Topic: SVC Chaos driver infos.

[iq_132]

sorry about that.
Try this one:

Code: [Select]

if (nTextBankswitch == 4) {
unsigned char *srom = NeoTextROM+0x20000;
(int i=0;isrom[i]=BITSWAP08(srom[i]^0xd2,4,0,7,2,5,1,6,3 );
}

[Xeon]

hmmm..same error still happens :\

[iq_132]

lmao!
I left out "for"

Code: [Select]

if (nTextBankswitch == 4) {
unsigned char *srom = NeoTextROM+0x20000;
for (int i=0;i srom[i]=BITSWAP08(srom[i]^0xd2,4,0,7,2,5,1,6,3 );
}
btw, you should update your stuff so that it is nNeoTextROMFixType instead of nTextBankswitch

[Xeon]

thank you, at least i can somewhat follow now is the name all thats changed?

[Badablek]

IQ, little question......

is the P1 8Mb AB053D97 supposed to work without any special initialisation or not

I tried it some days ago, it boots, then reboots, and reboots.....if I press Start > Black screen, music plays.....

This one is supposed to be Svcnd P1, is there some kind of protection (like on the bootleg) that doesn't allow it to work ?

What a mess with all these files/patches/hacks/redump, it gives me a big headache  

if P1 8Mb AB053D97 is not the good one, what's the good CRC value (fully decrypted without any protection and without any bugs or missing moves) ?

[Xeon]

the above code for p1 is just for the NeoPVC protection. bankswitching/ read/write handlers and stuff arent included for now.

[Badablek]

oki doki.......

so this "decrypted P1 for svcnd" is not really decrypted  

I'm lost   , need a "Universal fully decrypted without bugs non bootleg P1"

[FerchogtX]

An attempt to translate the bankswitch code... this doesn't work but if anyone knows how to improve it...

Code: [Select]

static unsigned short mv0_prot_offset[0x08];
static unsigned short mv0_bankswitch_offset[2];
static int mv0_bankswitch_flg;

unsigned char __fastcall mv0ReadByteProtection(unsigned int sekAddress)
{
return *(((unsigned char *)mv0_prot_offset)+((sekAddress^1)-0x2fffe0));
}

unsigned short __fastcall mv0ReadWordProtection(unsigned int sekAddress)
{
return mv0_prot_offset[(sekAddress-0x2fffe0)/2];
}

static void mv0_protWriteBankSwitch(unsigned int sekAddress,unsigned short wordValue,unsigned short valueMask)
{
int address=(sekAddress-0x2fffe0)/2;
mv0_prot_offset[address]=(wordValue&valueMask)|(~valueMask&mv0_prot_offset[address]);
if (address == 0) {
UINT8 *ofst8 = (UINT8*)mv0_prot_offset;
ofst8[0x02]=((ofst8[0x01]>>4)&0x01)+((ofst8[0x00]&0x0f)<<1);
ofst8[0x03]=((ofst8[0x01]>>5)&0x01)+(((ofst8[0x00]>>4)&0x0f)<<1);
ofst8[0x04]=((ofst8[0x01]>>6)&0x01)+((ofst8[0x01]&0x0f)<<1);
ofst8[0x05]=(ofst8[0x01]>>7);
} else if (address == 5) {
UINT8 *ofst8 = (UINT8*)mv0_prot_offset;
ofst8[0x0c]=(ofst8[0x08]>>1)|((ofst8[ 0x09 ] >> 1) << 4);
ofst8[0x0d]=(ofst8[0x0a]>>1)|((ofst8[ 0x08 ] & 0x01) << 4)|
((ofst8[ 0x09 ] & 0x01) << 5)|
((ofst8[ 0x0a ] & 0x01) << 6)|
(ofst8[ 0x0b ] << 7);
}
}

void __fastcall mv0WriteWordProtection(unsigned int sekAddress, unsigned short wordValue)
{
unsigned short valueMask=0xffef;
mv0_protWriteBankSwitch(sekAddress,wordValue,valueMask);
}

void __fastcall mv0WriteByteProtection(unsigned int sekAddress, unsigned char byteValue)
{
unsigned short wordValue=0,valueMask=0xef;
if(!(sekAddress&1)) {
wordValue=byteValue<<8;
valueMask<<=8;
} else {
wordValue=byteValue;
}
mv0_protWriteBankSwitch(sekAddress,wordValue,valueMask);
}

static void mv0_ProtMapHandler()
{
// Install BankSwitch handler
SekMapHandler(5, 0x2fffe0, 0x2fffef, SM_READ);
SekSetReadWordHandler(5,  mv0ReadWordProtection);
SekSetReadByteHandler(5,  mv0ReadByteProtection);

SekMapHandler(5, 0x2fffe0, 0x2fffef, SM_WRITE);
SekSetWriteWordHandler(5, mv0WriteWordProtection);
SekSetWriteByteHandler(5, mv0WriteByteProtection);
}

// ========================================================================

unsigned char __fastcall mv0ReadByteBankswitch(unsigned int sekAddress)
{
return *(((unsigned char*)mv0_bankswitch_offset)+((sekAddress^1)-0x2ffff0));
}

unsigned short __fastcall mv0ReadWordBankswitch(unsigned int sekAddress)
{
if( mv0_bankswitch_offset[0] == 0xffff && mv0_bankswitch_offset[1] == 0xffff ) {
mv0_bankswitch_flg = 1;
if (sekAddress == 0) {
return 0xfea0;
} else if (sekAddress == 1) {
return 0x7fff;
} else {
return mv0_bankswitch_offset[(sekAddress-0x2fffe0)/2];
}
} else if (mv0_bankswitch_offset[0] == 0x0000 && mv0_bankswitch_offset[1] == 0x0000 && mv0_bankswitch_flg == 1) {
if(sekAddress == 0) {
return 0x00a0;
} else if (sekAddress == 1) {
mv0_bankswitch_flg = 0;
return 0x0000;
} else {
return mv0_bankswitch_offset[(sekAddress-0x2fffe0)/2];
}
} else {
return mv0_bankswitch_offset[(sekAddress-0x2fffe0)/2];
}
}

static void mv0WriteBankSwitch(unsigned int sekAddress,unsigned short wordValue,unsigned short valueMask)
{
int address=(sekAddress-0x2ffff0)/2,bankaddress;
mv0_bankswitch_offset[address]=(wordValue&valueMask)|(~valueMask&mv0_bankswitch_offset[ address ]);
bankaddress = (mv0_bankswitch_offset[0]>>8)+(mv0_bankswitch_offset[1]<<8)+0x100000;
SekMapMemory(Neo68KROM02+bankaddress,0x200000,0x2fdfff,SM_ROM);
}

void __fastcall mv0WriteWordBankSwitch(unsigned int sekAddress, unsigned short wordValue)
{
unsigned short valueMask=0xfff3;
mv0WriteBankSwitch(sekAddress,wordValue,valueMask);
}

void __fastcall mv0WriteByteBankSwitch(unsigned int sekAddress, unsigned char byteValue)
{
unsigned short wordValue=0,valueMask=0xf3;
if(!(sekAddress&1)) {
wordValue=byteValue<<8;
valueMask<<=8;
} else {
wordValue=byteValue;
}
mv0WriteBankSwitch(sekAddress,wordValue,valueMask);
}

static void mv0_BankMapHandler()
{
// Install BankSwitch handler
SekMapHandler(5, 0x2ffff0, 0x2ffff3, SM_READ);
SekSetReadWordHandler(5,  mv0ReadWordBankswitch);
SekSetReadByteHandler(5,  mv0ReadByteBankswitch);

SekMapHandler(5, 0x2ffff0, 0x2ffff3, SM_WRITE);
SekSetWriteWordHandler(5, mv0WriteWordBankSwitch);
SekSetWriteByteHandler(5, mv0WriteByteBankSwitch);
}

// --------------

static int svcchaosInit()
{
int nRet;

pNeoInitCallback = svcchaos_PVC_Protection;
nNeoProtectionXor = 0x57;
nNeoTextROMSize = 0x080000;
nNeoTextROMFixType = 6;

nRet = NeoInit();
if (!nRet) {
mv0_ProtMapHandler();
mv0_BankMapHandler();
}
return NeoInit();
}

static int svchaosaInit()
{
int nRet;

pNeoInitCallback = svchaosa_PVC_Protection;
nNeoProtectionXor = 0x57;
nNeoTextROMSize = 0x080000;

nRet = NeoInit();
if (!nRet) {
mv0_ProtMapHandler();
mv0_BankMapHandler();
}
return NeoInit();
}
See ya!!!!

[JiMMy_PaGe]

Thanks ferchogtx, lets work on this thing  
Here is the code to decrypt svcboot p1:

Code: [Select]


//FBA Conversion by JiMMy_PaGe (www.neofighters.com.br) original code by Harin
static void svcboot_px_decrypt()
{
int sec[] =  {0x06, 0x07, 0x01, 0x02, 0x03, 0x04, 0x05, 0x00};
     
unsigned char *src = Neo68KROM01;
int i,ofst,size = 0x800000;
unsigned char *dst = (unsigned char*)malloc(size);

         for( i = 0; i < size / 0x100000; i++ ){
memcpy( &dst[ i * 0x100000 ], &src[ sec[ i ] * 0x100000 ], 0x100000 );
}

for( i = 0; i < size / 2; i++ ){
ofst = BITSWAP08( (i & 0x0000ff), 7, 6, 1, 0, 3, 2, 5, 4 );
ofst += (i & 0xffff00);

memcpy( &src[ i * 2 ], &dst[ ofst * 2 ], 0x02 );
}

free( dst );
}

U have to use kof2003 bankswtich too
See ya

[FerchogtX]

You mean kof2003b (bootleg) bankswitch right?
See ya!!!!

[JiMMy_PaGe]

You mean kof2003b (bootleg) bankswitch right?
See ya!!!!

Yeah thats right  
Im thinking about something:
if svcboot uses mv0_bankswitch and it runs using kof2003b bankswitch
mv0_bankswitch  = kof2003b bankswitch
So we just have to convert mv0_prot and that MWA16_RAM to run svcnd, svchaosa and kof2003 ( we have to fix that bios problem too)
See ya  

[Badablek]

IQ, little question......

is the P1 8Mb AB053D97 supposed to work without any special initialisation or not

I tried it some days ago, it boots, then reboots, and reboots.....if I press Start > Black screen, music plays.....

This one is supposed to be Svcnd P1, is there some kind of protection (like on the bootleg) that doesn't allow it to work ?

What a mess with all these files/patches/hacks/redump, it gives me a big headache  

if P1 8Mb AB053D97 is not the good one, what's the good CRC value (fully decrypted without any protection and without any bugs or missing moves) ?

Again with a new stupid question  

I tried some combinaisons between P1 AB053D97 and P1 93855C0B, and when I replace the first 1Mo of AB053D97 with the one from 93855C0B, the game boots fine and works without any problem.......
Here is my question : Only the first chunk (first 1Mo) of the P1 is protected By comparing the 2 files, there isn't a lot of diff' (SNK Giga power logo added for example).

Is there some kind of protection like on svcplus (1 bit that prevents the game to work) as the P1 AB053D97 boots fine the reboots ?

[iq_132]

Here's the code for decrypting svcboot's C roms (I'm sure everyone would rather use this than that closed source lib file )

Code: [Select]

// Original MAME code by HalRIN - http://www52.tok2.com/home/foge/
static void svcboot_cx_decrypt()
{
const unsigned char sec[ 0x10 ] = {
0, 1, 0, 1, 2, 3, 2, 3, 3, 4, 3, 4, 4, 5, 4, 5,
};

const unsigned char swap[ 6 ][ 4 ] = {
{ 3, 0, 1, 2 },
{ 2, 3, 0, 1 },
{ 1, 2, 3, 0 },
{ 0, 1, 2, 3 },
{ 3, 2, 1, 0 },
{ 3, 0, 2, 1 },
};

int i;
int fsize = 0x4000000;
UINT8 *src = NeoSpriteROM;
UINT8 *dst = (UINT8*)malloc( fsize );
int ofst;

memcpy( dst, src, fsize );

for( i = 0; i < fsize / 0x80; i++ ){
int tbl = sec[ (i & 0xf00) >> 8 ];

int bit0 = swap[ tbl ][ 0 ];
int bit1 = swap[ tbl ][ 1 ];
int bit2 = swap[ tbl ][ 2 ];
int bit3 = swap[ tbl ][ 3 ];

ofst = BITSWAP08( (i & 0x0000ff), 7, 6, 5, 4, bit3, bit2, bit1, bit0 );
ofst += (i & 0xfffff00);

memcpy( &src[ i * 0x80 ], &dst[ ofst * 0x80 ], 0x80 );
}

free( dst );
}

[iq_132]

Here's my source to get svcchaos working in FBA
This uses the correct(?) PCB roms (32mb P & Cs)

Adding this code is Fairly complicated, so if it doesn't work correctly the first time, try it again maybe you'll get better results

[James33]

I tried kof2003b on the mv0_bankswitch on Mame The game loads ok but resets when you try and play the game So I reused the old koof2003b bankswitch.