Topic: IQ's PGM WIP

[JacKc]

Don't want to brake some hope but this set has been tested with MameUI 0.103 (which allows ddp2 to boot) and not in FBA...But maybe Iq_132 will take a look at mame source v103 to see how ddp2 boots?

[iq_132]

Don't want to brake some hope but this set has been tested with MameUI 0.103 (which allows ddp2 to boot) and not in FBA...But maybe Iq_132 will take a look at mame source v103 to see how ddp2 boots?

It isn't terribly difficult. Here's a quick, lazy port.  It doesn't make the game work fully (no enemy bullets, ship disappears after first level).

in pgm_run.cpp find this:

Code: [Select]

case 0xC00007:
return pgm_calendar_r();

Add this after:

Code: [Select]

case 0xC08007: // dipswitches
return ~(PgmInput[6]) | 0xe0;

use this driver in d_pgm.cpp

Code: [Select]

// Bee Storm - DoDonPachi II (V102)

static struct BurnRomInfo ddp2RomDesc[] = {
{ "v100.u8",    0x200000, 0x0c8aa8ea, 1 | BRF_PRG | BRF_ESS }, //  0 68K Code

{ "t1300.u21",    0x800000, 0xe748f0cb, 2 | BRF_GRA },   //  1 Tile data

{ "a1300.u1",    0x800000, 0xfc87a405, 3 | BRF_GRA },   //  2 Sprite Color Data
{ "a1301.u2",    0x800000, 0x0c8520da, 3 | BRF_GRA },   //  3

{ "b1300.u7",    0x800000, 0xef646604, 4 | BRF_GRA },   //  4 Sprite Masks & Color Indexes

{ "m1300.u5",    0x400000, 0x82d4015d, 5 | BRF_SND },   //  5 Samples

{ "ddp2_igs027a.bin", 0x004000, 0, 7 | BRF_PRG | BRF_NODUMP },//  6 Internal ARM7 Rom

{ "v100.u23",    0x020000, 0x06c3dd29, 8 | BRF_PRG | BRF_ESS }, //  7 External ARM7 Rom
};

STDROMPICKEXT(ddp2, ddp2, pgm)
STD_ROM_FN(ddp2)

static int ddp2_asic27_0xd10000 = 0;

void __fastcall Ddp2WriteByte(unsigned int address, unsigned char data)
{

if ((address & 0xffe000) == 0xd00000) {
PGMUSER0[(address & 0x1fff)^1] = data;

*((unsigned short*)(PGMUSER0 + 0x0010)) = 0;
*((unsigned short*)(PGMUSER0 + 0x0020)) = 1;
return;
}

if ((address & 0xffffffe) == 0xd10000) {
ddp2_asic27_0xd10000=data;
return;
}
}

void __fastcall Ddp2WriteWord(unsigned int address, unsigned short data)
{
if ((address & 0xffe000) == 0xd00000) {
*((unsigned short*)(PGMUSER0 + (address & 0x1ffe))) = data;

*((unsigned short*)(PGMUSER0 + 0x0010)) = 0;
*((unsigned short*)(PGMUSER0 + 0x0020)) = 1;
return;
}

if ((address & 0xffffffe) == 0xd10000) {
ddp2_asic27_0xd10000=data;
return;
}
}

unsigned char __fastcall Ddp2ReadByte(unsigned int address)
{
if ((address & 0xfffffe) == 0xd10000) {
ddp2_asic27_0xd10000++;
ddp2_asic27_0xd10000&=0x7f;
return ddp2_asic27_0xd10000;
}

if ((address & 0xffe000) == 0xd00000) {

*((unsigned short*)(PGMUSER0 + 0x0002)) = 0; // region
*((unsigned short*)(PGMUSER0 + 0x1f00)) = 0;

return PGMUSER0[(address & 0x1fff)^1];
}

return 0;
}

unsigned short __fastcall Ddp2ReadWord(unsigned int address)
{
if ((address & 0xfffffe) == 0xd10000) {
ddp2_asic27_0xd10000++;
ddp2_asic27_0xd10000&=0x7f;
return ddp2_asic27_0xd10000;
}

if ((address & 0xffe000) == 0xd00000) {

*((unsigned short*)(PGMUSER0 + 0x0002)) = 0; // region
*((unsigned short*)(PGMUSER0 + 0x1f00)) = 0;

return *((unsigned short*)(PGMUSER0 + (address & 0x1ffe)));
}

return 0;
}

int ddp2Init()
{
pPgmInitCallback = pgm_decrypt_ddp2;

int nRet;

nRet = pgmInit();

if (nRet == 0) {
memset (PGMUSER0, 0, 0x2000);

SekOpen(0);
SekMapHandler(4,        0xd00000, 0xd1ffff, SM_READ | SM_WRITE);
SekSetReadWordHandler(4, Ddp2ReadWord);
SekSetReadByteHandler(4, Ddp2ReadByte);
SekSetWriteWordHandler(4, Ddp2WriteWord);
SekSetWriteByteHandler(4, Ddp2WriteByte);
SekClose();
}

return nRet;
}

struct BurnDriver BurnDrvDdp2 = {
"ddp2", NULL, "pgm", "2001",
"Bee Storm - DoDonPachi II (V102)\0", "Incomplete Dump", "IGS", "PolyGameMaster",
L"Bee Storm - DoDonPatchi II\0\u6012\u9996\u9886\u8702\uff0d\u8702\u66b4 (V102)\0", NULL, NULL, NULL,
BDF_ORIENTATION_VERTICAL , 4, HARDWARE_IGS_PGM/* | HARDWARE_IGS_USE_ARM_CPU*/, GBF_VERSHOOT, 0,
NULL, ddp2RomInfo, ddp2RomName, pgmInputInfo, pgmDIPInfo,
ddp2Init, pgmExit, pgmFrame, pgmDraw, pgmScan, 0, NULL, NULL, NULL, &nPgmPalRecalc, 0x1200,
224,448,3,4
};


[JacKc]

Nice iq_132...Now ddp2 boots on FBA (of course it doesn't solve the problem and doesn't make the game working fully as the igs027a.asic still needed).

[CaptainCPS]

So basically, are these games protection harder to emulate than protection of CPS2 ?  It has been long time since they are still unplayable even on MAME.

SeeYaa!
 

[JacKc]

Photo Y2K / Real and Fake (V105)

Code: [Select]

static struct BurnRomInfo photoy2kRomDesc[] = {
{ "p0701_v105.u2", 0x200000, 0xfab142e0, 1 | BRF_PRG | BRF_ESS }, //  0 68K Code

{ "t0700.rom",     0x080000, 0x93943b4d, 2 | BRF_GRA },   //  1 Tile data

{ "a0700.l",       0x400000, 0x26a9ae9c, 3 | BRF_GRA },   //  2 Sprite Color Data
{ "a0700.h",       0x400000, 0x79bc1fc1, 3 | BRF_GRA },   //  3
{ "a0701.l",       0x400000, 0x23607f81, 3 | BRF_GRA },   //  4
{ "a0701.h",       0x400000, 0x5f2efd37, 3 | BRF_GRA },   //  5
{ "a0702.rom",     0x080000, 0x42239e1b, 3 | BRF_GRA },   //  6

{ "b0700.l",       0x400000, 0xaf096904, 4 | BRF_GRA },   //  7 Sprite Masks & Color Indexes
{ "b0700.h",       0x400000, 0x6d53de26, 4 | BRF_GRA },   //  8
{ "cgv101.rom",    0x020000, 0xda02ec3e, 4 | BRF_GRA },   //  9

{ "m0700.rom",     0x080000, 0xacc7afce, 5 | BRF_SND },   // 10 Samples

{ "igs027a_photoy2k_v100_china.asic", 0x004000,  0x1a0b68f6, 7 | BRF_PRG | BRF_ESS }, // 11 Internal ARM7 Rom
};

STDROMPICKEXT(photoy2k, photoy2k, pgm)
STD_ROM_FN(photoy2k)

int photoy2kInit()
{
pPgmInitCallback = pgm_decrypt_photoy2k;

Arm7SetIdleLoopAddress(0x000001f4);

int nRet = pgmInit();

if (nRet == 0) {
install_protection_kovsh();
}

return nRet;
}

struct BurnDriver BurnDrvPhotoy2k = {
"photoy2k", NULL, "pgm", "1999",
"Photo Y2K\0Real and Fake (V105)\0", NULL, "IGS", "PolyGameMaster",
L"Photo Y2K\0\u30EA\u30A2\u30EB\u30A2\u30F3\u30C9 \u30D5\u30A7\u30A4\u30AF\0\u5927\u5BB6\u6765 \u627E\u78B4\0\u8D85\u7EA7 \u6BD4\u4E00\u6BD4 (V105)\0", NULL, NULL, NULL,
BDF_GAME_WORKING, 4, HARDWARE_IGS_PGM | HARDWARE_IGS_USE_ARM_CPU, GBF_PUZZLE, 0,
NULL, photoy2kRomInfo, photoy2kRomName, pgmInputInfo, photoy2kDIPInfo,
photoy2kInit, pgmExit, pgmFrame, pgmDraw, pgmScan, 0, NULL, NULL, NULL, &nPgmPalRecalc, 0x1200,
448, 224, 4, 3
};

[FerchogtX]

I always though that games were alredy playable... since Nebula released a binary with those games... I was wrong...

Is always exciting to see new proteccions waiting to be broken XD

See ya!!!

[iq_132]

This is still missing the asic, but some hacking (in large part thanks to XingXing) gets it to show a little bit of sexyness.

[80GSM]

Ooooo, Christmas has come early. In the form of some wonderful screenshots!
Thanks for the treat on the eyes iq_132.

[iq_132]

Ooooo, Christmas has come early. In the form of some wonderful screenshots!
Thanks for the treat on the eyes iq_132.

lol have a couple more.  This is absolutely as far as it gets though.

[SuperPang]

Sweet! Great Work IQ and XingXing 
with more work the game may be playable without ARM7?

[80GSM]

I hope so! But on the subject of emulation. Not Ketsui specifically. Is this using an old ARM7 driver code with some hacks applied?

[iq_132]

I hope so! But on the subject of emulation. Not Ketsui specifically. Is this using an old ARM7 driver code with some hacks applied?

It's pretty much the standard pgm memory map, just that there's no 68k bios, just the 68k rom.  Other than that there are reads/writes to 400000-400005 for the protection unit.
XingXing had patched the 68k code to get the game to boot, I wrote a really stupid sim that gets the game to boot without the patches.

[80GSM]

Ahh, I understand it a bit more now. I can see where the ASIC comes in.

Pretty amazing how they have so many sprites and animations on screen, running on a Motorola 68000 @ 20 MHz, and the ASIC.

[iq_132]

I got a little further with the protection simulation.  It still needs a lot of work.

[iq_132]

And a little more.  Gets in-game now. Sprites are fairly glitchy and the game locks up after a while.