Welcome!
Final Burn Neo => FBN Development => Topic started by: iq_132 on November 08, 2004, 06:35:31 AM
-
Here's source code to descramble the bootleg svc C roms:
// Original MAME code by HalRIN - http://www52.tok2.com/home/foge/
static void svcboot_cx_decrypt()
{
const unsigned char sec[ 0x10 ] = {
0, 1, 0, 1, 2, 3, 2, 3, 3, 4, 3, 4, 4, 5, 4, 5,
};
const unsigned char swap[ 6 ][ 4 ] = {
{ 3, 0, 1, 2 },
{ 2, 3, 0, 1 },
{ 1, 2, 3, 0 },
{ 0, 1, 2, 3 },
{ 3, 2, 1, 0 },
{ 3, 0, 2, 1 },
};
int i;
int fsize = 0x4000000;
UINT8 *src = NeoSpriteROM;
UINT8 *dst = (UINT8*)malloc( fsize );
int ofst;
memcpy( dst, src, fsize );
for( i = 0; i < fsize / 0x80; i++ ){
int tbl = sec[ (i & 0xf00) >> 8 ];
int bit0 = swap[ tbl ][ 0 ];
int bit1 = swap[ tbl ][ 1 ];
int bit2 = swap[ tbl ][ 2 ];
int bit3 = swap[ tbl ][ 3 ];
ofst = BITSWAP08( (i & 0x0000ff), 7, 6, 5, 4, bit3, bit2, bit1, bit0 );
ofst += (i & 0xfffff00);
memcpy( &src[ i * 0x80 ], &dst[ ofst * 0x80 ], 0x80 );
}
free( dst );
}
I've attached the old (lib) that was used to descramble the bootleg svc C roms.
-
And here are my drivers for anyone who cares.....LOL :D
Don't PM me about these not being 100% correct, I know they aren't, but it's the best I got right now.....the others are hard to find or not emulated correctly....... ;)
// SVC Chaos: SNK Vs. Capcom (bootleg, set 1)
static struct BurnRomInfo svcbootRomDesc[] = {
{"svc-p1.bin", 0x600000, 0x1cc8fb7a, 0x10}, // 0 68K code
{"svc-s1.bin", 0x020000, 0x70b44df1, 1}, // 1 Text data
{"svc-c1.bin", 0x800000, 0xa7826b89, 1}, // 2 Sprite data
{"svc-c2.bin", 0x800000, 0xed3c2089, 1}, // 3
{"svc-c3.bin", 0x800000, 0x71ed8063, 1}, // 5
{"svc-c4.bin", 0x800000, 0x250bde2d, 1}, // 6
{"svc-c5.bin", 0x800000, 0x9817c082, 1}, // 7
{"svc-c6.bin", 0x800000, 0x2bc0307f, 1}, // 8
{"svc-c7.bin", 0x800000, 0x4358d7b9, 1}, // 9
{"svc-c8.bin", 0x800000, 0x366deee5, 1}, // 10
{"svc-m1.bin", 0x020000, 0x804328c3, 0x10}, // 11 Z80 code
{"svc-v1.bin", 0x400000, 0xbd3a391f, 2}, // 12 Sound data
{"svc-v2.bin", 0x400000, 0xb5097287, 2}, // 13
{"svc-v3.bin", 0x400000, 0xaa9849a0, 2}, // 14
{"svc-v4.bin", 0x400000, 0x33fc0b37, 2}, // 15
};
STDROMPICKEXT(svcboot, svcboot, neogeo);
STD_ROM_FN(svcboot);
static void svcboot_m1Decrypt()
{
UINT8 *mrom = (UINT8 *)(NeoZ80ROM);
UINT8 *dst = (UINT8*)malloc(0x20000);
memcpy( dst+0x00000, mrom+0x10000, 0x10000 );
memcpy( dst+0x10000, mrom+0x00000, 0x10000 );
memcpy( mrom, dst, 0x20000 );
free(dst);
svcboot_c(); // svcboot C fix
}
static int svcbootInit()
{
pNeoInitCallback=svcboot_m1Decrypt;
nTextBankswitch=2;
nADPCMByteswap = 2;
return NeoInit();
}
struct BurnDriver BurnDrvsvcboot = {
{"svcboot", "SVC Chaos: SNK Vs. Capcom (bootleg, set 1)", NULL, "Playmore / Capcom", "Neo Geo", "2003", NULL, "neogeo"},
BDF_GAME_WORKING | BDF_LOCKED | BDF_BOOTLEG, 2, HARDWARE_SNK_NEOGEO,
NULL, svcbootRomInfo, svcbootRomName, neogeoInputInfo, neogeoDIPInfo,
svcbootInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
// SVC Chaos: SNK vs Capcom (bootleg, set 2)
/* ================================================== =============================== */
/* This version has the blending effect as svcchaos, the text rom is scrambled
and needs extra handling... */
/* ================================================== =============================== */
static struct BurnRomInfo svcbootaRomDesc[] = {
{"svc-p1.bin", 0x600000, 0x1cc8fb7a, 0x10}, // 0 68K code
{"svc-s1a.bin ", 0x080000, 0xad184232, 1}, // 1 Text data
{"svc-c1.bin", 0x800000, 0xa7826b89, 1}, // 2 Sprite data
{"svc-c2.bin", 0x800000, 0xed3c2089, 1}, // 3
{"svc-c3.bin", 0x800000, 0x71ed8063, 1}, // 5
{"svc-c4.bin", 0x800000, 0x250bde2d, 1}, // 6
{"svc-c5.bin", 0x800000, 0x9817c082, 1}, // 7
{"svc-c6.bin", 0x800000, 0x2bc0307f, 1}, // 8
{"svc-c7.bin", 0x800000, 0x4358d7b9, 1}, // 9
{"svc-c8.bin", 0x800000, 0x366deee5, 1}, // 10
{"svc-m1.bin", 0x020000, 0x804328c3, 0x10}, // 11 Z80 code
{"svc-v1.bin", 0x400000, 0xbd3a391f, 2}, // 12 Sound data
{"svc-v2.bin", 0x400000, 0xb5097287, 2}, // 13
{"svc-v3.bin", 0x400000, 0xaa9849a0, 2}, // 14
{"svc-v4.bin", 0x400000, 0x33fc0b37, 2}, // 15
};
STDROMPICKEXT(svcboota, svcboota, neogeo);
STD_ROM_FN(svcboota);
static int svcbootaInit()
{
/* This uses the same function for the m1 as svcboot */
pNeoInitCallback=svcboot_m1Decrypt;
nTextBankswitch=4;
nADPCMByteswap = 2;
return NeoInit();
}
struct BurnDriver BurnDrvsvcboota = {
{"svcboota", "SVC Chaos: SNK Vs. Capcom (bootleg, set 2)", NULL, "Playmore / Capcom", "Neo Geo", "2003", "svcboot", "neogeo"},
BDF_GAME_WORKING | BDF_CLONE | BDF_BOOTLEG | BDF_LOCKED, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ALTERNATE_TEXT,
NULL, svcbootaRomInfo, svcbootaRomName, neogeoInputInfo, neogeoDIPInfo,
svcbootaInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
// SVC Chaos: SNK Vs. Capcom Plus! (bootleg, set 1)
static struct BurnRomInfo svcplusRomDesc[] = {
{"svc-p1p.bin", 0x600000, 0x7bdc4420, 0x10}, // 0 68K code
{"svc-s1p.bin", 0x020000, 0xaaef740c, 1}, // 1 Text data
{"svc-c1.bin", 0x800000, 0xa7826b89, 1}, // 2 Sprite data
{"svc-c2.bin", 0x800000, 0xed3c2089, 1}, // 3
{"svc-c3.bin", 0x800000, 0x71ed8063, 1}, // 5
{"svc-c4.bin", 0x800000, 0x250bde2d, 1}, // 6
{"svc-c5.bin", 0x800000, 0x9817c082, 1}, // 7
{"svc-c6.bin", 0x800000, 0x2bc0307f, 1}, // 8
{"svc-c7.bin", 0x800000, 0x4358d7b9, 1}, // 9
{"svc-c8.bin", 0x800000, 0x366deee5, 1}, // 10
{"svc-m1.bin", 0x020000, 0x804328c3, 0x10}, // 11 Z80 code
{"svc-v1.bin", 0x400000, 0xbd3a391f, 2}, // 12 Sound data
{"svc-v2.bin", 0x400000, 0xb5097287, 2}, // 13
{"svc-v3.bin", 0x400000, 0xaa9849a0, 2}, // 14
{"svc-v4.bin", 0x400000, 0x33fc0b37, 2}, // 15
};
STDROMPICKEXT(svcplus, svcplus, neogeo);
STD_ROM_FN(svcplus);
static int svcplusInit()
{
pNeoInitCallback=svcboot_m1Decrypt;
nADPCMByteswap = 2;
return NeoInit();
}
struct BurnDriver BurnDrvsvcplus = {
{"svcplus", "SVC Chaos: SNK Vs. Capcom Plus! (bootleg, set 1)", NULL, "Playmore / Capcom", "Neo Geo", "2003", "svcboot", "neogeo"},
BDF_GAME_WORKING | BDF_LOCKED | BDF_CLONE | BDF_BOOTLEG, 2, HARDWARE_SNK_NEOGEO,
NULL, svcplusRomInfo, svcplusRomName, neogeoInputInfo, neogeoDIPInfo,
svcplusInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
// SvC Chaos: SNK vs Capcom Plus! (bootleg, set 2)
static struct BurnRomInfo svcplusaRomDesc[] = {
{"svc-p1pl.bin",0x200000, 0x16b44144, 0x10}, // 0 68K code /* alternate code... scrambled and protected */
{"svc-p2pl.bin",0x400000, 0x7231ace2, 0x10}, // 1
{"svc-s1pl.bin",0x020000, 0xca3c735e, 1}, // 2 Text data /* scrambled */
{"svc-c1.bin", 0x800000, 0xa7826b89, 1}, // 3 Sprite data /* bit-swaped */
{"svc-c2.bin", 0x800000, 0xed3c2089, 1}, // 4
{"svc-c3.bin", 0x800000, 0x71ed8063, 1}, // 5
{"svc-c4.bin", 0x800000, 0x250bde2d, 1}, // 6
{"svc-c5.bin", 0x800000, 0x9817c082, 1}, // 7
{"svc-c6.bin", 0x800000, 0x2bc0307f, 1}, // 8
{"svc-c7.bin", 0x800000, 0x4358d7b9, 1}, // 9
{"svc-c8.bin", 0x800000, 0x366deee5, 1}, // 10
{"svc-m1.bin", 0x020000, 0x804328c3, 0x10}, // 11 Z80 code /* scrambled */
/* scrambled, bit-swaped */
{"svc-v1.bin", 0x400000, 0xbd3a391f, 2}, // 12 Sound data
{"svc-v2.bin", 0x400000, 0xb5097287, 2}, // 13
{"svc-v3.bin", 0x400000, 0xaa9849a0, 2}, // 14
{"svc-v4.bin", 0x400000, 0x33fc0b37, 2}, // 15
};
STDROMPICKEXT(svcplusa, svcplusa, neogeo);
STD_ROM_FN(svcplusa);
static void svcplusaDecrypt()
{
/* Descrambling Px by FerchogtX */
unsigned char* prom = Neo68KROM01;
unsigned char* dst = (unsigned char*)malloc(0x600000);
unsigned int sec[]={0x100000,0x200000,0x300000,0x400000,0x500000,0x000000};
if (dst)
{
memcpy( dst, prom, 0x600000 );
for( int i=0; i<6; ++i )
{
memcpy( prom+i*0x100000, dst+sec[i], 0x100000 );
}
free(dst);
}
svcboot_m1Decrypt();// Using the same function as svcboota
/* Patch out protection (info by robber804) */
/*
F8010: 40 C6 F8011: 04 33
F8012: 00 2F F8013: 10 00
F8014: 40 F2 F8015: 46 FF
F8016: C1 C2 some kind of protection?
F802C: 16 C0 don't know what this does
F80C0: FF 42 F80C1: FF 06
F80C2: FF 02 F80C3: FF 00
F80C4: FF F9 F80C5: FF 4E
F80C6: FF 0F F80C7: FF 00
F80C8: FF 16 F80C9: FF 80
*/
// 33c2 for "good" crc
*((unsigned short*)(Neo68KROM01 + 0xf8016)) = 0x33c1; /* 0F8028 33C2 002F FFF0 MOVE.W D2,0x2FFFF0 */
/* The below probably does not need to be patched in memory needed just to patch diffs from 1cc8fb7a */
// *((unsigned short*)(Neo68KROM01 + 0xf8010)) = 0x4004; /* 0F8010 33C6 002F FFF2 MOVE.W D6,0x2FFFF2 */
// *((unsigned short*)(Neo68KROM01 + 0xf8012)) = 0x0010;
// *((unsigned short*)(Neo68KROM01 + 0xf8014)) = 0x4046;
// *((unsigned short*)(Neo68KROM01 + 0xf802c)) = 0x1680; /* 0F8028 4EF9 000F 80C0 JMP 0xF80C0 */
// *((unsigned short*)(Neo68KROM01 + 0xf80c0)) = 0xffff; /* 0F8028 4EF9 000F 80C0 JMP 0xF80C0 */
// *((unsigned short*)(Neo68KROM01 + 0xf80c2)) = 0xffff; /* 0F8028 4EF9 000F 80C0 JMP 0xF80C0 */
// *((unsigned short*)(Neo68KROM01 + 0xf80c4)) = 0xffff; /* 0F8028 4EF9 000F 80C0 JMP 0xF80C0 */
// *((unsigned short*)(Neo68KROM01 + 0xf80c6)) = 0xffff; /* 0F8028 4EF9 000F 80C0 JMP 0xF80C0 */
// *((unsigned short*)(Neo68KROM01 + 0xf80c8)) = 0xffff; /* 0F8028 4EF9 000F 80C0 JMP 0xF80C0 */
}
static int svcplusaInit()
{
pNeoInitCallback = svcplusaDecrypt;
nTextBankswitch=2;
nADPCMByteswap = 3;
return NeoInit();
}
struct BurnDriver BurnDrvsvcplusa = {
{"svcplusa", "SVC Chaos: SNK Vs. Capcom Plus! (bootleg, set 2)", NULL, "Playmore / Capcom", "Neo Geo", "2003", "svcboot", "neogeo"},
BDF_GAME_WORKING | BDF_CLONE | BDF_BOOTLEG | BDF_LOCKED, 2, HARDWARE_SNK_NEOGEO,
NULL, svcplusaRomInfo, svcplusaRomName, neogeoInputInfo, neogeoDIPInfo,
svcplusaInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
-
Here is the code for these roms (svcsplus) :D
{"svc-p1p.bin", 0x400000, 0x2601902F, 0x10}, // 0 68K code
{"svc-p2p.bin", 0x400000, 0x0ca13305, 0x10}, // 1
{"svc-s1p.bin", 0x020000, 0x233D6439, 1}, // 2 Text data
Here's the S decryption code (It's best to use ferchogtx's "NeoTextromfix" code and add this to that):
// Converted by Jimmy_Page (www.neofighters.com)
srom = NeoTextROM+0x20000;
for (int i=0;i<0x20000;i++)
srom[i]=BITSWAP08(srom[i],7,6,0,4,3,2,1,5);
Here's the P decryption code.
// Analyzed by HalRIN - http://www52.tok2.com/home/foge/
static void svcsplus_px_decrypt()
{
int sec[] = {0x06, 0x01, 0x02, 0x03, 0x04, 0x05, 0x00, 0x07};
int sed[] = {0x000000,0x700000,0x100000,0x200000,0x300000,0x400000,0x500000};
unsigned char *src = Neo68KROM01;
int i,ofst,size = 0x800000;
unsigned char *dst = (unsigned char*)malloc(size);
memcpy( dst, src, size );
for( i = 0; i < size / 2; i++ )
{
ofst = BITSWAP16( (i & 0x007fff), 0x0f, 0x00, 0x08, 0x09, 0x0b, 0x0a, 0x0c, 0x0d,
0x04, 0x03, 0x01, 0x07, 0x06, 0x02, 0x05, 0x0e );
ofst += (i & 0x078000);
ofst += sec[ (i & 0xf80000) >> 19 ] << 19;
memcpy( &src[ i * 2 ], &dst[ ofst * 2 ], 0x02 );
}
memcpy(dst,src,0x800000);
for(i = 0; i < 7; ++i)
{
memcpy(src+i*0x100000,dst+sed[i],0x100000);
}
free(dst);
*((unsigned short*)(Neo68KROM01 + 0x9E90)) = 0x000F; // Enable S. Plus
*((unsigned short*)(Neo68KROM01 + 0x9E92)) = 0xc9c0;
*((unsigned short*)(Neo68KROM01 + 0xA10C)) = 0x4EB9; // Enable boss icons
*((unsigned short*)(Neo68KROM01 + 0xA10E)) = 0x000E;
*((unsigned short*)(Neo68KROM01 + 0xA110)) = 0x9750;
}
-
And here's the P rom decryption code for these P roms (svcplus):
{"svc-p1p.bin", 0x200000, 0xA194D842, 0x10}, // 0 68K code
{"svc-p2p.bin", 0x200000, 0x50C0E2B7, 0x10}, // 1
{"svc-p3p.bin", 0x200000, 0x58CDC293, 0x10}, // 2
// Analyzed by HalRIN - http://www52.tok2.com/home/foge/
static void svcplus_px_decrypt()
{
int sec[] = {0x00, 0x03, 0x02, 0x05, 0x04, 0x01};
unsigned char *src = Neo68KROM01;
int i,ofst,rom_size = 0x600000;
unsigned char *dst = (unsigned char*)malloc( rom_size );
memcpy( dst, src, rom_size );
for( i = 0; i < rom_size / 2; i++ ){
ofst = BITSWAP24( (i & 0xfffff), 0x17, 0x16, 0x15, 0x14, 0x13, 0x00, 0x01, 0x02,
0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
0x07, 0x06, 0x05, 0x04, 0x03, 0x10, 0x11, 0x12 );
ofst ^= 0x0f0007;
ofst += (i & 0xff00000);
memcpy( &src[ i * 2 ], &dst[ ofst * 2 ], 0x02 );
}
memcpy( dst, src, rom_size );
for( i = 0; i < 6; i++ ){
memcpy( &src[ i << 20 ], &dst[ sec[ i ] << 20 ], (1 << 20) );
}
free( dst );
*((unsigned short*)(Neo68KROM01 + 0xF8016)) = 0x33c1; // Patch protected address
}
-
well it seems that the protection algorithm for new bootleg hacks is very similar to the protection used in the pcb games:
for svcsplus (it MUST work for kof2k3up too)
srom=BITSWAP08(srom,7,6,0,4,3,2,1,5);
for kof2k1pla
srom=BITSWAP08(srom,3,2,4,5,1,6,0,7);
for svcnd and kof2k3 PCB (svcchaos pcb too)
srom=BITSWAP08(srom,4,0,7,2,5,1,6,3);
-
Here's my attempt to convert that code to FBA.
*edit*
You need | HARDWARE_SNK_ALTERNATE_TEXT for kof2003 :)
Replace the NeoExtractSData function in neo_decrypt.cpp
// Analyzed by HalRIN - http://www52.tok2.com/home/foge/
void NeoExtractSData(unsigned char* rom, unsigned char* sdata, int rom_size, int sdata_size)
{
if (sdata_size != 0x100000)
{
/* the S data comes from the end fo the C data */
rom += rom_size - sdata_size;
for (int i = 0; i < sdata_size; i++) {
sdata[i] = rom[(i & ~0x1F) + ((i & 7) << 2) + ((~i & 8) >> 2) + ((i & 0x10) >> 4)];
}
} else {
int i;
unsigned char *src;
unsigned char *dst;
src = rom + rom_size - 0x1000000 - 0x80000;
dst = sdata;
// This extracts the first 512k of S data
for( i = 0; i < sdata_size / 2; i++ ){
dst[ i ] = src[ (i & ~0x1f) + ((i & 7) << 2) + ((~i & 8) >> 2) + ((i & 0x10) >> 4) ];
}
src = rom + rom_size - 0x80000;
dst = sdata + 0x80000;
// This extracts the second 512k of S data
for( i = 0; i < sdata_size / 2; i++ ){
dst[ i ] = src[ (i & ~0x1f) + ((i & 7) << 2) + ((~i & 8) >> 2) + ((i & 0x10) >> 4) ];
}
// This descrambles the S data (kof2003)
dst = sdata;
for( i = 0; i < sdata_size; i++ ){
dst[ i ] = BITSWAP08( dst[ i ] ^ 0xd2, 4, 0, 7, 2, 5, 1, 6, 3 );
}
}
}
-
Here is the code for these roms (svcsplus) :D
{"svc-p1p.bin", 0x400000, 0x2601902F, 0x10}, // 0 68K code
{"svc-p2p.bin", 0x400000, 0x0ca13305, 0x10}, // 1
{"svc-s1p.bin", 0x020000, 0x233D6439, 1}, // 2 Text data
Here's the P decryption code.
// Analyzed by HalRIN - http://www52.tok2.com/home/foge/
// FBA conversion by IQ_132 - http://neosource.1emu.net/
static void svcsplus_px_decrypt()
{
int sec[] = {0x06, 0x01, 0x02, 0x03, 0x04, 0x05, 0x00, 0x07};
int sed[] = {0x000000,0x700000,0x100000,0x200000,0x300000,0x400000,0x500000};
unsigned char *src = Neo68KROM01;
int i,ofst,size = 0x800000;
unsigned char *dst = (unsigned char*)malloc(size);
memcpy( dst, src, size );
for( i = 0; i < size / 2; i++ )
{
ofst = BITSWAP16( (i & 0x007fff), 0x0f, 0x00, 0x08, 0x09, 0x0b, 0x0a, 0x0c, 0x0d,
0x04, 0x03, 0x01, 0x07, 0x06, 0x02, 0x05, 0x0e );
ofst += (i & 0x078000);
ofst += sec[ (i & 0xf80000) >> 19 ] << 19;
memcpy( &src[ i * 2 ], &dst[ ofst * 2 ], 0x02 );
}
memcpy(dst,src,0x800000);
for(i = 0; i < 7; ++i)
{
memcpy(src+i*0x100000,dst+sed[i],0x100000);
}
free(dst);
*((unsigned short*)(Neo68KROM01 + 0x9E90)) = 0x000F; // Enable S. Plus
*((unsigned short*)(Neo68KROM01 + 0x9E92)) = 0xc9c0;
*((unsigned short*)(Neo68KROM01 + 0xA10C)) = 0x4EB9; // Enable boss icons
*((unsigned short*)(Neo68KROM01 + 0xA10E)) = 0x000E;
*((unsigned short*)(Neo68KROM01 + 0xA110)) = 0x9750;
}
and here's the S decryption code (It's best to use ferchogtx's "NeoTextromfix" code and add this to that):
// Converted by Jimmy_Page (www.neofighters.com)
srom = NeoTextROM+0x20000;
for (int i=0;i<0x20000;i++)
srom[i]=BITSWAP08(srom[i],7,6,0,4,3,2,1,5);
EDIT Never Mind I fixed it :)
// Snk Vs. Capcom: Chaos Super plus
static struct BurnRomInfo svcsplusRomDesc[] = {
{"svc-p1sp.bin", 0x400000, 0x2601902F, 0x10}, // 0 68K code
{"svc-p2sp.bin", 0x400000, 0x0ca13305, 0x10}, // 1
{"269-s1sp.bin",0x080000, 0xa792fdba, 1}, // 2 Text data
{"269-c1d.bin", 0x800000, 0x465D473B, 1}, // 3 Sprite data
{"269-c2d.bin", 0x800000, 0x3EB28F78, 1}, // 4
{"269-c3d.bin", 0x800000, 0xF4D4AB2B, 1}, // 5
{"269-c4d.bin", 0x800000, 0xA69D523A, 1}, // 6
{"269-c5d.bin", 0x800000, 0xBA2A7892, 1}, // 7
{"269-c6d.bin", 0x800000, 0x37371CA1, 1}, // 8
{"269-c7d.bin", 0x800000, 0x56AC5FB9, 1}, // 9
{"269-c8d.bin", 0x800000, 0xDE99E613, 1}, // 10
{"269-m1d.bin", 0x020000, 0xfd602218, 0x10}, // 11 Z80 code
{"269-v1d.bin", 0x800000, 0xdab37bef, 2}, // 12 Sound data
{"269-v2d.bin", 0x800000, 0x7b3e9487, 2}, // 13
};
STDROMPICKEXT(svcsplus, svcsplus, neogeo);
STD_ROM_FN(svcsplus);
static unsigned short svcsplsa_tbl[0x1000];
unsigned char __fastcall svcsplsaReadByteBankSwitch(unsigned int sekAddress)
{
return *(((unsigned char *)svcsplsa_tbl)+((sekAddress^1)-0x2fe000));
}
unsigned short __fastcall svcsplsaReadWordBankSwitch(unsigned int sekAddress)
{
return svcsplsa_tbl[(sekAddress-0x2fe000)/2];
}
static void svcsplsaWriteBankSwitch(unsigned int sekAddress,unsigned short wordValue,unsigned short valueMask)
{
int address=(sekAddress-0x2fe000)/2,bankaddress;
svcsplsa_tbl[address]=(wordValue&valueMask)|(~valueMask&svcsplsa_tbl[address]);
if(address!=0xff8 && address!=0xff9 ) return;
bankaddress=(svcsplsa_tbl[0xff8]>>8)|(svcsplsa_tbl[0xff9]<<8);
SekMapMemory(Neo68KROM02+bankaddress,0x200000,0x2fdfff,SM_ROM);
}
void __fastcall svcsplsaWriteWordBankSwitch(unsigned int sekAddress, unsigned short wordValue)
{
unsigned short valueMask=0xffff;
svcsplsaWriteBankSwitch(sekAddress,wordValue,valueMask);
}
void __fastcall svcsplsaWriteByteBankSwitch(unsigned int sekAddress, unsigned char byteValue)
{
unsigned short wordValue=0,valueMask=0xff;
if(!(sekAddress&1)) {
wordValue=byteValue<<8;
valueMask<<=8;
}
else{
wordValue=byteValue;
}
svcsplsaWriteBankSwitch(sekAddress,wordValue,valueMask);
}
static void svcsplsaMapHandler()
{
// Install BankSwitch handler
SekMapHandler(5, 0x2fe000, 0x2fffff, SM_READ);
SekSetReadWordHandler(5, svcsplsaReadWordBankSwitch);
SekSetReadByteHandler(5, svcsplsaReadByteBankSwitch);
SekMapHandler(5, 0x2fe000, 0x2fffff, SM_WRITE);
SekSetWriteWordHandler(5, svcsplsaWriteWordBankSwitch);
SekSetWriteByteHandler(5, svcsplsaWriteByteBankSwitch);
}
static void svcsplus_px_decrypt()
{
int sec[] = {0x06, 0x01, 0x02, 0x03, 0x04, 0x05, 0x00, 0x07};
int sed[] = {0x000000,0x700000,0x100000,0x200000,0x300000,0x400000,0x500000};
unsigned char *src = Neo68KROM01;
int i,ofst,size = 0x800000;
unsigned char *dst = (unsigned char*)malloc(size);
memcpy( dst, src, size );
for( i = 0; i < size / 2; i++ )
{
ofst = BITSWAP16( (i & 0x007fff), 0x0f, 0x00, 0x08, 0x09, 0x0b, 0x0a, 0x0c, 0x0d,
0x04, 0x03, 0x01, 0x07, 0x06, 0x02, 0x05, 0x0e );
ofst += (i & 0x078000);
ofst += sec[ (i & 0xf80000) >> 19 ] << 19;
memcpy( &src[ i * 2 ], &dst[ ofst * 2 ], 0x02 );
}
memcpy(dst,src,0x800000);
for(i = 0; i < 7; ++i)
{
memcpy(src+i*0x100000,dst+sed[i],0x100000);
}
free(dst);
*((unsigned short*)(Neo68KROM01 + 0x9E90)) = 0x000F; // Enable S. Plus
*((unsigned short*)(Neo68KROM01 + 0x9E92)) = 0xc9c0;
*((unsigned short*)(Neo68KROM01 + 0xA10C)) = 0x4EB9; // Enable boss icons
*((unsigned short*)(Neo68KROM01 + 0xA10E)) = 0x000E;
*((unsigned short*)(Neo68KROM01 + 0xA110)) = 0x9750;
}
static int svcsplusInit()
{
int nRet;
memset(svcsplsa_tbl,0,0x2000);
// sTextBankswitch=2;
pNeoInitCallback = svcsplus_px_decrypt;
nRet=NeoInit();
if(!nRet)
svcsplsaMapHandler();
nNeoTextROMSize = 0x080000;
return nRet;
}
struct BurnDriver BurnDrvsvcsplus = {
{"svcsplus", "Snk Vs. Capcom: Chaos Super plus", "Hack", "SNK Playmore Corporation", "Neo Geo", "2003", "svc", "neogeo"},
BDF_GAME_WORKING | BDF_CLONE | BDF_BOOTLEG, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ALTERNATE_TEXT | HARDWARE_SNK_NEWBANKSYSTEM,
NULL, svcsplusRomInfo, svcsplusRomName, neogeoInputInfo, neogeoDIPInfo,
svcsplusInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
-
When I tried this code the neogeo logo keep repeating over and over .
I am useing a decrypted S rom So thats why theres no S decryption .
Hehe u forgot about kof2003b map handler + banskwitch + HARDWARE_SNK_NEWBANKSYSTEM, if u put it the game will run well :D
See ya
-
Yes I just found that out :) I have allready edited my post above .
Now to convert that to Mame code hehe .
-
Yes I just found that out :) I have allready edited my post above .
Now to convert that to Mame code hehe .
U dont need to do it, u can get it here :D :
http://www52.tok2.com/home/foge/
See ya
-
Thanks so much for that :D It save me some time . :)
-
i just tried iq's conversion of S ROMs decryption, i know its an attempt for now but i just want to know if it at least compile (its giving me error on the BITSWAP08 thing)
-
make sure you put this at the type of neo_run.cpp
#include "byteswap.h"
-
make sure you put this at the type of neo_run.cpp
#include "byteswap.h"
what do you mean "at the type of neo_run.cpp"? :confused:
-
lol, I meant top ;)
Put it right under:
#include "neogeo.h"
-
hmmm..weird, the error is "...byteswap.h: No such file or directory", is this file suppose to be in my MinGW setup?
-
oops... "bitswap.h" :D
-
the darned thing simply hates me :eek:
MinGWC:\fbasrc>make >log.txt
src/burn/neogeo/neo_run.cpp: In function `int LoadRoms(NeoGameInfo*)':
src/burn/neogeo/neo_run.cpp:547: warning: ISO C++ forbids variable-size array `
buffer'
src/burn/neogeo/neo_decrypt.cpp:448: warning: ISO C++ forbids declaration of `
NeoExtractSData' with no type
src/burn/neogeo/neo_decrypt.cpp: In function `int NeoExtractSData(unsigned
char*, unsigned char*, int, int)':
src/burn/neogeo/neo_decrypt.cpp:448: new declaration `int
NeoExtractSData(unsigned char*, unsigned char*, int, int)'
src/burn/neogeo/neogeo.h:115: ambiguates old declaration `void
NeoExtractSData(unsigned char*, unsigned char*, int, int)'
src/burn/neogeo/neo_decrypt.cpp: In function `int NeoExtractSData(unsigned
char*, unsigned char*, int, int)':
src/burn/neogeo/neo_decrypt.cpp:481: `BITSWAP08' undeclared (first use this
function)
src/burn/neogeo/neo_decrypt.cpp:481: (Each undeclared identifier is reported
only once for each function it appears in.)
src/burn/neogeo/neo_decrypt.cpp:484: warning: no return statement in function
returning non-void
C:\MINGW\BIN\MAKE.EXE: *** [neo_decrypt.o] Error 1
MinGWC:\fbasrc>exit
time for a re-check i guess
-
Any chance to post the converted code for the P roms of kof2003? thanks for all the convertions man!!!!!!!!!!
See ya!!!! :D
-
The driver is not complete and does not work
EDIT : All sorted now .For Mame32 Plus
-
And here's the P rom decryption code for these P roms (svcplus):
{"svc-p1p.bin", 0x200000, 0xA194D842, 0x10}, // 0 68K code
{"svc-p2p.bin", 0x200000, 0x50C0E2B7, 0x10}, // 1
{"svc-p3p.bin", 0x200000, 0x58CDC293, 0x10}, // 2
// Analyzed by HalRIN - http://www52.tok2.com/home/foge/
static void svcplus_px_decrypt()
{
int sec[] = {0x00, 0x03, 0x02, 0x05, 0x04, 0x01};
unsigned char *src = Neo68KROM01;
int i,ofst,rom_size = 0x600000;
unsigned char *dst = (unsigned char*)malloc( rom_size );
memcpy( dst, src, rom_size );
for( i = 0; i < rom_size / 2; i++ ){
ofst = BITSWAP24( (i & 0xfffff), 0x17, 0x16, 0x15, 0x14, 0x13, 0x00, 0x01, 0x02,
0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
0x07, 0x06, 0x05, 0x04, 0x03, 0x10, 0x11, 0x12 );
ofst ^= 0x0f0007;
ofst += (i & 0xff00000);
memcpy( &src[ i * 2 ], &dst[ ofst * 2 ], 0x02 );
}
memcpy( dst, src, rom_size );
for( i = 0; i < 6; i++ ){
memcpy( &src[ i << 20 ], &dst[ sec[ i ] << 20 ], (1 << 20) );
}
free( dst );
*((unsigned short*)(Neo68KROM01 + 0xF8016)) = 0x33c1; // Patch protected address
}
in case this is not known this rom uses the same init as svcplusa .
-
If anyone has problems with the NeoExtractSdata that IQ_132 posted, maybe this can help.
Replace the whole old code with this:
// Analyzed by HalRIN - http://www52.tok2.com/home/foge/
void NeoExtractSData(unsigned char* rom, unsigned char* sdata, int rom_size, int sdata_size)
{
int i;
if (sdata_size == 0x100000) {
unsigned char *src = rom + rom_size - 0x1000000 - 0x80000;
unsigned char *dst = sdata;
// This extracts the first 512k of S data
for( i = 0; i < sdata_size / 2; i++ ) {
dst[ i ] = src[ (i & ~0x1f) + ((i & 7) << 2) + ((~i & 8) >> 2) + ((i & 0x10) >> 4) ];
}
src = rom + rom_size - 0x80000;
dst = sdata + 0x80000;
// This extracts the second 512k of S data
for( i = 0; i < sdata_size / 2; i++ ) {
dst[ i ] = src[ (i & ~0x1f) + ((i & 7) << 2) + ((~i & 8) >> 2) + ((i & 0x10) >> 4) ];
}
// This descrambles the S data (kof2003)
dst = sdata;
for( i = 0; i < sdata_size; i++ ) {
dst[ i ] = BITSWAP08( dst[ i ] ^ 0xd2, 4, 0, 7, 2, 5, 1, 6, 3 );
}
} else {
/* the S data comes from the end fo the C data */
rom += rom_size - sdata_size;
for ( i = 0; i < sdata_size; i++) {
sdata[i] = rom[(i & ~0x1F) + ((i & 7) << 2) + ((~i & 8) >> 2) + ((i & 0x10) >> 4)];
}
}
}and add this in the top of the file:
#include "bitswap.h"Is the same as the code posted bi IQ... but maybe it will work if you have probs...
See ya!!!!! :D
-
it worked now, thanks ferch (can i call you that? :D)
-
Here it is, is quite simple to convert (only redefinitions & conversions) :D
// Original code by HalRIN -- http://www52.tok2.com/home/foge/
static void svcchaos_px_decrypt( void )
{
const unsigned char xor1[ 0x20 ] = {
0x3b, 0x6a, 0xf7, 0xb7, 0xe8, 0xa9, 0x20, 0x99, 0x9f, 0x39, 0x34, 0x0c, 0xc3, 0x9a, 0xa5, 0xc8,
0xb8, 0x18, 0xce, 0x56, 0x94, 0x44, 0xe3, 0x7a, 0xf7, 0xdd, 0x42, 0xf0, 0x18, 0x60, 0x92, 0x9f,
};
const unsigned char xor2[ 0x20 ] = {
0x69, 0x0b, 0x60, 0xd6, 0x4f, 0x01, 0x40, 0x1a, 0x9f, 0x0b, 0xf0, 0x75, 0x58, 0x0e, 0x60, 0xb4,
0x14, 0x04, 0x20, 0xe4, 0xb9, 0x0d, 0x10, 0x89, 0xeb, 0x07, 0x30, 0x90, 0x50, 0x0e, 0x20, 0x26,
};
int i;
int ofst;
unsigned char *rom, *buf;
rom = Neo68KROM01;
for( i = 0; i < 0x100000; i++ ){
rom[ i ] ^= xor1[ (i % 0x20) ];
}
for( i = 0x100000; i < 0x800000; i++ ){
rom[ i ] ^= xor2[ (i % 0x20) ];
}
for( i = 0x100000; i < 0x800000; i += 4 ){
UINT16 *rom16 = (UINT16*)&rom[ i + 1 ];
*rom16 = BITSWAP16( *rom16, 15, 14, 13, 12, 10, 11, 8, 9, 6, 7, 4, 5, 3, 2, 1, 0 );
}
buf = (unsigned char*)malloc( 0x800000 );
memcpy( buf, rom, 0x800000 );
for( i = 0; i < 0x0100000 / 0x10000; i++ ){
ofst = (i & 0xf0) + BITSWAP08( (i & 0x0f), 7, 6, 5, 4, 2, 3, 0, 1 );
memcpy( &rom[ i * 0x10000 ], &buf[ ofst * 0x10000 ], 0x10000 );
}
for( i = 0x100000; i < 0x800000; i += 0x100 ){
ofst = (i & 0xf000ff) +
((i & 0x000f00) ^ 0x00a00) +
(BITSWAP08( ((i & 0x0ff000) >> 12), 4, 5, 6, 7, 1, 0, 3, 2 ) << 12);
memcpy( &rom[ i ], &buf[ ofst ], 0x100 );
}
free( buf );
buf = (unsigned char*)malloc( 0x800000 );
memcpy( buf, rom, 0x800000 );
memcpy( &rom[ 0x100000 ], &buf[ 0x700000 ], 0x100000 );
memcpy( &rom[ 0x200000 ], &buf[ 0x100000 ], 0x600000 );
free( buf );
}
-
Thanks man!!!!!! now we need the read and write handlers for the bankswitch...
See ya!!!!! :D
-
i got the NeoExtractSData code to compile but i still cant get the text data to work properly for svcnd. do i need to add HARDWARE_SNK_ALTERNATE_TEXT and/or set the nTextBankSwitch?
also, will it work for kof2003 8x8 C ROMs?
sorry for asking like a n00b to this but i havent followed this driver scene for a while now :o
-
i got the NeoExtractSData code to compile but i still cant get the text data to work properly for svcnd. do i need to add HARDWARE_SNK_ALTERNATE_TEXT and/or set the nTextBankSwitch?
For svcnd, you need:
HARDWARE_SNK_ALTERNATE_TEXT
nNeoTextROMSize = 0x80000;
and you need to add this code to your nTextBankSwitch stuff (If you have that code added)
srom = NeoTextROM+0x20000;
(int i=0;i srom[i]=BITSWAP08(srom[i]^0xd2,4,0,7,2,5,1,6,3 );
also, will it work for kof2003 8x8 C ROMs?
No. Those roms don't contain S data.
sorry for asking like a n00b to this but i havent followed this driver scene for a while now :o
lol, it's ok man :) Everybody gets behind sometimes ;)
-
okay thanks :)
i have the nTextBankSwitch code but where can i put in that piece of code in the following code?:
if (nTextBankswitch == 1) {
unsigned char* dst = (unsigned char*)malloc(0x20000);
unsigned char* roms1 = NeoTextROM+0x20000;
if ( dst )
{
memcpy(dst,roms1,0x20000);
for ( int j=0;j<0x20000 ; j+=0x000010)
{
memcpy( roms1+j, dst+j+0x000008,8);
memcpy( roms1+j+0x000008, dst+j,8);
}
}
free( dst );
}
if (nTextBankswitch == 2) {
unsigned char* srom = NeoTextROM+0x20000;
unsigned char* dst2 = (unsigned char*)malloc(0x80000);
memcpy( dst2+0x00000, srom+0x60000, 0x20000 );
memcpy( dst2+0x20000, srom+0x40000, 0x20000 );
memcpy( dst2+0x40000, srom+0x20000, 0x20000 );
memcpy( dst2+0x60000, srom+0x00000, 0x20000 );
memcpy( srom, dst2, 0x80000 );
free(dst2);
}
or do i have the nTextBankswitch code outdated?
-
oh, and I forgot to say make sure you have
#include "bitswap.h" in the top of neo_run.cpp
if (nTextBankswitch == 4) {
unsigned char* srom = NeoTextROM+0x20000;
(int i=0;i srom=BITSWAP08(srom^0xd2,4,0,7,2,5,1,6,3 );
}
-
crap, not again :(
src/burn/neogeo/neo_run.cpp: In function `int LoadRoms(NeoGameInfo*)':
src/burn/neogeo/neo_run.cpp:460: parse error before `=' token
src/burn/neogeo/neo_run.cpp:459: warning: unused variable `unsigned char*srom'
src/burn/neogeo/neo_run.cpp:553: warning: ISO C++ forbids variable-size array `
buffer'
C:\MINGW\BIN\MAKE.EXE: *** [neo_run.o] Error 1
-
sorry about that.
Try this one:
if (nTextBankswitch == 4) {
unsigned char *srom = NeoTextROM+0x20000;
(int i=0;isrom[i]=BITSWAP08(srom[i]^0xd2,4,0,7,2,5,1,6,3 );
}
-
hmmm..same error still happens :\
-
lmao!
I left out "for"
if (nTextBankswitch == 4) {
unsigned char *srom = NeoTextROM+0x20000;
for (int i=0;i srom[i]=BITSWAP08(srom[i]^0xd2,4,0,7,2,5,1,6,3 );
}
btw, you should update your stuff so that it is nNeoTextROMFixType instead of nTextBankswitch
-
thank you, at least i can somewhat follow now :D is the name all thats changed?
-
IQ, little question......
is the P1 8Mb AB053D97 supposed to work without any special initialisation or not ???
I tried it some days ago, it boots, then reboots, and reboots.....if I press Start > Black screen, music plays.....
This one is supposed to be Svcnd P1, is there some kind of protection (like on the bootleg) that doesn't allow it to work ?
What a mess with all these files/patches/hacks/redump, it gives me a big headache :(
if P1 8Mb AB053D97 is not the good one, what's the good CRC value (fully decrypted without any protection and without any bugs or missing moves) ?
-
the above code for p1 is just for the NeoPVC protection. bankswitching/ read/write handlers and stuff arent included for now.
-
oki doki.......
so this "decrypted P1 for svcnd" is not really decrypted :rolleyes:
I'm lost :D , need a "Universal fully decrypted without bugs non bootleg P1" :cool:
-
An attempt to translate the bankswitch code... this doesn't work but if anyone knows how to improve it...
static unsigned short mv0_prot_offset[0x08];
static unsigned short mv0_bankswitch_offset[2];
static int mv0_bankswitch_flg;
unsigned char __fastcall mv0ReadByteProtection(unsigned int sekAddress)
{
return *(((unsigned char *)mv0_prot_offset)+((sekAddress^1)-0x2fffe0));
}
unsigned short __fastcall mv0ReadWordProtection(unsigned int sekAddress)
{
return mv0_prot_offset[(sekAddress-0x2fffe0)/2];
}
static void mv0_protWriteBankSwitch(unsigned int sekAddress,unsigned short wordValue,unsigned short valueMask)
{
int address=(sekAddress-0x2fffe0)/2;
mv0_prot_offset[address]=(wordValue&valueMask)|(~valueMask&mv0_prot_offset[address]);
if (address == 0) {
UINT8 *ofst8 = (UINT8*)mv0_prot_offset;
ofst8[0x02]=((ofst8[0x01]>>4)&0x01)+((ofst8[0x00]&0x0f)<<1);
ofst8[0x03]=((ofst8[0x01]>>5)&0x01)+(((ofst8[0x00]>>4)&0x0f)<<1);
ofst8[0x04]=((ofst8[0x01]>>6)&0x01)+((ofst8[0x01]&0x0f)<<1);
ofst8[0x05]=(ofst8[0x01]>>7);
} else if (address == 5) {
UINT8 *ofst8 = (UINT8*)mv0_prot_offset;
ofst8[0x0c]=(ofst8[0x08]>>1)|((ofst8[ 0x09 ] >> 1) << 4);
ofst8[0x0d]=(ofst8[0x0a]>>1)|((ofst8[ 0x08 ] & 0x01) << 4)|
((ofst8[ 0x09 ] & 0x01) << 5)|
((ofst8[ 0x0a ] & 0x01) << 6)|
(ofst8[ 0x0b ] << 7);
}
}
void __fastcall mv0WriteWordProtection(unsigned int sekAddress, unsigned short wordValue)
{
unsigned short valueMask=0xffef;
mv0_protWriteBankSwitch(sekAddress,wordValue,valueMask);
}
void __fastcall mv0WriteByteProtection(unsigned int sekAddress, unsigned char byteValue)
{
unsigned short wordValue=0,valueMask=0xef;
if(!(sekAddress&1)) {
wordValue=byteValue<<8;
valueMask<<=8;
} else {
wordValue=byteValue;
}
mv0_protWriteBankSwitch(sekAddress,wordValue,valueMask);
}
static void mv0_ProtMapHandler()
{
// Install BankSwitch handler
SekMapHandler(5, 0x2fffe0, 0x2fffef, SM_READ);
SekSetReadWordHandler(5, mv0ReadWordProtection);
SekSetReadByteHandler(5, mv0ReadByteProtection);
SekMapHandler(5, 0x2fffe0, 0x2fffef, SM_WRITE);
SekSetWriteWordHandler(5, mv0WriteWordProtection);
SekSetWriteByteHandler(5, mv0WriteByteProtection);
}
// ========================================================================
unsigned char __fastcall mv0ReadByteBankswitch(unsigned int sekAddress)
{
return *(((unsigned char*)mv0_bankswitch_offset)+((sekAddress^1)-0x2ffff0));
}
unsigned short __fastcall mv0ReadWordBankswitch(unsigned int sekAddress)
{
if( mv0_bankswitch_offset[0] == 0xffff && mv0_bankswitch_offset[1] == 0xffff ) {
mv0_bankswitch_flg = 1;
if (sekAddress == 0) {
return 0xfea0;
} else if (sekAddress == 1) {
return 0x7fff;
} else {
return mv0_bankswitch_offset[(sekAddress-0x2fffe0)/2];
}
} else if (mv0_bankswitch_offset[0] == 0x0000 && mv0_bankswitch_offset[1] == 0x0000 && mv0_bankswitch_flg == 1) {
if(sekAddress == 0) {
return 0x00a0;
} else if (sekAddress == 1) {
mv0_bankswitch_flg = 0;
return 0x0000;
} else {
return mv0_bankswitch_offset[(sekAddress-0x2fffe0)/2];
}
} else {
return mv0_bankswitch_offset[(sekAddress-0x2fffe0)/2];
}
}
static void mv0WriteBankSwitch(unsigned int sekAddress,unsigned short wordValue,unsigned short valueMask)
{
int address=(sekAddress-0x2ffff0)/2,bankaddress;
mv0_bankswitch_offset[address]=(wordValue&valueMask)|(~valueMask&mv0_bankswitch_offset[ address ]);
bankaddress = (mv0_bankswitch_offset[0]>>8)+(mv0_bankswitch_offset[1]<<8)+0x100000;
SekMapMemory(Neo68KROM02+bankaddress,0x200000,0x2fdfff,SM_ROM);
}
void __fastcall mv0WriteWordBankSwitch(unsigned int sekAddress, unsigned short wordValue)
{
unsigned short valueMask=0xfff3;
mv0WriteBankSwitch(sekAddress,wordValue,valueMask);
}
void __fastcall mv0WriteByteBankSwitch(unsigned int sekAddress, unsigned char byteValue)
{
unsigned short wordValue=0,valueMask=0xf3;
if(!(sekAddress&1)) {
wordValue=byteValue<<8;
valueMask<<=8;
} else {
wordValue=byteValue;
}
mv0WriteBankSwitch(sekAddress,wordValue,valueMask);
}
static void mv0_BankMapHandler()
{
// Install BankSwitch handler
SekMapHandler(5, 0x2ffff0, 0x2ffff3, SM_READ);
SekSetReadWordHandler(5, mv0ReadWordBankswitch);
SekSetReadByteHandler(5, mv0ReadByteBankswitch);
SekMapHandler(5, 0x2ffff0, 0x2ffff3, SM_WRITE);
SekSetWriteWordHandler(5, mv0WriteWordBankSwitch);
SekSetWriteByteHandler(5, mv0WriteByteBankSwitch);
}
// --------------
static int svcchaosInit()
{
int nRet;
pNeoInitCallback = svcchaos_PVC_Protection;
nNeoProtectionXor = 0x57;
nNeoTextROMSize = 0x080000;
nNeoTextROMFixType = 6;
nRet = NeoInit();
if (!nRet) {
mv0_ProtMapHandler();
mv0_BankMapHandler();
}
return NeoInit();
}
static int svchaosaInit()
{
int nRet;
pNeoInitCallback = svchaosa_PVC_Protection;
nNeoProtectionXor = 0x57;
nNeoTextROMSize = 0x080000;
nRet = NeoInit();
if (!nRet) {
mv0_ProtMapHandler();
mv0_BankMapHandler();
}
return NeoInit();
}
See ya!!!! :D
-
Thanks ferchogtx, lets work on this thing :D
Here is the code to decrypt svcboot p1:
//FBA Conversion by JiMMy_PaGe (www.neofighters.com.br) original code by Harin
static void svcboot_px_decrypt()
{
int sec[] = {0x06, 0x07, 0x01, 0x02, 0x03, 0x04, 0x05, 0x00};
unsigned char *src = Neo68KROM01;
int i,ofst,size = 0x800000;
unsigned char *dst = (unsigned char*)malloc(size);
for( i = 0; i < size / 0x100000; i++ ){
memcpy( &dst[ i * 0x100000 ], &src[ sec[ i ] * 0x100000 ], 0x100000 );
}
for( i = 0; i < size / 2; i++ ){
ofst = BITSWAP08( (i & 0x0000ff), 7, 6, 1, 0, 3, 2, 5, 4 );
ofst += (i & 0xffff00);
memcpy( &src[ i * 2 ], &dst[ ofst * 2 ], 0x02 );
}
free( dst );
}
U have to use kof2003 bankswtich too
See ya
-
You mean kof2003b (bootleg) bankswitch right? :confused:
See ya!!!! :D
-
You mean kof2003b (bootleg) bankswitch right? :confused:
See ya!!!! :D
Yeah thats right :p
Im thinking about something:
if svcboot uses mv0_bankswitch and it runs using kof2003b bankswitch
mv0_bankswitch = kof2003b bankswitch
So we just have to convert mv0_prot and that MWA16_RAM to run svcnd, svchaosa and kof2003 ( we have to fix that bios problem too)
See ya :D
-
IQ, little question......
is the P1 8Mb AB053D97 supposed to work without any special initialisation or not ???
I tried it some days ago, it boots, then reboots, and reboots.....if I press Start > Black screen, music plays.....
This one is supposed to be Svcnd P1, is there some kind of protection (like on the bootleg) that doesn't allow it to work ?
What a mess with all these files/patches/hacks/redump, it gives me a big headache :(
if P1 8Mb AB053D97 is not the good one, what's the good CRC value (fully decrypted without any protection and without any bugs or missing moves) ?
Again with a new stupid question :D
I tried some combinaisons between P1 AB053D97 and P1 93855C0B, and when I replace the first 1Mo of AB053D97 with the one from 93855C0B, the game boots fine and works without any problem.......
Here is my question : Only the first chunk (first 1Mo) of the P1 is protected ?????? By comparing the 2 files, there isn't a lot of diff' (SNK Giga power logo added for example).
Is there some kind of protection like on svcplus (1 bit that prevents the game to work) as the P1 AB053D97 boots fine the reboots ?
-
Here's the code for decrypting svcboot's C roms (I'm sure everyone would rather use this than that closed source lib file ;))
// Original MAME code by HalRIN - http://www52.tok2.com/home/foge/
static void svcboot_cx_decrypt()
{
const unsigned char sec[ 0x10 ] = {
0, 1, 0, 1, 2, 3, 2, 3, 3, 4, 3, 4, 4, 5, 4, 5,
};
const unsigned char swap[ 6 ][ 4 ] = {
{ 3, 0, 1, 2 },
{ 2, 3, 0, 1 },
{ 1, 2, 3, 0 },
{ 0, 1, 2, 3 },
{ 3, 2, 1, 0 },
{ 3, 0, 2, 1 },
};
int i;
int fsize = 0x4000000;
UINT8 *src = NeoSpriteROM;
UINT8 *dst = (UINT8*)malloc( fsize );
int ofst;
memcpy( dst, src, fsize );
for( i = 0; i < fsize / 0x80; i++ ){
int tbl = sec[ (i & 0xf00) >> 8 ];
int bit0 = swap[ tbl ][ 0 ];
int bit1 = swap[ tbl ][ 1 ];
int bit2 = swap[ tbl ][ 2 ];
int bit3 = swap[ tbl ][ 3 ];
ofst = BITSWAP08( (i & 0x0000ff), 7, 6, 5, 4, bit3, bit2, bit1, bit0 );
ofst += (i & 0xfffff00);
memcpy( &src[ i * 0x80 ], &dst[ ofst * 0x80 ], 0x80 );
}
free( dst );
}
-
Here's my source to get svcchaos working in FBA :)
This uses the correct(?) PCB roms (32mb P & Cs)
Adding this code is Fairly complicated, so if it doesn't work correctly the first time, try it again maybe you'll get better results ;)
-
I tried kof2003b on the mv0_bankswitch on Mame The game loads ok but resets when you try and play the game So I reused the old koof2003b bankswitch.
-
can someone please post a complete driver for svcboot? i have my own driver and got it to compile but one of the void itself seems to require too much RAM (as the loading takes eternity after the m1). also, im not too sure if i did put it in the right place (i put the svcboot_cx_decrypt on d_neogeo.cpp)
-
Here's my source to get svcchaos working in FBA :)
This uses the correct(?) PCB roms (32mb P & Cs)
Adding this code is Fairly complicated, so if it doesn't work correctly the first time, try it again maybe you'll get better results ;)
useing your driver.
I have tried many times with this and keeps comming up with this error
And I allready been useing kof2003b init (bankswitch) for kof2003b
src/burn/neogeo/d_neogeo.cpp: In function `int svcchaosInit()':
src/burn/neogeo/d_neogeo.cpp:5513: `kof2003b_tbl' undeclared (first use this function)
src/burn/neogeo/d_neogeo.cpp:5513: (Each undeclared identifier is reported only once for each function it appears in.)
src/burn/neogeo/d_neogeo.cpp:5517: `kof2003bMapHandler' undeclared (first use this function)
src/burn/neogeo/d_neogeo.cpp: At global scope:
src/burn/neogeo/d_neogeo.cpp:6850: `short unsigned int kof2003b_tbl[4096]' used prior to declaration
src/burn/neogeo/d_neogeo.cpp: In function `void kof2003bMapHandler()':
src/burn/neogeo/d_neogeo.cpp:6914: `void kof2003bMapHandler()' used prior to declaration
make: *** [d_neogeo.o] Error 1
-
Again with a new stupid question :D
I tried some combinaisons between P1 AB053D97 and P1 93855C0B, and when I replace the first 1Mo of AB053D97 with the one from 93855C0B, the game boots fine and works without any problem.......
Here is my question : Only the first chunk (first 1Mo) of the P1 is protected ?????? By comparing the 2 files, there isn't a lot of diff' (SNK Giga power logo added for example).
Is there some kind of protection like on svcplus (1 bit that prevents the game to work) as the P1 AB053D97 boots fine the reboots ?
Not quite, the game sems to have 2 bankswitches..., the one for kof2003b (that seems to be almost universal) and the other one that seems to be the protection itself... I'm not sure of this but the fact is that svcchaos and kof2003 have 2 bankswitchs instead of only one, so when you replace the first MB of data the whole protections were removed, the problem is that in that chunk (of the decrypted and fixed p1 you're truing to use) there are a lot of bugs that aren't present in the original p1, the only problem is that we need the second bankswitch in order to get working the last not working game in fba (kof2003 and kof2k3nd)...
Thats the point...
See ya!!!!!! :D
-
can someone please post a complete driver for svcboot? i have my own driver and got it to compile but one of the void itself seems to require too much RAM (as the loading takes eternity after the m1). also, im not too sure if i did put it in the right place (i put the svcboot_cx_decrypt on d_neogeo.cpp)
Try this version of the svcboot_cx_decrypt code.
It should require less ram than the old one, but it may take a little longer for it to decrypt.
btw. Yes, I have my code in d_neogeo.cpp
static void svcboot_cx_decrypt()
{
int i,j;
int fsize = 0x100000;
for (j = 0; j < 0x4000000; j=j+fsize)
{
int ofst;
UINT8 *src = NeoSpriteROM + j;
UINT8 *dst = (UINT8*)malloc( fsize );
const unsigned char sec[ 0x10 ] = {
0, 1, 0, 1, 2, 3, 2, 3, 3, 4, 3, 4, 4, 5, 4, 5,
};
const unsigned char swap[ 6 ][ 4 ] = {
{ 3, 0, 1, 2 },
{ 2, 3, 0, 1 },
{ 1, 2, 3, 0 },
{ 0, 1, 2, 3 },
{ 3, 2, 1, 0 },
{ 3, 0, 2, 1 },
};
memcpy( dst, src, fsize );
for( i = 0; i < fsize / 0x80; i++ ){
int tbl = sec[ (i & 0xf00) >> 8 ];
int bit0 = swap[ tbl ][ 0 ];
int bit1 = swap[ tbl ][ 1 ];
int bit2 = swap[ tbl ][ 2 ];
int bit3 = swap[ tbl ][ 3 ];
ofst = BITSWAP08( (i & 0x0000ff), 7, 6, 5, 4, bit3, bit2, bit1, bit0 );
ofst += (i & 0xfffff00);
memcpy( &src[ i * 0x80 ], &dst[ ofst * 0x80 ], 0x80 );
}
free( dst );
}
}
-
Not quite, the game sems to have 2 bankswitches..., the one for kof2003b (that seems to be almost universal) and the other one that seems to be the protection itself... I'm not sure of this but the fact is that svcchaos and kof2003 have 2 bankswitchs instead of only one, so when you replace the first MB of data the whole protections were removed, the problem is that in that chunk (of the decrypted and fixed p1 you're truing to use) there are a lot of bugs that aren't present in the original p1, the only problem is that we need the second bankswitch in order to get working the last not working game in fba (kof2003 and kof2k3nd)...
Thats the point...
See ya!!!!!! :D
thx for the info ^^
So i'll wait for a clean really decrypted non bootleg P.....
-
I think the decrypted P will turn out to be allready released Since the bootleg P roms came from the original set anyway
-
thanks iq, now, not to be a request b*tch but do you think something can be done on svcchaos/svcnd P1 to load quicker? i mean, the last time i tried svcnd on kdev it took a little more time to load the P1 but after that short while everything went nicely. overall, its still a lot quicker than with the current code now.
also, i made a CRC check with Uni-BIOS and it seems were getting closer now, everything else is correct except for the ROM Region.
-
What rom set did you check with the UNI BIOS ? I checked svchaosa and svcchaos and is 100% ok with version 2.0.
-
svcnd, havent gotten around to encrypt the C ROMs :P
and btw, iq, the new svcboot c decrypt code didnt work :(
-
It looks like that because of your S rom. The correct one for svcboot is scrambled.
-
i have already set the NeoTextROMFixType to 2 though (value according to Ferchogtx). is the CRC of the S1 supposed to be the same as the one KDev uses (thats what im using), another S1 needed, or have i used the wrong ROMFixType value?
-
I'm using this S1:
{"svc-s1.bin", 0x020000, 0x70b44df1, 1}, // 1 Text data
and this descrambling code:
/* Descrambling S1 by FerchogtX, based on DorriGa's code */
unsigned char* srom = NeoTextROM+0x20000;
unsigned char* dst = (unsigned char*)malloc(0x20000);
memcpy( dst+0x00000, srom+0x10000, 0x10000 );
memcpy( dst+0x10000, srom+0x00000, 0x10000 );
memcpy( srom, dst, 0x20000 );
free(dst);
-
weird, im using those exactly as well :|
-
Chek in you init of flags that you don't have anything that enables some configs for texts... i mean:
-HARDWARE_SNK_ALTERNATE_TEXT
-nNeoTextROMSize
If you have any of them in your driver, delete them
See ya!!!! :D
P.D. Also check the case number (init value) maybe you've mistaken the number, check against the whole code in neo_run.cpp, it seems that you are using svcsplus value instead of svcboot one...
-
im fairly sure i dont have those and have matched the descrambling code iq used. i guess ill just try other values :\
-
ok, i just tried using the svcchaos drivers iq_132 posted on page 5 and done everything need but when compiling i get an error dealing with kof2003bMapHandlder:
src/burn/neogeo/d_neogeo.cpp: In function `int svcchaosInit()':
src/burn/neogeo/d_neogeo.cpp:8729: `kof2003b_tbl' undeclared (first use this
function)
src/burn/neogeo/d_neogeo.cpp:8729: (Each undeclared identifier is reported only
once for each function it appears in.)
src/burn/neogeo/d_neogeo.cpp:8733: `kof2003bMapHandler' undeclared (first use
this function)
src/burn/neogeo/d_neogeo.cpp: At global scope:
src/burn/neogeo/d_neogeo.cpp:9093: `short unsigned int kof2003b_tbl[4096]' used
prior to declaration
src/burn/neogeo/d_neogeo.cpp: In function `void kof2003bMapHandler()':
src/burn/neogeo/d_neogeo.cpp:9147: `void kof2003bMapHandler()' used prior to
declaration
make: *** [d_neogeo.o] Error 1
i used the same kof2003b driver that the txt file refer to which is located here: http://neosource.1emu.net/pages/games/fba/kof2003b.htm
and i did name all occurances of kof2003 to kof2003b so i'm lost on what exactly is wrong :confused:
-
you need change the references name of the Kof2003 to kof2003b
for example
this is the original code
static struct BurnRomInfo kof2003RomDesc[] = {
static struct BurnRomInfo kof2003bRomDesc[] =
this is the change do you need in your driver
-
and i did name all occurances of kof2003 to kof2003b so i'm lost on what exactly is wrong :confused:
you missed that part of my last post :p
also you can see in my qoute that error was for kof2003bMapHandler
Update: i found the problem with that error as i had the kof2003b driver after svcchaos thx to james help :) but now it seems i have a bigger prob as all i get from trying svcchaos set is this:(http://img114.exs.cx/img114/3191/l3tsvcchaos110706495.th.png) (http://img114.exs.cx/my.php?loc=img114&image=l3tsvcchaos110706495.png)
i thought i might add my neogeo files for fba, i haven't really touched fba since samsho5 based on the dev emu was playable so if you can plz fix mine or post updated files thank you
-
did anyone have any luck finding out what might cause this? i tried another source but it too was only updated around samsho5 based on dev and got the same result after adding what was needed :(
-
did anyone have any luck finding out what might cause this? i tried another source but it too was only updated around samsho5 based on dev and got the same result after adding what was needed :(
Have you look at this website? http://neosource.1emu.net/
I don't have the roms to try yet.
I will find those soon anyway.
-
well odd enough when i clicked on games and then on svcchaos it said it wasn't availible :confused:
none the less the info is posted here and thats what i used but i'm getting no such luck with it.
Update: i got it working as i notice a missing part from the textrom fix code :D
-
ok, decided to stick with the old fba src for online gaming and i was trying out all the svc drivers but svchaosa for some reason gives me static sound :confused:
heres the driver i used:
// SvC Chaos: SNK vs Capcom (MVS Cart)
static struct BurnRomInfo svchaosaRomDesc[] = {
{"269-p1a.bin", 0x400000, 0x38e2005e, 0x10}, // 0 68K code (interleaved)
{"269-p2a.bin", 0x400000, 0x6d13797c, 0x10}, // 1 (interleaved)
{"269-c1r.bin", 0x800000, 0x887b4068, 1}, // 2 Sprite data
{"269-c2r.bin", 0x800000, 0x4e8903e4, 1}, // 3
{"269-c3r.bin", 0x800000, 0x7d9c55b0, 1}, // 4
{"269-c4r.bin", 0x800000, 0x8acb5bb6, 1}, // 5
{"269-c5r.bin", 0x800000, 0x097a4157, 1}, // 6
{"269-c6r.bin", 0x800000, 0xe19df344, 1}, // 7
{"269-c7r.bin", 0x800000, 0xd8f0340b, 1}, // 8
{"269-c8r.bin", 0x800000, 0x2570b71b, 1}, // 9
{"269-m1d.bin", 0x020000, 0xfd4f0ff9, 0x10}, // 10 Z80 code
{"269-m1.bin", 0x080000, 0xf6819d00, 0x10}, // 11 (encrypted)
/* This uses Neo-PCM2 PLAYMORE(c) 2002 Chip */
{"269-v1.bin", 0x800000, 0xc659b34c, 2}, // 12 Sound data
{"269-v2.bin", 0x800000, 0xdd903835, 2}, // 13
};
STDROMPICKEXT(svchaosa, svchaosa, neogeo);
STD_ROM_FN(svchaosa);
static void svchaosaPVCDecrypt()
{
interleave_pdata();
svcchaosPVCDecrypt();
}
static int svchaosaInit()
{
int nRet;
memset(CartRAM,0,0x2000);
pNeoInitCallback = svchaosaPVCDecrypt;
nNeoProtectionXor = 0x57;
nNeoTextROMSize = 0x080000;
nNeoPCM2PLAYMOREByteswap = 4;
nRet = NeoInit();
if (!nRet)
mv0_BankMapHandler();
return nRet;
}
struct BurnDriver BurnDrvsvchaosa = {
{"svchaosa", "SvC Chaos: SNK vs Capcom (set 2)", "MVS version", "Playmore / Capcom", "Neo Geo", "2003", "svcchaos", "neogeo"},
BDF_GAME_WORKING | BDF_CLONE, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ALTERNATE_TEXT | HARDWARE_SNK_ENCRYPTED_B | HARDWARE_SNK_NEWBANKSYSTEM,
NULL, svchaosaRomInfo, svchaosaRomName, neogeoInputInfo, neogeoDIPInfo,
svchaosaInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
-
Can somebody please tell me which code is required to get sound from the svcboot V ROMs? Thankies ^_^
-
Can somebody please tell me which code is required to get sound from the svcboot V ROMs? Thankies ^_^
http://neo-source.com/index.php?topic=314.0
-
Anyone has a COMPLETE driver (with the C-roms code) for the lastest fba version)
-
Thankies alot netbug! ^_^
-
Well, some svcboot/cthd2003 C decryption code has been released.
Here's my version of that code (a bit trimmed)
static void DoPerm(int game)
{
unsigned char *src = NeoSpriteROM;
unsigned char *dst = (unsigned char*)malloc(0x800);
for(int i=0; i<0x8000; i++)
{
unsigned int tbl[8][16] =
{
{1,2,3,0,0,4,4,5,1,2,3,0,0,4,4,5}, // cthd2003
{1,2,1,2,3,0,3,0,0,4,0,4,4,5,4,5}, // svcboot
{0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15},
{0,2,4,6,8,10,12,14,1,3,5,7,9,11,13,15},
{0,4,8,12,1,5,9,13,2,6,10,14,3,7,11,15},
{0,8,1,9,2,10,3,11,4,12,5,13,6,14,7,15},
{0,8,4,12,2,10,6,14,1,9,5,13,3,11,7,15},
{0,2,8,10,4,6,12,14,1,3,9,11,5,7,13,15},
};
int ofst=tbl[0][(i>>5)&0xF];
if (game==1) ofst=tbl[1][(i>>4)&0xF];
for(int j=0; j<16; j++)
{
memcpy(dst+j*128, src+i*0x800+(tbl[ofst+2][j]*128), 128);
}
memcpy(src+i*0x800, dst, 0x800);
}
free(dst);
}
-
Well done. IQ,this code is very short.^_^
-
Oopsie! I left a piece of code in there that isn't needed.
Check my post above for a fixed version.
-
Oopsie! I left a piece of code in there that isn't needed.
Check my post above for a fixed version.
OK, we can remove all svcboot_cx_decrypt and cthd2003_c now,^_^.
This is my useing code,can keep cthd2003,svcboot,matrimbl working.^_^
neogeo.h
// d_neogeo.cpp
extern void DoPerm(int game); // for cthd2003 & svcboot C-ROMs
neo_run.cpp
// Descramble C roms without messing out the text layers (matrimbl only)
if (!strcmp(BurnDrvGetTextA(DRV_NAME), "matrimbl")) {
DoPerm(0);
}
d_neogeo.cpp
void DoPerm(int game)
{
int i, j, ofst, size = 0x800;
unsigned char *src = NeoSpriteROM;
unsigned char *dst = (unsigned char*)malloc(size);
for (i=0; i<0x8000; i++){
unsigned int tbl[8][16] = {
{1,2,3,0,0,4,4,5,1,2,3,0,0,4,4,5}, // cthd2003
{1,2,1,2,3,0,3,0,0,4,0,4,4,5,4,5}, // svcboot
{0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15},
{0,2,4,6,8,10,12,14,1,3,5,7,9,11,13,15},
{0,4,8,12,1,5,9,13,2,6,10,14,3,7,11,15},
{0,8,1,9,2,10,3,11,4,12,5,13,6,14,7,15},
{0,8,4,12,2,10,6,14,1,9,5,13,3,11,7,15},
{0,2,8,10,4,6,12,14,1,3,9,11,5,7,13,15},
};
ofst=tbl[0][(i>>5)&0xF];
if (game==1) ofst=tbl[1][(i>>4)&0xF];
for (j=0; j<16; j++){
memcpy(dst+j*128, src+i*0x800+(tbl[ofst+2][j]*128), 128);
}
memcpy(src+i*0x800, dst, size);
}
free(dst);
}
-
Hey bms! Check my original post for a better version of that code.
It only needs 2kb more instead of 64mb :)
-
Hey bms! Check my original post for a better version of that code.
It only needs 2kb more instead of 64mb :)
Oh,yeah. I,ve tested.^_^
-
Wow! looks great, i'll test it inmeditely
Thanks a lot IQ (for both driver and you know ;) )
See ya!!!!!! :D
-
Here's the extra C decryption code for SVC. but with a small modification:
- I've managed to make it so that this code only takes 8MB of ram instead of
the 64 MB it use to take. Enjoy ;)
// Original MAME by HalRIN - http://www52.tok2.com/home/foge/
// Ported to FBA and modified by IQ_132 - http://neosource.1emu.net/
// SvC Chaos: SNK vs CAPCOM C-ROM decryption (Version 2, Low RAM)
void svcchaos_cx_decrypt(unsigned char* src)
{
int i, j, ofst;
const unsigned char xor1[ 4 ] = {0x34, 0x21, 0xc4, 0xe9,};
unsigned char *pTemp = (unsigned char*)malloc( 0x800000 );
for (i = 0; i < 8; i++)
{
unsigned char *rom = src+i*0x800000;
for( j = 0; j < 0x800000; j++ ) {
rom[ j ] ^= xor1[ (j % 4) ];
}
for( j = 0; j < 0x800000; j += 4 ) {
UINT32 *rom32 = (UINT32*)&rom[ j ];
*rom32 = BITSWAP32( *rom32, 0x09, 0x0d, 0x13, 0x00, 0x17, 0x0f, 0x03, 0x05,
0x04, 0x0c, 0x11, 0x1e, 0x12, 0x15, 0x0b, 0x06,
0x1b, 0x0a, 0x1a, 0x1c, 0x14, 0x02, 0x0e, 0x1d,
0x18, 0x08, 0x01, 0x10, 0x19, 0x1f, 0x07, 0x16 );
}
memcpy( pTemp, rom, 0x800000 );
for( j = 0; j < 0x800000 / 4; j++ ) {
ofst = BITSWAP24( (j & 0x1fffff), 0x17, 0x16, 0x15, 0x04, 0x0b, 0x0e, 0x08, 0x0c,
0x10, 0x00, 0x0a, 0x13, 0x03, 0x06, 0x02, 0x07,
0x0d, 0x01, 0x11, 0x09, 0x14, 0x0f, 0x12, 0x05 );
ofst ^= 0x0c8923;
ofst += (j & 0xffe00000);
memcpy( &rom[ j * 4 ], &pTemp[ ofst * 4 ], 0x04 );
}
}
free( pTemp );
}
-
Here's the extra C decryption code for SVC. but with a small modification:
- I've managed to make it so that this code only takes 8MB of ram instead of
the 64 MB it use to take. Enjoy ;)
// Original MAME by HalRIN - http://www52.tok2.com/home/foge/
// Ported to FBA and modified by IQ_132 - http://neosource.1emu.net/
// SvC Chaos: SNK vs CAPCOM C-ROM decryption (Version 2, Low RAM)
void svcchaos_cx_decrypt(unsigned char* src)
{
int i, j, ofst;
const unsigned char xor1[ 4 ] = {0x34, 0x21, 0xc4, 0xe9,};
unsigned char *pTemp = (unsigned char*)malloc( 0x800000 );
for (i = 0; i < 8; i++)
{
unsigned char *rom = src+i*0x800000;
for( j = 0; j < 0x800000; j++ ) {
rom[ j ] ^= xor1[ (j % 4) ];
}
for( j = 0; j < 0x800000; j += 4 ) {
UINT32 *rom32 = (UINT32*)&rom[ j ];
*rom32 = BITSWAP32( *rom32, 0x09, 0x0d, 0x13, 0x00, 0x17, 0x0f, 0x03, 0x05,
0x04, 0x0c, 0x11, 0x1e, 0x12, 0x15, 0x0b, 0x06,
0x1b, 0x0a, 0x1a, 0x1c, 0x14, 0x02, 0x0e, 0x1d,
0x18, 0x08, 0x01, 0x10, 0x19, 0x1f, 0x07, 0x16 );
}
memcpy( pTemp, rom, 0x800000 );
for( j = 0; j < 0x800000 / 4; j++ ) {
ofst = BITSWAP24( (j & 0x1fffff), 0x17, 0x16, 0x15, 0x04, 0x0b, 0x0e, 0x08, 0x0c,
0x10, 0x00, 0x0a, 0x13, 0x03, 0x06, 0x02, 0x07,
0x0d, 0x01, 0x11, 0x09, 0x14, 0x0f, 0x12, 0x05 );
ofst ^= 0x0c8923;
ofst += (j & 0xffe00000);
memcpy( &rom[ j * 4 ], &pTemp[ ofst * 4 ], 0x04 );
}
}
free( pTemp );
}
Hey!! thanks a lot :)
See ya!!!!! :biggrin:
-
sorry for the evil bump, but is there a patch to change 269-m1d (fd602218) to 269-m1d (d193b4fa)?
-
I've modified halrin's svcboot cx code a little, it's now low-ram (only 0x800 bytes [2kb] of ram is needed for decryption),
and the code is very short. Also, it will work for cthd2003, matrimbl, and svcboot
DoPerm(0); // cthd2003, matrimbl
DoPerm(1); // svcboot
void DoPerm(int g) // 0 - cthd2003, 1 - svcboot
{
unsigned int idx[2][ 0x10 ] = {
{0,1,2,3,3,4,4,5,0,1,2,3,3,4,4,5}, // cthd2003
{0,1,0,1,2,3,2,3,3,4,3,4,4,5,4,5}, // svcboot
};
unsigned int tbl[ 6 ][ 4 ] = {
{ 3, 0, 1, 2 },
{ 2, 3, 0, 1 },
{ 1, 2, 3, 0 },
{ 0, 1, 2, 3 },
{ 3, 2, 1, 0 },
{ 3, 0, 2, 1 },
};
unsigned char dst[0x800];
for(int i = 0; i < 0x8000; i++)
{
for(int j = 0; j < 16; j++)
{
unsigned int *b = tbl[ idx[g][(i>>(5-g))&0xF] ];
int ofst = BITSWAP08(j, 7, 6, 5, 4, b[3], b[2], b[1], b[0] );
memcpy( dst + j * 0x80, NeoSpriteROM + (i * 0x800) + ofst * 0x80, 0x80 );
}
memcpy (NeoSpriteROM + i * 0x800, dst, 0x800);
}
}
-
hehe I seen an edit in IQ's post . Must of been for matrimbl :)
-
lol, yeah. I had //cthd2003, svcboot before.
-
Just so you know that code works well in Mame :)
-
Svc jumper support (Region change)
firts of all make sure svcpcb IS NOT a clone of neogeo (remove "neogeo" form the strict burndriver)
then add this rom info and dipswitches:
static struct BurnDIPInfo PCB269DIPList[] = {
// Offset
{0x19, 0xF0, 0x00, 0x00, NULL},
// Defaults
{0x00, 0xFF, 0xFF, 0x00, NULL},
{0x01, 0xFF, 0x7F, 0x00, NULL},
// Fake DIPs
{0x02, 0xFF, 0xFF, 0x86, NULL},
{0, 0xFE, 0, 2, "Autofire"},
{0x0D, 0x01, 0x04, 0x00, "Off"},
{0x0D, 0x01, 0x04, 0x04, "On"},
// DIP 1
{0, 0xFE, 0, 2, "Setting mode"},
{0x00, 0x01, 0x01, 0x00, "Off"},
{0x00, 0x01, 0x01, 0x01, "On"},
// 1 or 2 coin slots
{0, 0xFE, 0, 2, "Coin chutes"},
{0x00, 0x02, 0x02, 0x00, "1"},
{0x02, 0x00, 0x3F, 0x06, NULL},
{0x00, 0x02, 0x02, 0x02, "2"},
{0x02, 0x00, 0x3F, 0x06, NULL},
// 2 or 4 coin slots
{0, 0xFE, 0, 2, "Coin chutes"},
{0x00, 0x82, 0x02, 0x00, "2"},
{0x02, 0x00, 0x3F, 0x06, NULL},
{0x00, 0x82, 0x02, 0x02, "4"},
{0x02, 0x00, 0x3F, 0x06, NULL},
{0, 0xFE, 0, 5, "Commmunicaton"},
{0x00, 0x01, 0x38, 0x00, "Disabled"},
{0x00, 0x01, 0x38, 0x08, "Setting 1"},
{0x00, 0x01, 0x38, 0x10, "Setting 2"},
{0x00, 0x01, 0x38, 0x18, "Setting 3"},
{0x00, 0x01, 0x38, 0x20, "Setting 4"},
{0x00, 0x01, 0x38, 0x28, "Setting 5"},
{0x00, 0x01, 0x38, 0x30, "Setting 6"},
{0x00, 0x01, 0x38, 0x38, "Setting 7"},
{0, 0xFE, 0, 2, "Free play"},
{0x00, 0x01, 0x40, 0x00, "Off"},
{0x00, 0x01, 0x40, 0x40, "On"},
{0, 0xFE, 0, 2, "Stop mode"},
{0x00, 0x01, 0x80, 0x00, "Off"},
{0x00, 0x01, 0x80, 0x80, "On"},
// Region
{0, 0xFD, 0, 2, "Region"},
{0x02, 0x02, 0x03, 0x02, "Asia / Europe"},
{0x02, 0x00, 0x30, 0x00, NULL},
{0x02, 0x02, 0x03, 0x03, "Japan"},
{0x02, 0x00, 0x30, 0x00, NULL},
};
STDDIPINFO(PCB269);
static struct BurnRomInfo PCB269RomDesc[] = {
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "269-bios.bin", 0x080000, 0xb4590283, BRF_BIOS },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "sm1.sm1", 0x020000, 0x97Cf998B, BRF_ESS | BRF_PRG | BRF_BIOS }, // 10 Z80 program
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "sfix.sfx", 0x020000, 0x354029FC, BRF_GRA | BRF_BIOS }, // 14 Text layer tiles
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "000-lo.lo", 0x010000, 0xE09E253C, BRF_ESS | BRF_PRG | BRF_BIOS }, // 18 Zoom table
};
STD_ROM_PICK(PCB269);
STD_ROM_FN(PCB269);
// SvC Chaos - SNK vs CAPCOM (PCB board)
static struct BurnRomInfo svcpcbRomDesc[] = {
{ "269-p1.bin", 0x2000000, 0x432CFDFC, 1 | BRF_ESS | BRF_PRG }, // 0 68K code
{ "269-c1.bin", 0x2000000, 0x1B608F9C, 3 | BRF_GRA }, // 1 Sprite data
{ "269-c2.bin", 0x2000000, 0x5A95F294, 3 | BRF_GRA }, // 2
{ "269-m1_decrypted.bin", 0x020000, 0x447b3123, 4 | BRF_ESS | BRF_PRG }, // 3 Z80 code (decrypted)
{ "269-m1.bin", 0x020000, 0x7d337756, 0 | BRF_PRG | BRF_OPT }, // 4 Z80 code
// This uses Neo-PCM2 PLAYMORE(c) 2002 Protection chip
{ "269-v1.bin", 0x800000, 0xC659B34C, 5 | BRF_SND }, // 5 Sound data
{ "269-v2.bin", 0x800000, 0xDD903835, 5 | BRF_SND }, // 6
};
STDROMPICKEXT(svcpcb, svcpcb, PCB269); // note rominfo
STD_ROM_FN(svcpcb);
// Your personal inits should be placed here
struct BurnDriver BurnDrvsvcpcb = {
"svcpcb", NULL, NULL, "2003", // boardrom is NULL because it NOT a neogeo cart
"SvC Chaos - SNK vs CAPCOM (JAMMA PCB)\0", "PCB Custom board / Asia / Japan", "Capcom / Playmore Corporation", "Neo Geo",
NULL, NULL, NULL, NULL,
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B | HARDWARE_SNK_ALTERNATE_TEXT | HARDWARE_SNK_PCB_BIOS,
NULL, svcpcbRomInfo, svcpcbRomName, neogeoInputInfo, PCB269DIPInfo,
svcpcbInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};now in neo run.cpp (get sure befor that your'e loading 269-bios.bin in the place #10 (HEX #0x0A)
add this in int neogeoReset after NeoLoad68KBIOS...
// Does this is tied directly to the harddip or there's a bankswitch somewhere?
if ((BurnDrvGetHardwareCode() & HARDWARE_SNK_CONTROLMASK) == HARDWARE_SNK_PCB_BIOS) {
if (!strcmp(BurnDrvGetTextA(DRV_NAME), "svcpcb") || !strcmp(BurnDrvGetTextA(DRV_NAME), "svcpcbn")) {
int harddip3 = (NeoSystem & 0x03)&1;
switch (NeoSystem & 0x03) {
case 0x02:
case 0x03:
memcpy(Neo68KBIOS, Neo68KBIOS + 0x20000 + harddip3 * 0x20000, 0x20000);
break;
}
}
}and you're done if you already added Cx decryption routines provided by IQ_132
see ya!!!!!! :D
-
Ah, just saw this. Nice work Ferch :)
-
Thanks man!! :D seems that there's not too much movement here... :( where's the people?
See ya!!!!!!! :biggrin:
-
Thanks man!! :D seems that there's not too much movement here... :( where's the people?
See ya!!!!!!! :biggrin:
True. I guess there's not been much to discuss lately. I wish we could come up with new features for the emu too, instead of just new drivers (even though you guys are certainly doing great on that departament). I would like to be able to implement more stuff, like introduce it to emulation of new chips (so that the remaining Cave drivers could be added), and perhaps other cool stuff too, but all I can do is a little something here or there, nothing big. :redface: And even though it's an open-source project, not too many people/programmers seem to be interested in working on it, which is a real shame.
-
burn.h
add after:
#define HARDWARE_SNK_ALTERNATE_TEXT (0x0080) // KOF2000 text layer banks
#define HARDWARE_SNK_SMA_PROTECTION (0x0100) // SMA protection
#define HARDWARE_SNK_CUSTOM_BANKING (0x0200) // Uses custom banking
this:
#define HARDWARE_SNK_PCB_BIOS (0x0400) // Uses PCB BIOS
or else you'll have some comp problems...
edit
fecho, please help me: with this code the game only stays rebooting all the time...
-
Maybe is a problem with the bankswitch you have... I'll post my whole svcpcb source + decrypted C sets, mine works just fine :)
See ya!!!!! :biggrin:
-
Here my complete Driver:
d_neogeo.cpp:
add this after neotrackball BIOS info:
static struct BurnRomInfo PCB269RomDesc[] = {
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "269-bios.bin", 0x080000, 0xb4590283, BRF_BIOS },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "sm1.sm1", 0x020000, 0x97Cf998B, BRF_ESS | BRF_PRG | BRF_BIOS }, // 10 Z80 program
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "sfix.sfx", 0x020000, 0x354029FC, BRF_GRA | BRF_BIOS }, // 14 Text layer tiles
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "", 0, 0, 0 },
{ "000-lo.lo", 0x010000, 0xE09E253C, BRF_ESS | BRF_PRG | BRF_BIOS }, // 18 Zoom table
};
STD_ROM_PICK(PCB269);
STD_ROM_FN(PCB269);now after the neotrackball DIP settings add this:
static struct BurnDIPInfo PCB269DIPList[] = {
// Offset
{0x19, 0xF0, 0x00, 0x00, NULL},
// Defaults
{0x00, 0xFF, 0xFF, 0x00, NULL},
{0x01, 0xFF, 0x7F, 0x00, NULL},
// Fake DIPs
{0x02, 0xFF, 0xFF, 0x86, NULL},
{0, 0xFE, 0, 2, "Autofire"},
{0x0D, 0x01, 0x04, 0x00, "Off"},
{0x0D, 0x01, 0x04, 0x04, "On"},
// DIP 1
{0, 0xFE, 0, 2, "Setting mode"},
{0x00, 0x01, 0x01, 0x00, "Off"},
{0x00, 0x01, 0x01, 0x01, "On"},
// 1 or 2 coin slots
{0, 0xFE, 0, 2, "Coin chutes"},
{0x00, 0x02, 0x02, 0x00, "1"},
{0x02, 0x00, 0x3F, 0x06, NULL},
{0x00, 0x02, 0x02, 0x02, "2"},
{0x02, 0x00, 0x3F, 0x06, NULL},
// 2 or 4 coin slots
{0, 0xFE, 0, 2, "Coin chutes"},
{0x00, 0x82, 0x02, 0x00, "2"},
{0x02, 0x00, 0x3F, 0x06, NULL},
{0x00, 0x82, 0x02, 0x02, "4"},
{0x02, 0x00, 0x3F, 0x06, NULL},
{0, 0xFE, 0, 5, "Commmunicaton"},
{0x00, 0x01, 0x38, 0x00, "Disabled"},
{0x00, 0x01, 0x38, 0x08, "Setting 1"},
{0x00, 0x01, 0x38, 0x10, "Setting 2"},
{0x00, 0x01, 0x38, 0x18, "Setting 3"},
{0x00, 0x01, 0x38, 0x20, "Setting 4"},
{0x00, 0x01, 0x38, 0x28, "Setting 5"},
{0x00, 0x01, 0x38, 0x30, "Setting 6"},
{0x00, 0x01, 0x38, 0x38, "Setting 7"},
{0, 0xFE, 0, 2, "Free play"},
{0x00, 0x01, 0x40, 0x00, "Off"},
{0x00, 0x01, 0x40, 0x40, "On"},
{0, 0xFE, 0, 2, "Stop mode"},
{0x00, 0x01, 0x80, 0x00, "Off"},
{0x00, 0x01, 0x80, 0x80, "On"},
// Region
{0, 0xFD, 0, 2, "Region"},
{0x02, 0x02, 0x03, 0x02, "Asia / Europe"},
{0x02, 0x00, 0x30, 0x00, NULL},
{0x02, 0x02, 0x03, 0x03, "Japan"},
{0x02, 0x00, 0x30, 0x00, NULL},
};now... add this drivers:
// SvC Chaos - SNK vs CAPCOM (PCB board)
static struct BurnRomInfo svcpcbRomDesc[] = {
{ "269-p1.bin", 0x2000000, 0x432CFDFC, 1 | BRF_ESS | BRF_PRG }, // 0 68K code
{ "269-c1.bin", 0x2000000, 0x1B608F9C, 3 | BRF_GRA }, // 1 Sprite data
{ "269-c2.bin", 0x2000000, 0x5A95F294, 3 | BRF_GRA }, // 2
{ "269-m1_decrypted.bin", 0x080000, 0x7b7bf462, 4 | BRF_ESS | BRF_PRG }, // 3 Z80 code (decrypted)
{ "269-m1.bin", 0x080000, 0xf6819d00, 0 | BRF_PRG | BRF_OPT }, // 4
// This uses Neo-PCM2 PLAYMORE(c) 2002 Protection chip
{ "269-v1.bin", 0x800000, 0xC659B34C, 5 | BRF_SND }, // 5 Sound data
{ "269-v2.bin", 0x800000, 0xDD903835, 5 | BRF_SND }, // 6
};
STDROMPICKEXT(svcpcb, svcpcb, PCB269);
STD_ROM_FN(svcpcb);
static int svcpcbInit()
{
nNeoProtectionXor = 0x57;
nNeoTextROMSize = 0x080000;
return NeoPVCInit(svcpcbPVCDecrypt, 1, 5, 7);
}
struct BurnDriver BurnDrvsvcpcb = {
"svcpcb", NULL, NULL, "2003", // boardrom is NULL because it NOT a neogeo cart
"SvC Chaos - SNK vs CAPCOM (JAMMA PCB)\0", "PCB Custom board / Asia / Japan", "Capcom / Playmore Corporation", "Neo Geo",
NULL, NULL, NULL, NULL,
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B | HARDWARE_SNK_ALTERNATE_TEXT | HARDWARE_SNK_PCB_BIOS,
NULL, svcpcbRomInfo, svcpcbRomName, neogeoInputInfo, PCB269DIPInfo,
svcpcbInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
// SvC Chaos - SNK vs CAPCOM (PCB board, decrypted C-ROMs)
static struct BurnRomInfo svcpcbnRomDesc[] = {
{ "269-p1.bin", 0x2000000, 0x432CFDFC, 1 | BRF_ESS | BRF_PRG }, // 0 68K code
{ "svcn_c1.rom", 0x2000000, 0x382ce01f, 3 | BRF_GRA }, // 1 Sprite data
{ "svcn_c2.rom", 0x2000000, 0x88ad01ec, 3 | BRF_GRA }, // 2
{ "269-m1_decrypted.bin", 0x080000, 0x7b7bf462, 4 | BRF_ESS | BRF_PRG }, // 3 Z80 code (decrypted)
{ "269-v1.bin", 0x800000, 0xc659b34c, 5 | BRF_SND }, // 4 Sound data
{ "269-v2.bin", 0x800000, 0xdd903835, 5 | BRF_SND }, // 5
};
STDROMPICKEXT(svcpcbn, svcpcbn, PCB269);
STD_ROM_FN(svcpcbn);
struct BurnDriver BurnDrvsvcpcbn = {
"svcpcbn", "svcpcb", NULL, "2003",
"SvC Chaos - SNK vs CAPCOM (JAMMA PCB, decrypted C)\0", "PCB Custom board / Asia / Japan, decrypted C-ROMs", "Capcom / Playmore Corporation", "Neo Geo",
NULL, NULL, NULL, NULL,
BDF_GAME_WORKING | BDF_CLONE, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ALTERNATE_TEXT | HARDWARE_SNK_PCB_BIOS,
NULL, svcpcbnRomInfo, svcpcbnRomName, neogeoInputInfo, PCB269DIPInfo,
svcpcbInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};perfect... now the rest: the bankswitch
// ----------------------------------------------------------------------------
// Extra code for Neo-PVC Protection
// ----------------------------------------------------------------------------
// General Bankswitch & Protections for PVC Protected games
// ========================================================
unsigned short CartRAM[0x1000];
unsigned char pvc_r8(unsigned int sekAddress)
{
return *(((unsigned char*)CartRAM) + ((sekAddress^1) - 0x2fe000));
}
void pvc_w8(unsigned int sekAddress, unsigned char byteValue)
{
*(((unsigned char*)CartRAM) + ((sekAddress^1) - 0x2fe000)) = byteValue;
}
// These perform some palette calculations
// Unpack palette word to RGB dword, thanks to bms888
void pvc_prot1() // on writes to e0/e1
{
unsigned char b1, b2;
b1 = pvc_r8(0x2fffe0);
b2 = pvc_r8(0x2fffe1);
pvc_w8(0x2fffe3,(((b2>>0)&0xf)<<1)|((b1>>4)&1));
pvc_w8(0x2fffe2,(((b2>>4)&0xf)<<1)|((b1>>5)&1));
pvc_w8(0x2fffe5,(((b1>>0)&0xf)<<1)|((b1>>6)&1));
pvc_w8(0x2fffe4, (b1>>7));
}
// pack RGB dword to palette word
void pvc_prot2() // on writes to e8/e9/ea/eb
{
unsigned char b1, b2, b3, b4;
b1 = pvc_r8(0x2fffe8);
b2 = pvc_r8(0x2fffe9);
b3 = pvc_r8(0x2fffea);
b4 = pvc_r8(0x2fffeb);
pvc_w8(0x2fffed,(b2>>1)|((b1>>1)<<4));
pvc_w8(0x2fffec,(b4>>1)|((b2&1)<<4)|((b1&1)<<5)|((b4&1)<<6)|((b3&1)<<7));
}
void mv0WriteBankSwitch() // on writes to f0-f3
{
unsigned int offset = (pvc_r8(0x2ffff2)<<16)|(pvc_r8(0x2ffff3)<<8)|(pvc_r8(0x2ffff0)<<0);
*(((unsigned char*)CartRAM) + (0x2ffff0-0x2fe000)) = 0xA0; // Modified
*(((unsigned char*)CartRAM) + (0x2ffff1-0x2fe000)) &= 0xFE;
*(((unsigned char*)CartRAM) + (0x2ffff3-0x2fe000)) &= 0x7F;
if ((BurnDrvGetFlags() & BDF_BOOTLEG) && (Neo68KROM[0x108] == 0x69)) {
SekMapMemory(Neo68KROM + offset, 0x200000, 0x2fdfff, SM_ROM);
} else {
SekMapMemory(Neo68KROM + 0x100000 + offset, 0x200000, 0x2fdfff, SM_ROM);
}
}
unsigned char __fastcall mv0ReadByteBankSwitch(unsigned int sekAddress)
{
return pvc_r8(sekAddress);
}
unsigned short __fastcall mv0ReadWordBankSwitch(unsigned int sekAddress)
{
return CartRAM[(sekAddress-0x2fe000)/2];
}
void __fastcall mv0WriteByteBankSwitch(unsigned int sekAddress, unsigned char byteValue)
{
pvc_w8(sekAddress,byteValue);
if (sekAddress>=0x2fffe0 && sekAddress<=0x2fffe1) pvc_prot1();
else if(sekAddress>=0x2fffe8 && sekAddress<=0x2fffeb) pvc_prot2();
else if(sekAddress>=0x2ffff0 && sekAddress<=0x2ffff3) mv0WriteBankSwitch();
}
void __fastcall mv0WriteWordBankSwitch(unsigned int sekAddress, unsigned short wordValue)
{
CartRAM[(sekAddress-0x2fe000)/2] = wordValue;
if (sekAddress>=0x2fffe0 && sekAddress<=0x2fffe1) pvc_prot1();
else if(sekAddress>=0x2fffe8 && sekAddress<=0x2fffeb) pvc_prot2();
else if(sekAddress>=0x2ffff0 && sekAddress<=0x2ffff3) mv0WriteBankSwitch();
}
// This is needed for the scan function and savestates
unsigned char *NeoCartRAM = (unsigned char*)CartRAM;
int NeoPVCScan(int nAction, int* /*pnMin*/)
{
struct BurnArea ba;
if (nAction & ACB_MEMORY_RAM) {
ba.Data = NeoCartRAM;
ba.nLen = 0x00002000;
ba.nAddress = 0;
ba.szName = "Neo-PVC 68K RAM";
BurnAcb(&ba);
}
return 0;
}
void NeoPVCMapBank()
{
// Don't map memory to the 68K BankAdress, PVC games don't use it (it seems...)
return;
}
// Install handlers
int NeoPVCInit(void(*pInitCallback)(), int nGameInit, void(*pBIOSCallBack)(),int nPCM2Value, int nTextDecValue)
{
int nRet;
extern unsigned char *Neo68KBIOS;
// Set up Extra RAM for PVC games (mslug5 doesn't use this)
memset(CartRAM, 0, sizeof(CartRAM));
pNeoInitCallback = pInitCallback;
pNeoBankswitchCallback = NeoPVCMapBank;
pNeoScanCallback = NeoPVCScan;
// Special handlers for sound and text if necesary
nNeoPCM2PLAYMOREProtection = nPCM2Value; // Neo-PCM2 PLAYMORE (c) type
nNeoTextROMFixType = nTextDecValue; // Text encryption handler
if ((nRet = NeoInit()) == 0) {
// Install Normal BankSwitch handler
SekMapHandler(5, 0x2fe000, 0x2fffff, SM_READ);
SekSetReadWordHandler(5, mv0ReadWordBankSwitch);
SekSetReadByteHandler(5, mv0ReadByteBankSwitch);
SekMapHandler(5, 0x2fe000, 0x2fffff, SM_WRITE);
SekSetWriteWordHandler(5, mv0WriteWordBankSwitch);
SekSetWriteByteHandler(5, mv0WriteByteBankSwitch);
if (nGameInit == 2) {
// Handler for kof2003 BIOS
SekMapMemory(Neo68KBIOS + 0x20000, 0xC20000, 0xC3FFFF, SM_ROM);
}
}
return nRet;
}decryption for this sets:
// ----------------------------------------------------------------------------
// mslug5, svcchaos, kof2003
static void Neo68KROM32WORDSWAP(unsigned char* Neo68KROMData, int nROMsize)
{
// Interleave data in the 68K code
unsigned short *ROMData = (unsigned short*)Neo68KROMData;
unsigned short *tmp = (unsigned short*)malloc(nROMsize);
for (int i = 0; i < 0x200000; i++) {
tmp[i * 2 + 0] = ROMData[i];
tmp[i * 2 + 1] = ROMData[i + 0x200000];
}
memcpy(ROMData, tmp, nROMsize);
free(tmp);
}
// By IQ_132 -- http://neosource.1emu.net/
static void Neo_PVC_PLAYMORE_2003(int g) // 0 mslug5, 1 kof2003, 2 kof2003a, 3 svcchaos
{
const unsigned char b0[4][8] = {
{ 6, 7, 4, 5, 2, 3, 0, 1 },
{ 0, 1, 2, 3, 4, 5, 6, 7 },
{ 1, 0, 3, 2, 5, 4, 7, 6 },
{ 6, 7, 4, 5, 2, 3, 0, 1 },
};
const unsigned char b1[4][8] = {
{ 1, 0, 3, 2, 5, 4, 7, 6 },
{ 1, 0, 3, 2, 4, 5, 6, 7 },
{ 0, 1, 2, 3, 4, 5, 6, 7 },
{ 2, 3, 0, 1, 4, 5, 6, 7 },
};
unsigned int adxor[4] = { 0x00700, 0x00300, 0x00800, 0x00A00 };
unsigned char *pTemp = (unsigned char*)malloc(0x900000);
int x1 = 0xFF; if (g == 0) x1 = 0; // mslug5 fix
for(int i = 0; i < 0x100000; i++)
pTemp[i] = Neo68KROM[i] ^ x1 ^ Neo68KROM[0x0FFFE0 + (i % 0x20)];
for(int i = 0x100000; i < 0x800000; i++)
pTemp[i] = Neo68KROM[i] ^ 0xFF ^ Neo68KROM[0x7FFFE0 + (i % 0x20)];
for(int i = 0x100000; i < 0x800000; i += 4) {
unsigned short *rom16 = (unsigned short*)&pTemp[i + 1];
*rom16 = (*rom16&0xF00F) | BITSWAP08((*rom16>>4)&0xFF, b0[g][0], b0[g][1], b0[g][2], b0[g][3], b0[g][4], b0[g][5], b0[g][6], b0[g][7])<<4;
}
for(int i = 0; i < 0x10; i++) {
int j = (i & 0xf0) + BITSWAP08((i & 0x0f), 7, 6, 5, 4, b1[g][0], b1[g][1], b1[g][2], b1[g][3]);
memcpy(Neo68KROM + i * 0x10000, pTemp + j * 0x10000, 0x10000);
}
if ((g == 1) || (g == 2))
memcpy(Neo68KROM + 0x100000, Neo68KROM + 0x800000, 0x100000); // move P3 (kof2003/a)
for(int i = 0x100000; i < 0x700000; i += 0x100) {
int j = (i & 0xf000ff) + ((i & 0x000f00) ^ adxor[g]) + (BITSWAP08(((i & 0x0ff000) >> 12), b1[g][4], b1[g][5], b1[g][6], b1[g][7], 1, 0, 3, 2) << 12);
memcpy(Neo68KROM + i + 0x100000, pTemp + j, 0x100);
}
free(pTemp);
}
void svcpcbPVCDecrypt()
{
Neo_PVC_PLAYMORE_2003(3);
}ok... we're complete with inits... now let's go to:
neo_run.cpp:
add this befor SRAMProtaddres:
int nNeoPCM2PLAYMOREProtection = 0;
int nNeoTextROMFixType = 0;now in ROMIndex replace:
Neo68KBIOS = Next; Next += 0x20000; // 68K boardROMwith:
Neo68KBIOS = Next; Next += nCodeSize; // 68K boardROMnow in NeoLoad68KBIOS function after the SNK_TRACKBALL flag add:
if ((BurnDrvGetHardwareCode() & HARDWARE_SNK_CONTROLMASK) == HARDWARE_SNK_PCB_BIOS) {
nNewBIOS = 10;
}remember that your bios should be the number 10 in the BIOS list added in d_neogeo.cpp
now in neogeoReset function after:
NeoLoad68KBIOS((NeoSystem & 0x07) ^ 4);add:
// Does this is tied directly to the harddip or there's a bankswitch somewhere?
if ((BurnDrvGetHardwareCode() & HARDWARE_SNK_CONTROLMASK) == HARDWARE_SNK_PCB_BIOS) {
if (!strcmp(BurnDrvGetTextA(DRV_NAME), "svcpcb") || !strcmp(BurnDrvGetTextA(DRV_NAME), "svcpcbn")) {
int harddip3 = (NeoSystem & 0x03)&1;
switch (NeoSystem & 0x03) {
case 0x02:
case 0x03:
memcpy(Neo68KBIOS, Neo68KBIOS + 0x20000 + harddip3 * 0x20000, 0x20000);
break;
}
}
}now let's go to:
neogeo.cpp:
replace the old NeoLoadSprites function with this one:
// This function loads and pre-processes the sprite data
int NeoLoadSprites(int nOffset, int nNum, unsigned char* pDest, unsigned int nSpriteSize)
{
struct BurnRomInfo ri;
ri.nType = 0;
ri.nLen = 0;
unsigned int nRomSize = 0;
if ((BurnDrvGetHardwareCode() & (HARDWARE_SNK_ENCRYPTED_A | HARDWARE_SNK_ENCRYPTED_B)) && (nSpriteSize != 0x6000000)) {
if (BurnDrvGetHardwareCode() & HARDWARE_SNK_ENCRYPTED_A) {
NeoGfxDecryptCMC42Init();
} else {
if (BurnDrvGetHardwareCode() & HARDWARE_SNK_ENCRYPTED_B) {
NeoGfxDecryptCMC50Init();
}
}
unsigned char* pBuf = (unsigned char*)malloc(0x800000 * 2);
if (pBuf == NULL) {
return 1;
}
for (int i = 0; i < (nNum >> 1); i++) {
int k = 4, n = i;
if ((nSpriteSize == 0x4000000) && (nNum == 2)) {
pBuf = (unsigned char*)malloc(nSpriteSize);
BurnLoadRom(pBuf + 0x0000000, nOffset + (i << 1), 1);
BurnLoadRom(pBuf + 0x2000000, nOffset + 1 + (i << 1), 1);
k = 16, n = 0, i = 2;
svcchaos_cx_decrypt(pBuf);
} else {
BurnLoadRom(pBuf + 0, nOffset + (i << 1), 2);
BurnLoadRom(pBuf + 1, nOffset + 1 + (i << 1), 2);
}
for (int j = 0; j < k; j++) {
BurnUpdateProgress(1.0 / ((double)(nSpriteSize/0x800000) * 8.0 / 3.0), j ? NULL : _T("Decrypting graphics..."), 0);
NeoGfxDecryptDoBlock(nNeoProtectionXor, pBuf + j * 0x400000, n * 0x800000 * 2 + j * 0x400000, 0x400000, nSpriteSize);
}
}
free(pBuf);
} else {
nSpriteSize = 0;
// Compute correct size to gaps into account (Kizuna)
for (int i = 0; i < nNum - 2; i++) {
BurnDrvGetRomInfo(&ri, nOffset + i);
if (ri.nLen > nRomSize) {
nRomSize = ri.nLen;
}
}
for (int i = 0; i < (nNum >> 1); i++) {
BurnLoadRom(pDest + nSpriteSize + 0, nOffset + (i << 1), 2);
BurnLoadRom(pDest + nSpriteSize + 1, nOffset + 1 + (i << 1), 2);
BurnDrvGetRomInfo(&ri, nOffset + (i << 1));
if (i < (nNum >> 1) - 1) {
nSpriteSize += nRomSize << 1;
} else {
nSpriteSize += ri.nLen << 1;
}
}
}
// Swap data for viewpoin, aof, ssideki, kotm2, more
if (BurnDrvGetHardwareCode() & HARDWARE_SNK_SWAPC) {
unsigned char* pBuf = (unsigned char*)malloc(0x600000);
if (pBuf) {
for (int i = 0x200000; i < 0x600000; i++) {
pBuf[i] = pDest[i];
}
for (int i = 0; i < 0x100000; i++) {
((short*)(pDest + 0x200000))[i] = ((short*)(pBuf + 0x400000))[i];
((short*)(pDest + 0x400000))[i] = ((short*)(pBuf + 0x200000))[i];
}
free(pBuf);
} else {
return 1;
}
}
return 0;
}now in neo_decrypt.cpp:
add this:
// Original MAME by HalRIN - http://www52.tok2.com/home/foge/
// Ported to FBA and modified by IQ_132 - http://neosource.1emu.net/
// SvC Chaos: SNK vs CAPCOM C-ROM decryption (Version 2)
void svcchaos_cx_decrypt(unsigned char* rom)
{
const unsigned char xor1[ 4 ] = {0x34, 0x21, 0xc4, 0xe9,};
unsigned char *pTemp = (unsigned char*)malloc(0x800000);
for (int i = 0; i < 8; i++) {
int ofst;
unsigned char *gfxrom = rom+i*0x800000;
for(int j = 0; j < 0x800000; j++) {
gfxrom[ j ] ^= xor1[ (j % 4) ];
}
for(int j = 0; j < 0x800000; j += 4) {
UINT32 *rom32 = (UINT32*)&gfxrom[ j ];
*rom32 = BITSWAP32(*rom32, 0x09, 0x0d, 0x13, 0x00, 0x17, 0x0f, 0x03, 0x05, 0x04, 0x0c, 0x11, 0x1e, 0x12, 0x15, 0x0b, 0x06, 0x1b, 0x0a, 0x1a, 0x1c, 0x14, 0x02, 0x0e, 0x1d, 0x18, 0x08, 0x01, 0x10, 0x19, 0x1f, 0x07, 0x16);
}
memcpy( pTemp, gfxrom, 0x800000 );
for(int j = 0; j < 0x800000/4; j++ ) {
ofst = BITSWAP24((j & 0x1fffff), 0x17, 0x16, 0x15, 0x04, 0x0b, 0x0e, 0x08, 0x0c, 0x10, 0x00, 0x0a, 0x13, 0x03, 0x06, 0x02, 0x07, 0x0d, 0x01, 0x11, 0x09, 0x14, 0x0f, 0x12, 0x05);
ofst ^= 0x0c8923;
ofst += (j & 0xffe00000);
memcpy( &gfxrom[ j * 4 ], &pTemp[ ofst * 4 ], 0x04 );
}
}
free(pTemp);
}now un burn.h:
add this after the gambling flags
#define HARDWARE_SNK_PCB_BIOS (0x6000) // Uses custom BIOSnow finally, don't forget to declare the following in neogeo.h:
extern int nNeoPCM2PLAYMOREProtection;
extern int nNeoTextROMFixType;
void svcchaos_cx_decrypt(unsigned char* rom);this should be all to have the game workig... it works for me :)
See ya!!!!!! :biggrin:
-
I forgot something:
in neorun.cpp:
after:
if (BurnDrvGetHardwareCode() & HARDWARE_SNK_SWAPV) {
for (int i = 0; i < 0x00200000; i++) {
unsigned char n = YM2610ADPCMAROM[i];
YM2610ADPCMAROM[i] = YM2610ADPCMAROM[0x00200000 + i];
YM2610ADPCMAROM[0x00200000 + i] = n;
}
}add:
// Neo-PCM2 PLAYMORE(c) 2002 Sound Chip Emulation
if (nNeoPCM2PLAYMOREProtection != 0) {
Neo_PCM2_PLAYMORE_2002(nNeoPCM2PLAYMOREProtection);
}look for:
BurnUpdateProgress(0.0, _T("Generating text layer graphics..."), 0);
NeoExtractSData(NeoSpriteROM, NeoTextROM + 0x020000, nSpriteSize, nNeoTextROMSize);add after:
// Original convertion by IQ_132 (This is for svcpcb, kf2k3pcb and clones)
if (nNeoTextROMFixType == 7) {
for( int i = 0; i < nNeoTextROMSize; i++ ) {
(NeoTextROM+0x20000)[i] = BITSWAP08((NeoTextROM+0x20000)[i]^0xd2,4,0,7,2,5,1,6,3);
}
}now in neoexit function add to the very end:
nNeoPCM2PLAYMOREProtection = 0;
nNeoTextROMFixType = 0; // Exit text layer fixin neo_decrypt add:
// Neo-PCM2 PLAYMORE(c) 2002 Sound Chip Emulation
// Some code by Fataku & some by the vconv (from 2ch) - FBA conversion by iq_132
void Neo_PCM2_PLAYMORE_2002(int value)
{
unsigned int addrs[7][2] = {
{0x000000,0xA5000}, //kof2002
{0xFFCE20,0x01000}, //matrimelee
{0xFE2CF6,0x4E001}, //mslug5
{0xFEB2C0,0x0A000}, //samsho5
{0xFFAC28,0xC2000}, //svcchaos
{0xFF14EA,0xA7001}, //kof2003
{0xFFB440,0x02000}, //samsh5sp
};
unsigned int xordata[7][8] = {
{0xF9,0xE0,0x5D,0xF3,0xEA,0x92,0xBE,0xEF}, //kof2002
{0xC4,0x83,0xA8,0x5F,0x21,0x27,0x64,0xAF}, //matrimelee
{0xC3,0xFD,0x81,0xAC,0x6D,0xE7,0xBF,0x9E}, //mslug5
{0xCB,0x29,0x7D,0x43,0xD2,0x3A,0xC2,0xB4}, //samsho5
{0xC3,0xFD,0x81,0xAC,0x6D,0xE7,0xBF,0x9E}, //svcchaos
{0x4B,0xA4,0x63,0x46,0xF0,0x91,0xEA,0x62}, //kof2003
{0x4B,0xA4,0x63,0x46,0xF0,0x91,0xEA,0x62}, //samsh5sp
};
unsigned char *rom = YM2610ADPCMAROM;
unsigned char *buf = (unsigned char*)malloc(0x1000000);
int ofst;
memcpy(buf,rom,0x1000000);
for(int i=0; i<0x1000000; i++) {
ofst = (i & 0xfefffe) | ((i & 0x010000) >> 16) | ((i & 0x000001) << 16);
ofst ^= addrs[value-1][1];
rom[ofst] = (buf[((i + addrs[value-1][0]) & 0xffffff)] ^ xordata[value-1][(ofst & 0x07)]);
}
free(buf);
}and declare in neogeo.h:
void Neo_PCM2_PLAYMORE_2002(int value);see ya!!!!!! :biggrin:
-
A little lower ram Cx decrypt ^^
Replace this:
for (int i = 0; i < (nNum >> 1); i++) {
int k = 4, n = i;
if ((nSpriteSize == 0x4000000) && (nNum == 2)) {
pBuf = (unsigned char*)malloc(nSpriteSize);
BurnLoadRom(pBuf + 0x0000000, nOffset + (i << 1), 1);
BurnLoadRom(pBuf + 0x2000000, nOffset + 1 + (i << 1), 1);
k = 16, n = 0, i = 2;
svcchaos_cx_decrypt(pBuf);
} else {
BurnLoadRom(pBuf + 0, nOffset + (i << 1), 2);
BurnLoadRom(pBuf + 1, nOffset + 1 + (i << 1), 2);
}
With this:
int svcpcb = 0; // hack for svc's non-standard 32mb Cx roms
for (int i = 0; i < (nNum + svcpcb >> 1); i++) {
int k = 4, n = i;
if ((nSpriteSize == 0x4000000) && (nNum == 2)) { // svc pcb
pBuf = (unsigned char*)malloc(0x2000000);
BurnLoadRom(pBuf, nOffset + i, 1);
k = 8, n = i * 2, svcpcb = 2;
svcpcb_cx_decrypt(pBuf);
} else {
BurnLoadRom(pBuf + 0, nOffset + (i << 1), 2);
BurnLoadRom(pBuf + 1, nOffset + 1 + (i << 1), 2);
}
In the following function, replace i < 8 with i < 4
void svcchaos_cx_decrypt(unsigned char* rom)
{
const unsigned char xor1[ 4 ] = {0x34, 0x21, 0xc4, 0xe9,};
unsigned char *pTemp = (unsigned char*)malloc(0x800000);
for (int i = 0; i < 8; i++) {