Welcome!
Final Burn Neo => FBN Development => Topic started by: iq_132 on November 16, 2004, 01:17:59 AM
-
Sengoku 3
static void sengoku3AESPatch()
{
*((unsigned short*)(Neo68KROM + 0x00d04)) = 0x4E71;
}
Zupapa
static void zupapaAESPatch()
{
*((unsigned short*)(Neo68KROM + 0x80290)) = 0x4E71;
}
King of Fighters 2000
static void kof2000AESPatch()
{
*((unsigned short*)(Neo68KROM + 0xA226E)) = 0x4E75;
}
metal slug 4
static void mslug4AESPatch()
{
*((unsigned short*)(Neo68KROM + 0x0AD8C)) = 0x4E75;
}
matrimelee
static void matrimAESPatch()
{
*((unsigned short*)(Neo68KROM + 0x01050)) = 0x4E75;
}
Rage of the Dragons
static void rotdAESPatch()
{
*((unsigned short*)(Neo68KROM + 0x01020)) = 0x4E71;
*((unsigned short*)(Neo68KROM + 0x02400)) = 0x4E71;
}
Metal Slug 5
static void mslug5AESPatch()
{
*((unsigned short*)(Neo68KROM + 0x0122A)) = 0x4e75;
}
-
Nice, IQ. I was really looking for a source on all needed AES patches. Thanks.
-
An Update and questions...
First, you must use Neo68KROM instead of Neo68KROM01, for all cases.
Second, kof2000 and matrim patches don't work :p - and I didn't test mslug5.
-
Matrim works fine for me...
As for kof2000, they changed the way the init for SMA-protected games works.
Find this:
static void kof2000SMADecrypt()
Add this before the last }
kof2000AESPatch();
-
Here's the matrim driver, I tried pNeoInitCallback = matrimAESPatch; in all posible places but no luck...
This is using Neo Geo Normal BIOS, on all regions. AES Mode works with Universe BIOS.
// Matrimelee (encrypted graphics / sound)
static struct BurnRomInfo matrimRomDesc[] = {
{ "266-p1.bin", 0x100000, 0x5d4c2dc7, 1 | BRF_ESS | BRF_PRG }, // 0 68K code
{ "266-p2.bin", 0x400000, 0xa14b1906, 1 | BRF_ESS | BRF_PRG }, // 1
{ "266-c1.bin", 0x800000, 0x505f4e30, 3 | BRF_GRA }, // 2 Sprite data (decrypted)
{ "266-c2.bin", 0x800000, 0x3cb57482, 3 | BRF_GRA }, // 3
{ "266-c3.bin", 0x800000, 0xf1cc6ad0, 3 | BRF_GRA }, // 4
{ "266-c4.bin", 0x800000, 0x45b806b7, 3 | BRF_GRA }, // 5
{ "266-c5.bin", 0x800000, 0x9a15dd6b, 3 | BRF_GRA }, // 6
{ "266-c6.bin", 0x800000, 0x281cb939, 3 | BRF_GRA }, // 7
{ "266-c7.bin", 0x800000, 0x4b71f780, 3 | BRF_GRA }, // 8
{ "266-c8.bin", 0x800000, 0x29873d33, 3 | BRF_GRA }, // 9
{ "266-m1d.bin", 0x020000, 0xD2F3742D, 4 | BRF_ESS | BRF_PRG }, // 10 Z80 code (decrypted)
{ "266-m1.bin", 0x020000, 0x456c3e6c, 0 | BRF_PRG | BRF_OPT }, // 11 Z80 code
{ "266-v1.bin", 0x800000, 0xa4f83690, 5 | BRF_SND }, // 12
{ "266-v2.bin", 0x800000, 0xd0f69eda, 5 | BRF_SND }, // 13
};
STDROMPICKEXT(matrim, matrim, neogeo);
STD_ROM_FN(matrim);
static void matrimAESPatch()
{
*((unsigned short*)(Neo68KROM + 0x01050)) = 0x4E75; // <-------------
}
static int matrimInit()
{
int nRet;
nNeoTextROMSize = 0x080000;
nNeoProtectionXor = 0x6A;
pNeoInitCallback = PCM2DecryptP;
pNeoInitCallback = matrimAESPatch; // <-------------
nRet = NeoInit();
if (nRet == 0) {
PCM2DecryptVInfo Info = { 0x001000, 0xFFCE20, { 0xC4, 0x83, 0xA8, 0x5F, 0x21, 0x27, 0x64, 0xAF } };
PCM2DecryptV(&Info);
}
return nRet;
}
struct BurnDriver BurnDrvmatrim = {
"matrim", NULL, "neogeo", "2002",
"Shin gouketsuzi ichizoku - Toukon\0Matrimelee\0", NULL, "Playmore / Noise Factory / Atlus", "Neo Geo",
L"\u65B0\u8C6A\u8840\u5BFA\u4E00\u65CF - \u95D8\u5A5A\0Matrimelee\0", NULL, NULL, NULL,
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B | HARDWARE_SNK_ALTERNATE_TEXT,
NULL, matrimRomInfo, matrimRomName, neogeoInputInfo, neogeoDIPInfo,
matrimInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};
As for the kof2000 driver, I did this and I did not use kof2000AESPatch(); code in any way:
*note*: This is not the full, driver, just a little part.
static void kof2000SMADecrypt()
{
for (int i = 0; i < 0x800000 / 2; i++) {
((unsigned short*)(Neo68KROM + 0x100000))[i] = BITSWAP16(((unsigned short*)(Neo68KROM + 0x100000))[i], 12, 8, 11, 3, 15, 14, 7, 0, 10, 13, 6, 5, 9, 2, 1, 4);
}
for (int i = 0; i < 0x0C0000 / 2; i++) {
((unsigned short*)Neo68KROM)[i] = ((unsigned short*)Neo68KROM)[0x73A000 / 2 + BITSWAP24(i, 23, 22, 21, 20, 19, 18, 8, 4, 15, 13, 3, 14, 16, 2, 6, 17, 7, 12, 10, 0, 5, 11, 1, 9)];
}
for (int i = 0; i < 0x63A000 / 2; i += 0x0800 / 2) {
unsigned short nBuffer[0x0800 / 2];
memcpy(nBuffer, &((unsigned short*)(Neo68KROM + 0x100000))[i], 0x0800);
for (int j = 0; j < 0x0800 / 2; j++) {
((unsigned short*)(Neo68KROM + 0x100000))[i + j] = nBuffer[BITSWAP24(j, 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13, 12, 11, 10, 4, 1, 3, 8, 6, 2, 7, 0, 9, 5)];
}
}
{
*((unsigned short*)(Neo68KROM + 0xA226E)) = 0x4E75;
}
}
PD: Sorry for being so n00b, but I hate programming. I just like emulators :D
-
Try this ;)
static void matrimAESPatch()
{
*((unsigned short*)(Neo68KROM + 0x01050)) = 0x4E75;
}
static int matrimInit()
{
int nRet;
nNeoTextROMSize = 0x080000;
nNeoProtectionXor = 0x6A;
pNeoInitCallback = matrimAESPatch;
nRet = NeoInit();
if (nRet == 0) {
PCM2DecryptVInfo Info = { 0x001000, 0xFFCE20, { 0xC4, 0x83, 0xA8, 0x5F, 0x21, 0x27, 0x64, 0xAF } };
PCM2DecryptV(&Info);
PCM2DecryptP();
}
return nRet;
}
-
Thx, Iq_132.
It means without these patches, AES will not work. Right?
I wonder if these patches are necessary.
-
That patches are nessesary if you want t play AES version of this games... if you don't want AES to be working, you can disable this patches, this will not affect the entire game at all.
See ya!!!! :biggrin:
-
Thank you.
Some games I tried on the list can work in AES mode without patches...
-
Maybe those roms are fixed.
-
they have been fixed/added since the last fba update (which brought support to lots of roms etc)
-
Most likely these versions that run in AES mode just fine without the patches are one of two things:
1. "fixed" -- already have these aes patches applied
2. Dumps from actual AES carts (kof2001h -> kof2001 HOME -> AES)
-
Thank you.
Some games I tried on the list can work in AES mode without patches...
Maybe they are hacks for NRX (that emulator can't emulate AES protections since kof2000) avoid them, the real p roms have the AES protection (except some games like PCB carts)
See ya!!!! :biggrin:
-
Maybe they are hacks for NRX (that emulator can't emulate AES protections since kof2000) avoid them, the real p roms have the AES protection (except some games like PCB carts)
See ya!!!! :biggrin:
but there are some of them that we are using in our fba drivers (the encrypted romsets)... i'm working now, but coming back i'll confirm the sets that don't need fix (rotd and matrim, i think)
-
While we're at the AES talk, I'd like to ask something (oh surprise, me and my questions :p). Does anyone have any idea of which bios file would stand for the US AES? I do already know of neo-po.bin (16D0C132, Japanese AES) and neo-epo.bin (D27A71F1, Asiatic/European AES), but I've no idea about the US one.
Thanks.
-
last time I heard, the only known BIOS for AES was the asia one
I could be wrong though
-
Yeah, but apparently, since the last FBA release, there seems to be a new AES bios recognized, which is the Japanese one (neo-po.bin). We're left to wonder whether or not there's an American AES bios, since the space ofr that file in the source is blank.
-
Yeah, but apparently, since the last FBA release, there seems to be a new AES bios recognized, which is the Japanese one (neo-po.bin). We're left to wonder whether or not there's an American AES bios, since the space ofr that file in the source is blank.
They aren't dumped yet... but it seems that maybe soon they will
See ya!!!!!
-
Someone please test this for me for kof2000, matrim, mslug4, mslug5, nitd, sengoku3, rotd, and zupapa.
Start by removing or disabling the AES patches for these games, next, find this (in neo_run.cpp)
I just wanted to mention that this hack allows you to have the correct crc in the Uni-bios crc check.
int NeoFrame()
{
Add this after:
if (bAESBIOS && !SekReadByte(0x10fcef)) { // AES hack
SekWriteByte(0x108000 + 0x7cef, 0xff);
}
Please just test these games in AES mode and tell me if there are any bugs, gfx glitches, etc. Thx :)
btw, if you don't program, but are willing to test anyway, here's a cheat that does the same.
cheat "AES patch test"
default 0
0 "Disabled"
1 "Enabled", 0, 0x10fCEF, 0xFF
For some technical information, these games check a particular byte in the main 68k ram (0x100000-0x10ffff). The MVS bios sets
this byte (0x10fcef) to 0xFF on bootup; the AES (console) bios does not. It actually sets it to 0x00. So in the program rom,
there is this short piece of 68k code
00ad88 -- -- -- 4a2d 7cef tst.b ($7cef,A5) // this line tests the addess at $7cef + $108000[A5] (10fcef) to see if it's 0
00ad8c -- -- -- 6700 0034 beq adc2 // if it is 0, then go to an address to display an error message (AES hardware)
00ad90 -- -- -- -- 4e75 rts // otherwise, get out of this sub (MVS hardware)
Right after that is some text: "MVS SLOT CHECK Ver2.30 00/04/25"
-
So far, they all worked nicely for me, IQ. That was great, thanks!