, 0x439EC031, 0x10}, // 2
{"268-s1p.bin", 0x020000, 0x21E04432, 1}, // 3 Text data
{"268-c1.bin", 0x800000, 0x27d59de8, 1}, // 4 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1, 1}, // 5
{"268-c3.bin", 0x800000, 0xb650f098, 1}, // 6
{"268-c4.bin", 0x800000, 0x10499589, 1}, // 7
{"268-c5.bin", 0x800000, 0x19352405, 1}, // 8
{"268-c6.bin", 0x800000, 0xb1531523, 1}, // 9
{"268-c7.bin", 0x800000, 0xfe2c1338, 1}, // 10
{"268-c8.bin", 0x800000, 0xecce3141, 1}, // 11
{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, // 12 Decrypted Z80 code
{"268-v1.bin", 0x800000, 0x14848c5c, 2}, // 13 Sound data
{"268-v2.bin", 0x800000, 0x696cce3b, 2}, // 14
};
STDROMPICKEXT(ms5plus, ms5plus, neogeo);
STD_ROM_FN(ms5plus);
static void ms5plus_patch()
{
// Driver by IQ_132 - http://neosource.1emu.net/
// Patch out protections (Thanks to HappyASR)
*((unsigned short*)(Neo68KROM01 + 0xF0A02)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0xF0A08)) = 0x4E75;
*((unsigned short*)(Neo68KROM01 + 0xF1004)) = 0xE85F;
*((unsigned short*)(Neo68KROM01 + 0xF1006)) = 0x5307;
*((unsigned short*)(Neo68KROM01 + 0xF1008)) = 0x33C7;
*((unsigned short*)(Neo68KROM01 + 0xF100A)) = 0x002F;
*((unsigned short*)(Neo68KROM01 + 0xF100C)) = 0xFFF0;
*((unsigned short*)(Neo68KROM01 + 0xF100E)) = 0x4E75;
// Reload last 2 roms (fixes FBA load problem)
BurnLoadRom(Neo68KROM01+0x100000, 1, 0);
BurnLoadRom(Neo68KROM01+0x300000, 2, 0);
}
static int ms5plusInit()
{
pNeoInitCallback=ms5plus_patch;
nNeoTextROMFixType=1;
nNeoProtectionXor = 0x19;
return NeoInit();
}
struct BurnDriver BurnDrvms5plus = {
{"ms5plus", "Metal Slug 5 (Plus)", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_GAME_WORKING | BDF_CLONE, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, ms5plusRomInfo, ms5plusRomName, neogeoInputInfo, neogeoDIPInfo,
ms5plusInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
-
Also, here's... sort of a fix for ms5plus in AES mode.
in neo_run.cpp find this:
if (pNeoInitCallback) {
pNeoInitCallback();
}
Add this after:
if ((((NeoSystem & 0x07) ^ 4) == 0x06) && (!strcmp(BurnDrvText(0), "ms5plus")))
{
*((unsigned short*)(Neo68KROM01 + 0x264)) = 0x33C7;
*((unsigned short*)(Neo68KROM01 + 0x266)) = 0x002F;
*((unsigned short*)(Neo68KROM01 + 0x268)) = 0xFFF0;
*((unsigned short*)(Neo68KROM01 + 0x26A)) = 0x5247;
*((unsigned short*)(Neo68KROM01 + 0x26C)) = 0xE14F;
*((unsigned short*)(Neo68KROM01 + 0x270)) = 0x4E71;
*((unsigned short*)(Neo68KROM01 + 0x272)) = 0x4E71;
*((unsigned short*)(Neo68KROM01 + 0x274)) = 0x4E71;
}
I'll admit, it's a cheap hack, but it works. (Note that you have to reload (not reset) the game after you load it first and change the dip to AES mode.)
-
yeah, it's cheap and totally removes the plus in AES mode, but it's still better than disabling it completely I guess.... :D
-
Here's an updated, shortened, and untested version. :)
static void mslug5_patch() // Code by IQ_132 - Thanks to HappyASR for the info
{
for (int i = 0; i < 0x20000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 0)) == 0x33FC)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0)
{
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
}
if (*((unsigned short*)(Neo68KROM01 + i + 0 )) == 0x5247)
{
if (*((unsigned short*)(Neo68KROM01 + i + 4 )) == 0xe94f)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
}
}
}
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
}
-
well, I got it even shorter!! :)
static void mslug5_patch() // Code by IQ_132 - Thanks to HappyASR for the info
{
for (int i = 0; i < 0x20000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0)
{
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
if (*((unsigned short*)(Neo68KROM01 + i)) == 0x5247)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
}
}
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
}
-
Cool!..Im gonna Update Now :P ^^
Good job! :D
SeeYaa!!
:D:):D:):D:)
-
Well here I post the code for the 'nNeoTextROMFixType' required by the
ms5plus Driver...
» Open neo_run.cpp
Find:
static int nSRAMProtAddress;
int nNeoSRAMProtection = -1;
Add After:
int nNeoTextROMFixType = 0; // Text fix for games that have TextBankswitch
Find:
if (pInfo->nTextOffset != -1) {
// Load S ROM data
BurnLoadRom(NeoTextROM + 0x020000, pInfo->nTextOffset, 1);
Add After:
/* Original code for MAME by fataku */
if (nNeoTextROMFixType == 1) {
unsigned char* srom = NeoTextROM+0x20000;
for (int i=0;i<0x20000;i++) {
srom[i]=BITSWAP08(srom[i],3,2,4,5,1,6,0,7);
}
}
/* Original code from mame traduced by FerchogtX */
if (nNeoTextROMFixType == 2) {
/* Descrambling S1 by FerchogtX, bassed on DorriGa's code */
unsigned char* srom = NeoTextROM+0x20000;
unsigned char* dst = (unsigned char*)malloc(0x20000);
memcpy( dst+0x00000, srom+0x10000, 0x10000 );
memcpy( dst+0x10000, srom+0x00000, 0x10000 );
memcpy( srom, dst, 0x20000 );
free(dst);
}
/* Thanks also to HappyASR for the info */
if (nNeoTextROMFixType == 3) {
unsigned char* srom = NeoTextROM+0x20000;
unsigned char* dst = (unsigned char*)malloc(0x20000);
if (dst)
{
memcpy(dst,srom,0x20000);
// descrambling the S1 by dorriGa
for (int j=0;j<0x20000 ; j+=0x000010)
{
memcpy(srom+j, dst+j+0x000008,8);
memcpy(srom+j+0x000008, dst+j,8);
}
}
free(dst);
}
/* Thanks to Badzou for the info */
if (nNeoTextROMFixType == 4) {
/* Descrambling S1 by dorriga */
unsigned char* srom = NeoTextROM+0x20000;
unsigned char* dst = (unsigned char*)malloc(0x80000);
memcpy( dst+0x00000, srom+0x60000, 0x20000 );
memcpy( dst+0x20000, srom+0x40000, 0x20000 );
memcpy( dst+0x40000, srom+0x20000, 0x20000 );
memcpy( dst+0x60000, srom+0x00000, 0x20000 );
memcpy( srom, dst, 0x80000 );
free(dst);
}
*EDIT* (code to edit in neogeo.h :))
» Open neogeo.h
Find:
// neo_run.cpp
Add After:
extern int nNeoTextROMFixType;
EDIT 2* (ThanX To FerchogtX for the correction :))
» In neo_run.cpp
Find:
#include "burn_ym2610.h"
Add After:
#include "bitswap.h"
That's All! ^^....I hope this help :)
SeeYaa!! Saludos!!!
:D:):D:):D:)
PD: If you find any error in the code posted here please post it so it
can be fixed :)
-
Add at the top of the file this (fir the case 1)
#include "bitswap.h"
See ya!!!!!
-
If you use the 'nNeoTextROMFixType' code in the previous post,
you should update the 'ms5plus' driver with this...
»In d_neogeo.cpp
Find:
static int ms5plusInit()
{
pNeoInitCallback=ms5plus_patch;
nNeoTextROMFixType=1;
nNeoProtectionXor = 0x19;
return NeoInit();
}
Replace with:
static int ms5plusInit()
{
pNeoInitCallback=ms5plus_patch;
nNeoTextROMFixType=3;
nNeoProtectionXor = 0x19;
return NeoInit();
}
That's it ..the Text Layers should be fine with this now ^^
SeeYaa!!!Saludos!!!
:D:):D:):D:)
-
Woohoo!! I got P rom interleaving working!! I'll have mslug5 working within an hour :D
*edit*
I was wrong... less time than that :D
// Metal Slug 5
static struct BurnRomInfo mslug5RomDesc[] = {
{"268-p1.bin", 0x400000, 0xd0466792, 0x10}, // 0 68K code
{"268-p2.bin", 0x400000, 0xfbf6b61e, 0x10}, // 1
{"268-c1.bin", 0x800000, 0x27d59de8, 1}, // 2 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1, 1}, // 3
{"268-c3.bin", 0x800000, 0xb650f098, 1}, // 4
{"268-c4.bin", 0x800000, 0x10499589, 1}, // 5
{"268-c5.bin", 0x800000, 0x19352405, 1}, // 6
{"268-c6.bin", 0x800000, 0xb1531523, 1}, // 7
{"268-c7.bin", 0x800000, 0xfe2c1338, 1}, // 8
{"268-c8.bin", 0x800000, 0xecce3141, 1}, // 9
{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, // 10 Z80 code
// {"268-m1.bin", 0x040000, 0x88c11f51, 0x10}, // 10
// {"268-v1.bin", 0x800000, 0x33c6305c, 2}, // 11 Sound data
// {"268-v2.bin", 0x800000, 0x1afb848e, 2}, // 12
{"268-v1d.bin", 0x800000, 0x14848c5c, 2}, // 11
{"268-v2d.bin", 0x800000, 0x696cce3b, 2}, // 12
};
STDROMPICKEXT(mslug5, mslug5, neogeo);
STD_ROM_FN(mslug5);
// This patches out the bankswitch protection
// Code by IQ_132 - Thanks to HappyASR for the info
static void mslug5_patch()
{
for (int i = 0; i < 0x20000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0)
{
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
if (*((unsigned short*)(Neo68KROM01 + i)) == 0x5247)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
}
}
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x0122A)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
}
// Code by iq_132 -- http://neosource.1emu.net/
static void interleave_pdata()
{
int j=0,i;
unsigned char* src = Neo68KROM01;
unsigned char* dst = (unsigned char*)malloc(0x800000);
for (i=0;i<0x800000;i=i+4){
dst[i+0]=src[j];
dst[i+1]=src[j+1];
dst[i+2]=src[j+0x400000];
dst[i+3]=src[j+0x400001];
j=j+2;
}
memcpy(Neo68KROM01,dst,0x800000);
free(dst);
}
// Original code by(?) HalRIN -- http://www52.tok2.com/home/foge/
// Converted to FBA code by iq_132 -- http://neosource.1emu.net/
static void mslug5_px_decrypt()
{
interleave_pdata();
const unsigned char xor1[ 0x20 ] = {
0xc2, 0x4b, 0x74, 0xfd, 0x0b, 0x34, 0xeb, 0xd7, 0x10, 0x6d, 0xf9, 0xce, 0x5d, 0xd5, 0x61, 0x29,
0xf5, 0xbe, 0x0d, 0x82, 0x72, 0x45, 0x0f, 0x24, 0xb3, 0x34, 0x1b, 0x99, 0xea, 0x09, 0xf3, 0x03,
};
const unsigned char xor2[ 0x20 ] = {
0x36, 0x09, 0xb0, 0x64, 0x95, 0x0f, 0x90, 0x42, 0x6e, 0x0f, 0x30, 0xf6, 0xe5, 0x08, 0x30, 0x64,
0x08, 0x04, 0x00, 0x2f, 0x72, 0x09, 0xa0, 0x13, 0xc9, 0x0b, 0xa0, 0x3e, 0xc2, 0x00, 0x40, 0x2b,
};
int i;
unsigned char *rom, *buf;
int ofst;
rom = Neo68KROM01;
for( i = 0; i < 0x100000; i++ ){
rom[ i ] ^= xor1[ (i % 0x20) ];
}
for( i = 0x100000; i < 0x800000; i++ ){
rom[ i ] ^= xor2[ (i % 0x20) ];
}
for( i = 0x100000; i < 0x0800000; i += 4 ){
UINT16 *rom16 = (UINT16*)&rom[ i + 1 ];
*rom16 = BITSWAP16( *rom16, 15, 14, 13, 12, 10, 11, 8, 9, 6, 7, 4, 5, 3, 2, 1, 0 );
}
buf = (unsigned char*)malloc( 0x800000 );
memcpy( buf, rom, 0x800000 );
for( i = 0; i < 0x0100000 / 0x10000; i++ ){
ofst = (i & 0xf0) + BITSWAP08( (i & 0x0f), 7, 6, 5, 4, 1, 0, 3, 2 );
memcpy( &rom[ i * 0x10000 ], &buf[ ofst * 0x10000 ], 0x10000 );
}
for( i = 0x100000; i < 0x800000; i += 0x100 ){
ofst = (i & 0xf000ff) +
((i & 0x000f00) ^ 0x00700) +
(BITSWAP08( ((i & 0x0ff000) >> 12), 5, 4, 7, 6, 1, 0, 3, 2 ) << 12);
memcpy( &rom[ i ], &buf[ ofst ], 0x100 );
}
free( buf );
mslug5_patch();
}
static int mslug5Init()
{
pNeoInitCallback=mslug5_px_decrypt;
nNeoProtectionXor = 0x19;
return NeoInit();
}
struct BurnDriver BurnDrvmslug5 = {
{"mslug5", "Metal Slug 5", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", NULL, "neogeo"},
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, mslug5RomInfo, mslug5RomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
-
ThanX Man!!! IQ_132 Rules!! xDD :D (My SRC is updated now with the new
code :))..my ThanX to you are in comment in the code too :)
SeeYaa!!!Saludos!!!
:D:):D:):D:)
-
Ok, here an attempt to translate the MAME code into FBA one... THis doesn't work properly, I think that the PCV chip is working but the bankswitch needs the read/writeByte handlers in order to work properly... here what i have...
// Metal Slug 5
static struct BurnRomInfo mslug5RomDesc[] = {
/* Original code, has PCB Protection */
{"268-p1.bin", 0x400000, 0xd0466792, 0x10}, // 0 68K code (encrypted)
{"268-p2.bin", 0x400000, 0xfbf6b61e, 0x10}, // 1
{"268-c1.bin", 0x800000, 0x27d59de8, 1}, // 1 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1, 1}, // 2
{"268-c3.bin", 0x800000, 0xb650f098, 1}, // 3
{"268-c4.bin", 0x800000, 0x10499589, 1}, // 4
{"268-c5.bin", 0x800000, 0x19352405, 1}, // 5
{"268-c6.bin", 0x800000, 0xb1531523, 1}, // 6
{"268-c7.bin", 0x800000, 0xfe2c1338, 1}, // 7
{"268-c8.bin", 0x800000, 0xecce3141, 1}, // 8
{"268-m1d.bin",0x040000, 0x6866d696, 0x10}, // 9 Z80 code (decrypted)
{"268-m1.bin", 0x040000, 0x88c11f51, 0x10}, // 10 Z80 code (encrypted)
/* Decrypted roms */
{"268-v1d.bin",0x800000, 0x14848c5c, 2}, // 11 Sound data
{"268-v2d.bin",0x800000, 0x696cce3b, 2}, // 12
/* Encrypted Vx roms, disabled by now */
// {"268-v1.bin", 0x800000, 0x33c6305c, 2}, // 13 Sound data (encrypted) /* kawaks dev dump */
// {"268-v2.bin", 0x800000, 0x1afb848e, 2}, // 14
};
STDROMPICKEXT(mslug5, mslug5, neogeo);
STD_ROM_FN(mslug5);
// Analyzed by HalRIN http://www52.tok2.com/home/foge/
// FBA convertion by FerchogtX
static void mslug5_PVC_Protection()
{
const unsigned char xor1[ 0x20 ] = {
0xc2, 0x4b, 0x74, 0xfd, 0x0b, 0x34, 0xeb, 0xd7, 0x10, 0x6d, 0xf9, 0xce, 0x5d, 0xd5, 0x61, 0x29,
0xf5, 0xbe, 0x0d, 0x82, 0x72, 0x45, 0x0f, 0x24, 0xb3, 0x34, 0x1b, 0x99, 0xea, 0x09, 0xf3, 0x03,
};
const unsigned char xor2[ 0x20 ] = {
0x36, 0x09, 0xb0, 0x64, 0x95, 0x0f, 0x90, 0x42, 0x6e, 0x0f, 0x30, 0xf6, 0xe5, 0x08, 0x30, 0x64,
0x08, 0x04, 0x00, 0x2f, 0x72, 0x09, 0xa0, 0x13, 0xc9, 0x0b, 0xa0, 0x3e, 0xc2, 0x00, 0x40, 0x2b,
};
int i;
unsigned char *rom, *buf;
int ofst;
rom = Neo68KROM01;
for( i = 0; i < 0x100000; i++ ){
rom[ i ] ^= xor1[ (i % 0x20) ];
}
for( i = 0x100000; i < 0x800000; i++ ){
rom[ i ] ^= xor2[ (i % 0x20) ];
}
for( i = 0x100000; i < 0x0800000; i += 4 ){
unsigned short *rom16 = (unsigned short*)&rom[ i + 1 ];
*rom16 = BITSWAP16( *rom16, 15, 14, 13, 12, 10, 11, 8, 9, 6, 7, 4, 5, 3, 2, 1, 0 );
}
buf = (unsigned char*)malloc( 0x800000 );
memcpy( buf, rom, 0x800000 );
for( i = 0; i < 0x0100000 / 0x10000; i++ ){
ofst = (i & 0xf0) + BITSWAP08( (i & 0x0f), 7, 6, 5, 4, 1, 0, 3, 2 );
memcpy( &rom[ i * 0x10000 ], &buf[ ofst * 0x10000 ], 0x10000 );
}
for( i = 0x100000; i < 0x800000; i += 0x100 ){
ofst = (i & 0xf000ff) +
((i & 0x000f00) ^ 0x00700) +
(BITSWAP08( ((i & 0x0ff000) >> 12), 5, 4, 7, 6, 1, 0, 3, 2 ) << 12);
memcpy( &rom[ i ], &buf[ ofst ], 0x100 );
}
free( buf );
buf = (unsigned char*)malloc( 0x800000 );
memcpy( buf, rom, 0x800000 );
memcpy( &rom[ 0x100000 ], &buf[ 0x700000 ], 0x100000 );
memcpy( &rom[ 0x200000 ], &buf[ 0x100000 ], 0x600000 );
free( buf );
}
static unsigned short mv0_bankswitch_offset[ 2 ];
static int mv0_bankswitch_flg;
static unsigned short __fastcall ReadWord_mv0_bankswitch(unsigned int sekAddress)
{
unsigned short wordValue;
if( mv0_bankswitch_offset[ 0 ] == 0xffff && mv0_bankswitch_offset[ 1 ] == 0xffff ){
mv0_bankswitch_flg = 1;
if( sekAddress == 0 ){
return 0xfea0;
}else if( sekAddress == 1 ){
return 0x7fff;
}else{
return mv0_bankswitch_offset[ wordValue ];
}
}else if( mv0_bankswitch_offset[ 0 ] == 0x0000 && mv0_bankswitch_offset[ 1 ] == 0x0000 && mv0_bankswitch_flg == 1 ){
if( sekAddress == 0 ){
return 0x00a0;
}else if( sekAddress == 1 ){
mv0_bankswitch_flg = 0;
return 0x0000;
}else{
return mv0_bankswitch_offset[ wordValue ];
}
}else{
return mv0_bankswitch_offset[ wordValue ];
}
}
static void ms5WriteBankswitch(unsigned int sekAddress,unsigned short wordValue,unsigned short valueMask)
{
mv0_bankswitch_offset[wordValue]=
(mv0_bankswitch_offset[wordValue]&valueMask) | ((~valueMask)&mv0_bankswitch_offset[wordValue]);
sekAddress = (mv0_bankswitch_offset[ 0 ] >> 8)+(mv0_bankswitch_offset[ 1 ] << 8)+0x100000;
SekMapMemory(Neo68KROM02 + sekAddress, 0x200000, 0x2FFFFF, SM_ROM);
}
void __fastcall WriteWord_mv0_bankswitch(unsigned int sekAddress,unsigned short wordValue)
{
unsigned short valueMask=0xffff;
ms5WriteBankswitch(sekAddress,wordValue,valueMask);
}
static void mslug5MapHandler()
{
// Install BankSwitch handler
SekMapHandler(5, 0x2ffff0, 0x2ffff3, SM_READ);
SekSetReadWordHandler(5, ReadWord_mv0_bankswitch);
SekMapHandler(5, 0x2ffff0, 0x2ffff3, SM_WRITE);
SekSetWriteWordHandler(5, WriteWord_mv0_bankswitch);
}
static int mslug5Init()
{
int nRet;
pNeoInitCallback = mslug5_PVC_Protection;
nNeoProtectionXor = 0x19;
nRet = NeoInit();
if (!nRet){
mslug5MapHandler();
}
return nRet;
}
struct BurnDriver BurnDrvmslug5 = {
{"mslug5", "Metal Slug 5", "Neo-PVC protection not emulated yet", "SNK Playmore", "Neo Geo", "2003", NULL, "neogeo"},
BDF_LOCKED, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, mslug5RomInfo, mslug5RomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
// Metal Slug 5 (decrypted C & V)
static struct BurnRomInfo mslug5ndRomDesc[] = {
/* Original code, has PCB Protection */
{"268-p1.bin", 0x400000, 0xd0466792, 0x10}, // 0 68K code (encrypted)
{"268-p2.bin", 0x400000, 0xfbf6b61e, 0x10}, // 1
{"ms5n_c1.rom", 0x800000, 0x969C0D62, 1}, // 2 Sprite data
{"ms5n_c2.rom", 0x800000, 0xC69AE867, 1}, // 3
{"ms5n_c3.rom", 0x800000, 0xD7BEAEAF, 1}, // 4
{"ms5n_c4.rom", 0x800000, 0x899fb2af, 1}, // 5
{"ms5n_c5.rom", 0x800000, 0x2FA1A5AD, 1}, // 6
{"ms5n_c6.rom", 0x800000, 0x6DE89589, 1}, // 7
{"ms5n_c7.rom", 0x800000, 0x97BD0C0A, 1}, // 8
{"ms5n_c8.rom", 0x800000, 0xC0D5BC20, 1}, // 9
{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, // 10 Z80 code
{"268-v1d.bin", 0x800000, 0x14848c5c, 2}, // 11 Sound data
{"268-v2d.bin", 0x800000, 0x696cce3b, 2}, // 12
};
STDROMPICKEXT(mslug5nd, mslug5nd, neogeo);
STD_ROM_FN(mslug5nd);
struct BurnDriver BurnDrvmslug5nd = {
{"mslug5nd", "Metal Slug 5 (decrypted C & V)", "Decrypted C-ROMs", "SNK Playmore", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_CLONE | BDF_LOCKED, 2, HARDWARE_SNK_NEOGEO,
NULL, mslug5ndRomInfo, mslug5ndRomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
Just for reference...
See ya!!!!!! :D
-
lol, check the page before this with a working mslug5 (with neo_pvc protection) driver ;)
-
XD i didn't notice that you added a working driver already... Forget this stuff XD
See ya!!!!!! :D
P.D. I'm blind this last times XD
-
Well, I tested the driver, boots prefectly in MVS mode, but AES has a loop and doesn't boot... is something related either with the NeoPVC or the bankswitch patch?
I'll try with another versions of you ms5patch code... but i report this to you just if you want to fix it :P
See ya!!!!! :D
-
Looks like I removed too many patches :|
// This patches out the bankswitch protection
// Code by IQ_132 - Thanks to HappyASR for the info
static void mslug5_patch()
{
for (int i = 0; i < 0x20000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 0)) == 0x33FC)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0)
{
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
}
if (*((unsigned short*)(Neo68KROM01 + i + 0 )) == 0x5247)
{
if (*((unsigned short*)(Neo68KROM01 + i + 4 )) == 0xe94f)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
}
}
}
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x0122A)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
}
-
I'll test this one to see if works properly... thanks a lot IQ.
See ya!!!! :D
-
just tried the neo_pvc driver and it resets when the demo starts and this is in mvs mode with japan bios set
also i'm having a lil prob with the ms5plus that i did the text fix as needed but some of the text is garbled like the plus flashing and credits.
-
looks like you are missing parts of needed code metal slug 5 works fine here
(encrypted set)
-
yeah, i think my neo_run.cpp is out date as the last time i touched it was when samsho5 set based on x emu was working on fba
EDIT: i just added the neopcm2playmore to my neo_run but still the same result but oddly enough the game plays fine if i start it and this also seemed to fix my ms5plus text problem (dunno how but it did hehe).
-
OK here an updated driver for mslug5, now it uses its proper bankswitch as well
first get sure you have this codes by IQ_132
// Code by iq_132 -- [url]http://neosource.1emu.net/[/url]
static void interleave_pdata()
{
int j=0,i;
unsigned char* src = Neo68KROM01;
unsigned char* dst = (unsigned char*)malloc(0x800000);
for (i=0;i<0x800000;i=i+4){
dst[i+0]=src[j];
dst[i+1]=src[j+1];
dst[i+2]=src[j+0x400000];
dst[i+3]=src[j+0x400001];
j=j+2;
}
memcpy(Neo68KROM01,dst,0x800000);
free(dst);
}
and this one is the neo-pvc by IQ_132 (the translation and code modification)
just added some lines to get working properly mslug5
// Neo-PVC Code for PCB and MVS games with this protection
// Original code by(?) HalRIN -- http://www52.tok2.com/home/foge/
// Converted to FBA code by iq_132 -- http://neosource.1emu.net/
static void neo_pvc(int game)
{
unsigned int xor1[ 2 ][ 0x20 ] = { // kof2003 does not use XOR 1
{0x3b, 0x6a, 0xf7, 0xb7, 0xe8, 0xa9, 0x20, 0x99, 0x9f, 0x39, 0x34, 0x0c, 0xc3, 0x9a, 0xa5, 0xc8,
0xb8, 0x18, 0xce, 0x56, 0x94, 0x44, 0xe3, 0x7a, 0xf7, 0xdd, 0x42, 0xf0, 0x18, 0x60, 0x92, 0x9f},
{0xc2, 0x4b, 0x74, 0xfd, 0x0b, 0x34, 0xeb, 0xd7, 0x10, 0x6d, 0xf9, 0xce, 0x5d, 0xd5, 0x61, 0x29,
0xf5, 0xbe, 0x0d, 0x82, 0x72, 0x45, 0x0f, 0x24, 0xb3, 0x34, 0x1b, 0x99, 0xea, 0x09, 0xf3, 0x03},
};
unsigned int xor2[ 3 ][ 0x20 ] = {
{0xb4, 0x0f, 0x40, 0x6c, 0x38, 0x07, 0xd0, 0x3f, 0x53, 0x08, 0x80, 0xaa, 0xbe, 0x07, 0xc0, 0xfa,
0xd0, 0x08, 0x10, 0xd2, 0xf1, 0x03, 0x70, 0x7e, 0x87, 0x0B, 0x40, 0xf6, 0x2a, 0x0a, 0xe0, 0xf9},
{0x69, 0x0b, 0x60, 0xd6, 0x4f, 0x01, 0x40, 0x1a, 0x9f, 0x0b, 0xf0, 0x75, 0x58, 0x0e, 0x60, 0xb4,
0x14, 0x04, 0x20, 0xe4, 0xb9, 0x0d, 0x10, 0x89, 0xeb, 0x07, 0x30, 0x90, 0x50, 0x0e, 0x20, 0x26},
{0x36, 0x09, 0xb0, 0x64, 0x95, 0x0f, 0x90, 0x42, 0x6e, 0x0f, 0x30, 0xf6, 0xe5, 0x08, 0x30, 0x64,
0x08, 0x04, 0x00, 0x2f, 0x72, 0x09, 0xa0, 0x13, 0xc9, 0x0b, 0xa0, 0x3e, 0xc2, 0x00, 0x40, 0x2b},
};
int i, ofst, ofst2 = 0x00300;
unsigned char *src = Neo68KROM01;
unsigned char *dst = (unsigned char*)malloc( 0x800000 );
if (game != 1)
for( i = 0; i < 0x100000; i++ )
src[ i ] ^= xor1[ game-2 ][ (i % 0x20) ];
for( i = 0x100000; i < 0x800000; i++ )
src[ i ] ^= xor2[ game-1 ][ (i % 0x20) ];
for( i = 0x100000; i < 0x800000; i += 4 ){
unsigned short *rom16 = (unsigned short*)&src[ i + 1 ];
if (game==1) *rom16 = BITSWAP16( *rom16, 15, 14, 13, 12, 4, 5, 6, 7, 8, 9, 10, 11, 3, 2, 1, 0 );
if (game!=1) *rom16 = BITSWAP16( *rom16, 15, 14, 13, 12, 10, 11, 8, 9, 6, 7, 4, 5, 3, 2, 1, 0 );
}
memcpy( dst, src, 0x800000 );
for( i = 0; i < 0x10; i++ ){
ofst = (i & 0xf0) + BITSWAP08( (i & 0x0f), 7, 6, 5, 4, 1, 0, 3, 2 );
if (game==2) ofst = (i & 0xf0) + BITSWAP08( (i & 0x0f), 7, 6, 5, 4, 2, 3, 0, 1 );
memcpy( &src[ i * 0x10000 ], &dst[ ofst * 0x10000 ], 0x10000 );
}
for( i = 0x100000; i < 0x800000; i += 0x100 ){
if (game==2) ofst2=0x00a00;
ofst = (i & 0xf000ff) + ((i & 0x000f00) ^ ofst2) + (BITSWAP08( ((i & 0x0ff000) >> 12), 4, 5, 6, 7, 1, 0, 3, 2 ) << 12);
if (game==3)
ofst = (i & 0xf000ff) + ((i & 0x000f00) ^ 0x00700) + (BITSWAP08( ((i & 0x0ff000) >> 12), 5, 4, 7, 6, 1, 0, 3, 2 ) << 12);
memcpy( &src[ i ], &dst[ ofst ], 0x100 );
}
if (game == 1) {
dst= (unsigned char*)malloc( 0x900000 );
memcpy( dst, src, 0x900000 );
memcpy( &src[ 0x100000 ], &dst[ 0x800000 ], 0x100000 );
memcpy( &src[ 0x200000 ], &dst[ 0x100000 ], 0x700000 );
} else {
dst = (unsigned char*)malloc( 0x800000 );
memcpy( dst, src, 0x800000 );
memcpy( &src[ 0x100000 ], &dst[ 0x700000 ], 0x100000 );
memcpy( &src[ 0x200000 ], &dst[ 0x100000 ], 0x600000 );
}
free(dst);
}
and finally, the driver:
// Metal Slug 5
/* ========================================================================
This game has a new method of encryption in the P-ROMs, the Neo-PVC chip
this protection consists in a some kind of byteswap, with 1 or 2 xors
that reorders the data, also there is an interleaving in the P-ROMs (ex-
cept in some games) the xors can change depending of the game...
======================================================================== */
static struct BurnRomInfo mslug5RomDesc[] = {
{"268-p1.bin", 0x400000, 0xd0466792, 0x10}, // 0 68K code (interleaved)
{"268-p2.bin", 0x400000, 0xfbf6b61e, 0x10}, // 1 (interleaved)
{"268-c1.bin", 0x800000, 0x27d59de8, 1}, // 2 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1, 1}, // 3
{"268-c3.bin", 0x800000, 0xb650f098, 1}, // 4
{"268-c4.bin", 0x800000, 0x10499589, 1}, // 5
{"268-c5.bin", 0x800000, 0x19352405, 1}, // 6
{"268-c6.bin", 0x800000, 0xb1531523, 1}, // 7
{"268-c7.bin", 0x800000, 0xfe2c1338, 1}, // 8
{"268-c8.bin", 0x800000, 0xecce3141, 1}, // 9
{"268-m1d.bin",0x040000, 0x6866d696, 0x10}, // 10 Z80 code (decrypted)
{"268-m1.bin", 0x040000, 0x88c11f51, 0x10}, // 11 Z80 code
/* This uses Neo-PCM2 PLAYMORE(c) 2002 Chip */
{"268-v1.bin", 0x800000, 0x33c6305c, 2}, // 12 Sound data
{"268-v2.bin", 0x800000, 0x1afb848e, 2}, // 13
};
STDROMPICKEXT(mslug5, mslug5, neogeo);
STD_ROM_FN(mslug5);
static void mslug5PVCDecrypt()
{
interleave_pdata();
neo_pvc(3);
*((unsigned short*)(Neo68KROM01 + 0x122A)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x122C)) = 0x4e71; // AES Patch
}
// Bankswitch #1 for PVC protected carts / boards
static unsigned short CartRAM[0x1000];
unsigned char __fastcall mv0ReadByteBankSwitch(unsigned int sekAddress)
{
return *(((unsigned char *)CartRAM)+((sekAddress^1)-0x2fe000));
}
unsigned short __fastcall mv0ReadWordBankSwitch(unsigned int sekAddress)
{
return CartRAM[(sekAddress-0x2fe000)/2];
}
static void mv0WriteBankSwitch(unsigned int sekAddress,unsigned short wordValue,unsigned short valueMask)
{
int address=(sekAddress-0x2fe000)/2,bankaddress;
CartRAM[address]=(wordValue&valueMask)|(~valueMask&CartRAM[address]);
if(address!=0xff8 && address!=0xff9 ) return;
bankaddress=(CartRAM[0xff8]>>8)|(CartRAM[0xff9]<<8);
*(((unsigned char *)CartRAM)+0x1ff0)=0xa0;
*(((unsigned char *)CartRAM)+0x1ff1)&=0xfe;
*(((unsigned char *)CartRAM)+0x1ff3)&=0x7f;
SekMapMemory(Neo68KROM02+bankaddress,0x200000,0x2fdfff,SM_ROM);
Neo68KROM01[0x58196]=CartRAM[0xff9]&0xff;
}
void __fastcall mv0WriteWordBankSwitch(unsigned int sekAddress, unsigned short wordValue)
{
unsigned short valueMask=0xffff;
mv0WriteBankSwitch(sekAddress,wordValue,valueMask);
}
void __fastcall mv0WriteByteBankSwitch(unsigned int sekAddress, unsigned char byteValue)
{
unsigned short wordValue=0,valueMask=0xff;
if(!(sekAddress&1)) {
wordValue=byteValue<<8;
valueMask<<=8;
} else {
wordValue=byteValue;
}
mv0WriteBankSwitch(sekAddress,wordValue,valueMask);
}
static void mv0_BankMapHandler()
{
// Install BankSwitch handler
SekMapHandler(5, 0x2fe000, 0x2fffff, SM_READ);
SekSetReadWordHandler(5, mv0ReadWordBankSwitch);
SekSetReadByteHandler(5, mv0ReadByteBankSwitch);
SekMapHandler(5, 0x2fe000, 0x2fffff, SM_WRITE);
SekSetWriteWordHandler(5, mv0WriteWordBankSwitch);
SekSetWriteByteHandler(5, mv0WriteByteBankSwitch);
}
static int mslug5Init()
{
int nRet;
memset(CartRAM,0,0x2000);
pNeoInitCallback = mslug5PVCDecrypt;
nNeoProtectionXor = 0x19;
nNeoPCM2PLAYMOREByteswap = 3;
nRet = NeoInit();
if (!nRet)
mv0_BankMapHandler();
return nRet;
}
struct BurnDriver BurnDrvmslug5 = {
{"mslug5", "Metal Slug 5", NULL, "SNK Playmore", "Neo Geo", "2003", NULL, "neogeo"},
BDF_GAME_WORKING | BDF_LOCKED, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B | HARDWARE_SNK_NEWBANKSYSTEM,
NULL, mslug5RomInfo, mslug5RomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
// Metal Slug 5 (decrypted C)
static struct BurnRomInfo mslug5ndRomDesc[] = {
{"268-p1.bin", 0x400000, 0xd0466792, 0x10}, // 0 68K code
{"268-p2.bin", 0x400000, 0xfbf6b61e, 0x10}, // 1
{"ms5n_c1.rom", 0x800000, 0x969C0D62, 1}, // 2 Sprite data
{"ms5n_c2.rom", 0x800000, 0xC69AE867, 1}, // 3
{"ms5n_c3.rom", 0x800000, 0xD7BEAEAF, 1}, // 4
{"ms5n_c4.rom", 0x800000, 0x899fb2af, 1}, // 5
{"ms5n_c5.rom", 0x800000, 0x2FA1A5AD, 1}, // 6
{"ms5n_c6.rom", 0x800000, 0x6DE89589, 1}, // 7
{"ms5n_c7.rom", 0x800000, 0x97BD0C0A, 1}, // 8
{"ms5n_c8.rom", 0x800000, 0xC0D5BC20, 1}, // 9
{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, // 10 Z80 code
{"268-v1.bin", 0x800000, 0x33c6305c, 2}, // 11 Sound data
{"268-v2.bin", 0x800000, 0x1afb848e, 2}, // 12
};
STDROMPICKEXT(mslug5nd, mslug5nd, neogeo);
STD_ROM_FN(mslug5nd);
struct BurnDriver BurnDrvmslug5nd = {
{"mslug5nd", "Metal Slug 5 (decrypted C)", "Decrypted C-ROMs", "SNK Playmore", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_GAME_WORKING | BDF_CLONE | BDF_LOCKED, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_NEWBANKSYSTEM,
NULL, mslug5ndRomInfo, mslug5ndRomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
make sure you have also the PCM2 playmore chip code (by IQ_132) in your neo_run.cpp
See ya!!!!! :D
P.S. mv0_BankMapHandler = kof2003bBankMapHandler = kof2003BankMapHandler
-
Nice work ferchogtx :)
// Metal Slug 5 (Bootleg)
static struct BurnRomInfo mslug5bRomDesc[] = {
{"268-p1b.bin", 0x800000, 0x3f1cf3d2, 0x10}, // 0 68K code
{"268-c1b.bin", 0x800000, 0x969c0d62, 1}, // 1 Sprite data
{"268-c2b.bin", 0x800000, 0xc69ae867, 1}, // 2
{"268-c3b.bin", 0x800000, 0xd7beaeaf, 1}, // 3
{"268-c4b.bin", 0x800000, 0xe1b1131b, 1}, // 4
{"268-c5b.bin", 0x800000, 0x2fa1a5ad, 1}, // 5
{"268-c6b.bin", 0x800000, 0x6de89589, 1}, // 6
{"268-c7b.bin", 0x800000, 0x97bd0c0a, 1}, // 7
{"268-c8b.bin", 0x800000, 0xc0d5bc20, 1}, // 8
{"268-m1b.bin", 0x020000, 0x6FA01C9A, 0x10}, // 9 Z80 code
{"268-v1b.bin", 0x400000, 0xc3540e0d, 2}, // 10 Sound data
{"268-v2b.bin", 0x400000, 0x077bd2f4, 2}, // 11
{"268-v3b.bin", 0x400000, 0x39b14567, 2}, // 12
{"268-v4b.bin", 0x400000, 0x969ff3b2, 2}, // 13
};
STDROMPICKEXT(mslug5b, mslug5b, neogeo);
STD_ROM_FN(mslug5b);
static void mslug5b_descramble()
{
unsigned char* src = Neo68KROM01;
unsigned char* dst = (unsigned char*)malloc(0x100000);
memcpy(dst+0x000000, src+0x200000, 0x100000);
memcpy(src+0x200000, src+0x300000, 0x100000);
memcpy(src+0x300000, dst+0x000000, 0x100000);
memcpy(src+0x200000, src+0x100000, 0x400000);
free(dst);
*((unsigned short*)(Neo68KROM01 + 0x122A)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x122C)) = 0x4e71; // AES Patch
}
static int mslug5bInit()
{
int nRet;
memset(CartRAM,0,0x2000);
pNeoInitCallback = mslug5b_descramble;
nNeoProtectionXor = 0x19;
nRet = NeoInit();
if (!nRet)
mv0_BankMapHandler();
return nRet;
}
struct BurnDriver BurnDrvmslug5b = {
{"mslug5b", "Metal Slug 5 (Bootleg)", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_GAME_WORKING | BDF_BOOTLEG | BDF_CLONE, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_NEWBANKSYSTEM,
NULL, mslug5bRomInfo, mslug5bRomName, neogeoInputInfo, neogeoDIPInfo,
mslug5bInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
-
urrrgg...darn, im lost again after some matters. anyways, just a little question. if mslug5 uses 3 for neo_pvc then whats the value for svcchaos and kof2003 (i know kof2003 doesnt work yet)
-
for:
SNK vs CAPCOM neo_pvc = neo_pvc(2);
The King of Fighters 2003 neo_pvc = neo_pvc(1);
See ya!!!! :D
-
Metal Slug 5 Plus FBA code is here,not patch,^_^.
// Metal Slug 5 Plus! (hack)
static struct BurnRomInfo ms5plusRomDesc[] = {
{"268-p1p.bin", 0x100000, 0x106B276F, 0x10}, // 0 68K code /* protected code */
{"268-p2p.bin", 0x200000, 0xD6A458E8, 0x10}, // 1
{"268-p3p.bin", 0x200000, 0x439EC031, 0x10}, // 2
{"268-s1p.bin", 0x020000, 0x21e04432, 1}, // 3 Text layer tiles /* scrambled */
{"268-c1.bin", 0x800000, 0x27d59de8, 1}, // 4 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1, 1}, // 5
{"268-c3.bin", 0x800000, 0xb650f098, 1}, // 6
{"268-c4.bin", 0x800000, 0x10499589, 1}, // 7
{"268-c5.bin", 0x800000, 0x19352405, 1}, // 8
{"268-c6.bin", 0x800000, 0xb1531523, 1}, // 9
{"268-c7.bin", 0x800000, 0xfe2c1338, 1}, // 10
{"268-c8.bin", 0x800000, 0xecce3141, 1}, // 11
{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, // 12 Z80 code
{"268-v1.bin", 0x800000, 0x33c6305c, 2}, // 13 Sound data (encrypted)
{"268-v2.bin", 0x800000, 0x1afb848e, 2}, // 14
};
STDROMPICKEXT(ms5plus, ms5plus, neogeo);
STD_ROM_FN(ms5plus);
static unsigned short CartRAM[0x1000];
void __fastcall ms5plusWriteWordBankSwitch(unsigned int sekAddress, unsigned short wordValue)
{
if (sekAddress==0x2ffff4)
{
unsigned int offset=wordValue<<0x10;
SekMapMemory(Neo68KROM01+offset,0x200000,0x2fdfff,SM_ROM);
};
}
static void ms5plusMapHandler()
{
SekMapHandler(5, 0x2fe000, 0x2fffff, SM_WRITE);
SekSetWriteWordHandler(5, ms5plusWriteWordBankSwitch);
}
static void ms5p_px_fix()
{
// Reload last 2 roms (fixes FBA load problem)
BurnLoadRom(Neo68KROM01+0x100000, 1, 1);
BurnLoadRom(Neo68KROM01+0x300000, 2, 1);
}
static void ms5p_sx_fix()
{
int i, rom_size = 0x20000;
UINT8 *src = (UINT8*)(NeoTextROM+0x20000);
UINT8 *dst = (UINT8 *)malloc( rom_size );
memcpy( dst,src,rom_size );
// descrambling the S1
for( i=0; i memcpy(src+i, dst+i+0x08, 0x08);
memcpy(src+i+0x08, dst+i, 0x08);
}
free( dst );
}
static void ms5p_vx_fix()
{
const unsigned char ms5xor[0x08] = { 0xc3, 0xfd, 0x81, 0xac, 0x6d, 0xe7, 0xbf, 0x9e };
int i, ofst, rom_size = 0x1000000;
UINT8 *rom = YM2610ADPCMAROM;
UINT8 *buf = (UINT8 *)malloc( rom_size );
memcpy(buf, rom, rom_size);
for( i = 0; i < rom_size; i++)
{
ofst = (i & 0xfefffe) | ((i & 0x010000) >> 16) | ((i & 0x000001) << 16);
ofst ^= 0x4e001;
rom[ofst] = (buf[((i + 0xfe2cf6) & 0xffffff)] ^ ms5xor[(ofst & 0x07)]);
}
free( buf );
}
static void ms5plus_decrypt()
{
ms5p_px_fix();
ms5p_sx_fix();
ms5p_vx_fix();
}
static int ms5plusInit()
{
int nRet;
memset(CartRAM,0,0x2000);
nNeoProtectionXor = 0x19;
pNeoInitCallback = ms5plus_decrypt;
nRet = NeoInit();
if (!nRet)
ms5plusMapHandler();
return nRet;
}
struct BurnDriver BurnDrvms5plus = {
{"ms5plus", "Metal Slug 5 Plus! (hack)", "Hack of mslug5", "SNK Playmore", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_GAME_WORKING | BDF_CLONE | BDF_BOOTLEG, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B | HARDWARE_SNK_NEWBANKSYSTEM,
NULL, ms5plusRomInfo, ms5plusRomName, neogeoInputInfo, neogeoDIPInfo,
ms5plusInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
-
Wow! You're on a roll :)
Thanks BMS :)
-
Thanks a lot man! this is pretty good... maybe you can figure out which protection does kof2002b has in s1, p2 and c roms
Thanks
See ya!!!! :D
-
Thanks a lot man! this is pretty good... maybe you can figure out which protection does kof2002b has in s1, p2 and c roms
Thanks
See ya!!!! :D
kof2002b P-rom code is here,s1 unknown now, I don't have kof2002b C-roms,^_^.
// The King of Fighters 2002 (bootleg)
static struct BurnRomInfo kof2002bRomDesc[] = {
{"265-p1.bin", 0x100000, 0x9EDE7323, 0x10}, // 0 68K code
{"265-p2b.bin", 0x400000, 0x6DBEE4DF, 0x10}, // 1
static void kof2002b_px_decrypt()
{
int sec[] = { 0x02, 0x05, 0x06, 0x03, 0x00, 0x07, 0x04, 0x01 };
int i, rom_size = 0x400000;
UINT8 *src = Neo68KROM01+0x100000;
UINT8 *dst = (UINT8 *)malloc( rom_size );
memcpy( dst, src, rom_size);
for( i=0; i<8; i++){
memcpy( src+i*0x80000, dst+sec[i]*0x80000, 0x80000);
}
free( dst );
}
-
urrrgg...darn, im lost again after some matters. anyways, just a little question. if mslug5 uses 3 for neo_pvc then whats the value for svcchaos and kof2003 (i know kof2003 doesnt work yet)
I thought kof2003 does work (not the bootleg) As it works here .
-
kof2002b P-rom code is here,s1 unknown now, I don't have kof2002b C-roms,^_^.
// The King of Fighters 2002 (bootleg)
static struct BurnRomInfo kof2002bRomDesc[] = {
{"265-p1.bin", 0x100000, 0x9EDE7323, 0x10}, // 0 68K code
{"265-p2b.bin", 0x400000, 0x6DBEE4DF, 0x10}, // 1
static void kof2002b_px_decrypt()
{
int sec[] = { 0x02, 0x05, 0x06, 0x03, 0x00, 0x07, 0x04, 0x01 };
int i, rom_size = 0x400000;
UINT8 *src = Neo68KROM01+0x100000;
UINT8 *dst = (UINT8 *)malloc( rom_size );
memcpy( dst, src, rom_size);
for( i=0; i<8; i++){
memcpy( src+i*0x80000, dst+sec[i]*0x80000, 0x80000);
}
free( dst );
}
the s1 is scrambled: first 128 bytes are where they should be, next 128 bytes belongs to another place and this repeat untill the end of the rom
128 ok 128 moved
128 ok 128 moved
...
-
Thanks for the init BMS, check PM in PPX BBS...
BTW, about the s1 rom... it looks really messy but thanks for the info Kany
See ya!!!! :D
-
I thought kof2003 does work (not the bootleg) As it works here .
i asked the question back when the driver for kof2003 wasnt totally figured out yet. sorry for the spam but im trying to get back again and surprised about the reply :D
-
why i use HalRIN's mslug5 MAME code,i can't get good CRC with Uni-bios,but with FBASP can get it?
-
why i use HalRIN's mslug5 MAME code,i can't get good CRC with Uni-bios,but with FBASP can get it?
Have you tried with my version? (with the real bankswitch enabled in FBA? is just one page back)... maybe that one gives the correct CRC...
See ya!!!!! :D
P.D. Any luck with kof2002b C-ROMs? :confused:
-
Have you tried with my version? (with the real bankswitch enabled in FBA? is just one page back)... maybe that one gives the correct CRC...
See ya!!!!! :D
P.D. Any luck with kof2002b C-ROMs? :confused:
real bankswitch??? means you have got it,^_^.
I have the whole PVC bankswitch code,but it's not time to open now:D
-
Just ported Neoathyr's MAME bankswitch. I like this a lot better than the large pvc code.
No cartram and no HARDWARE_SNK_CUSTOMBANKING or HARDWARE_SNK_NEWBANKSYSTEM is required either. ;)
// Metal Slug 5
static struct BurnRomInfo mslug5RomDesc[] = {
{"268-p1.bin", 0x400000, 0xd0466792, 1 | BRF_ESS | BRF_PRG }, // 0 68K code
{"268-p2.bin", 0x400000, 0xfbf6b61e, 1 | BRF_ESS | BRF_PRG }, // 1
{"268-c1.bin", 0x800000, 0x27d59de8, 3 | BRF_GRA }, // 2 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1, 3 | BRF_GRA }, // 3
{"268-c3.bin", 0x800000, 0xb650f098, 3 | BRF_GRA }, // 4
{"268-c4.bin", 0x800000, 0x10499589, 3 | BRF_GRA }, // 5
{"268-c5.bin", 0x800000, 0x19352405, 3 | BRF_GRA }, // 6
{"268-c6.bin", 0x800000, 0xb1531523, 3 | BRF_GRA }, // 7
{"268-c7.bin", 0x800000, 0xfe2c1338, 3 | BRF_GRA }, // 8
{"268-c8.bin", 0x800000, 0xecce3141, 3 | BRF_GRA }, // 9
{"268-m1d.bin", 0x040000, 0x6866d696, 4 | BRF_ESS | BRF_PRG }, // 10 Z80 code
{"268-m1.bin", 0x040000, 0x88c11f51, 4 | BRF_PRG | BRF_OPT }, // 10
{"268-v1.bin", 0x800000, 0x33c6305c, 5 | BRF_SND }, // 11 Sound data
{"268-v2.bin", 0x800000, 0x1afb848e, 5 | BRF_SND }, // 12
};
STDROMPICKEXT(mslug5, mslug5, neogeo);
STD_ROM_FN(mslug5);
static void mslug5PVCDecrypt()
{
interleave_pdata();
do_neopvc(3);
memcpy(Neo68KROM+0x200000, Neo68KROM+0x100000, 0x400000);
*((unsigned short*)(Neo68KROM + 0x122A)) = 0x4e75; // AES Patch
}
// Based on code provided by BMS888 and Neoaethyr, ported by IQ_132
void __fastcall mslug5_w(unsigned int sekAddress, unsigned short data)
{
if (sekAddress==0x2ffff2)
{
SekMapMemory(Neo68KROM+(data<<8)+0x100000, 0x200000, 0x2fdfff, SM_ROM);
};
}
static void ms5MapHandler()
{
SekMapHandler(5, 0x2ffff0, 0x2fffff, SM_WRITE);
SekSetWriteWordHandler(5, mslug5_w);
}
static int mslug5Init()
{
int nRet;
pNeoInitCallback = mslug5PVCDecrypt;
nNeoProtectionXor = 0x19;
nNeoPCM2PLAYMOREProtection = 3;
nRet = NeoInit();
if (nRet == 0) {
ms5MapHandler();
}
return nRet;
}
struct BurnDriver BurnDrvmslug5 = {
"mslug5", NULL, "neogeo", "2003",
"Metal Slug 5\0", NULL, "SNK Playmore Corporation", "Neo Geo",
NULL, NULL, NULL, NULL,
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, mslug5RomInfo, mslug5RomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
-
And again wth mslug5b (Real bootleg??)
// Metal Slug 5 (Bootleg)
static struct BurnRomInfo mslug5bRomDesc[] = {
{ "268-p1b.bin", 0x800000, 0x3f1cf3d2, 1 | BRF_ESS | BRF_PRG }, // 0 68K code
{ "268-c1b.bin", 0x800000, 0x969c0d62, 3 | BRF_GRA }, // 1 Sprite data
{ "268-c2b.bin", 0x800000, 0xc69ae867, 3 | BRF_GRA }, // 2
{ "268-c3b.bin", 0x800000, 0xd7beaeaf, 3 | BRF_GRA }, // 3
{ "268-c4b.bin", 0x800000, 0xe1b1131b, 3 | BRF_GRA }, // 4
{ "268-c5b.bin", 0x800000, 0x2fa1a5ad, 3 | BRF_GRA }, // 5
{ "268-c6b.bin", 0x800000, 0x6de89589, 3 | BRF_GRA }, // 6
{ "268-c7b.bin", 0x800000, 0x97bd0c0a, 3 | BRF_GRA }, // 7
{ "268-c8b.bin", 0x800000, 0xc0d5bc20, 3 | BRF_GRA }, // 8
{ "268-m1b.bin", 0x020000, 0x6FA01C9A, 4 | BRF_ESS | BRF_PRG }, // 9 Z80 code
{ "268-v1b.bin", 0x400000, 0xc3540e0d, 5 | BRF_SND }, // 10 Sound data
{ "268-v2b.bin", 0x400000, 0x077bd2f4, 5 | BRF_SND }, // 11
{ "268-v3b.bin", 0x400000, 0x39b14567, 5 | BRF_SND }, // 12
{ "268-v4b.bin", 0x400000, 0x969ff3b2, 5 | BRF_SND }, // 13
};
STDROMPICKEXT(mslug5b, mslug5b, neogeo);
STD_ROM_FN(mslug5b);
// Based on code provided by BMS888 and Neoaethyr, ported by IQ_132
void __fastcall mslug5b_bankswitch_w(unsigned int offset, unsigned short data)
{
if (offset == 0x2ffff2)
{
data = (data >> 12);
if (data == 2)
data = 3;
else
if (data == 3)
data = 2;
SekMapMemory(Neo68KROM+data*0x100000, 0x200000, 0x2fdfff, SM_ROM);
}
}
static int mslug5bInit()
{
int nRet = NeoInit();
if (nRet == 0)
{
SekMapHandler(5, 0x2ffff0, 0x2fffff, SM_WRITE);
SekSetWriteWordHandler(5, mslug5b_bankswitch_w);
}
return nRet;
}
struct BurnDriver BurnDrvmslug5b = {
"mslug5b", "mslug5", "neogeo", "2003",
"Metal Slug 5 (Bootleg)\0", NULL, "SNK Playmore Corporation", "Neo Geo",
NULL, NULL, NULL, NULL,
BDF_GAME_WORKING | BDF_BOOTLEG | BDF_CLONE, 2, HARDWARE_SNK_NEOGEO,
NULL, mslug5bRomInfo, mslug5bRomName, neogeoInputInfo, neogeoDIPInfo,
mslug5bInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};