Topic: Metal Slug 5 Drivers

[iq_132]

This is for Metal Slug 5 (Original set).  Note that the P rom I'm using for this set has the Neo-PVC encryption removed.
It's essentially the bootleg with parts 3 & 4 swapped and a 2 byte difference.

BTW, if you save the RAM from Nebula, the AES patch has already been applied.

Code: [Select]

// Metal Slug 5

static struct BurnRomInfo mslug5RomDesc[] = {
// These use the neo-pvc code which is currently unemulated
// {"268-p1.bin", 0x400000, 0xd0466792, 0x10}, //  0 68K code
// {"268-p2.bin", 0x400000, 0xfbf6b61e, 0x10}, //  1
// So use a P1 with the neo-pvc protection removed
{"268-p1d.bin",0x800000, 0x2ECC772D, 0x10}, //  0  (Saved from Kawaks' RAM)

{"268-c1.bin", 0x800000, 0x27d59de8,    1}, //  2 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1,    1}, //  3
{"268-c3.bin", 0x800000, 0xb650f098,    1}, //  4
{"268-c4.bin", 0x800000, 0x10499589,    1}, //  5
{"268-c5.bin", 0x800000, 0x19352405,    1}, //  6
{"268-c6.bin", 0x800000, 0xb1531523,    1}, //  7
{"268-c7.bin", 0x800000, 0xfe2c1338,    1}, //  8
{"268-c8.bin", 0x800000, 0xecce3141,    1}, //  9

// {"268-m1.bin", 0x040000, 0x88c11f51, 0x10},  //  10 Z80 code (Encrypted)
{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, //  10

// These use the Neo-PCM2 2002 (Playmore) chip
// {"268-v1.bin", 0x800000, 0x33c6305c,    2},  //  11 Sound data (Encrypted)
// {"268-v2.bin", 0x800000, 0x1afb848e,    2},  //  12
{"268-v1d.bin", 0x800000, 0x14848c5c,   2},  //  11 Sound data
{"268-v2d.bin", 0x800000, 0x696cce3b,   2},  //  12
};

STDROMPICKEXT(mslug5, mslug5, neogeo);
STD_ROM_FN(mslug5);

static void mslug5_patch()
{
// Code by IQ_132 - Thanks to HappyASR for the info
for (int i = 0; i < 0x100000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 0)) == 0x33FC)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0) {
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
}
if (*((unsigned short*)(Neo68KROM01 + i + 0 )) == 0x5247)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6 )) == 0x33c7)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
*((unsigned short*)(Neo68KROM01 + i + 6 )) = 0x5247;
*((unsigned short*)(Neo68KROM01 + i + 8 )) = 0xe14f;
*((unsigned short*)(Neo68KROM01 + i + 10)) = 0xe94f;
}
}
}
*((unsigned short*)(Neo68KROM01 + 0x0122A)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x18434)) = 0xFFF0;
}

static int mslug5Init()
{
pNeoInitCallback=mslug5_patch; // Remove Protections
nNeoProtectionXor = 0x19;
return NeoInit();
}

struct BurnDriver BurnDrvmslug5 = {

{"mslug5", "Metal Slug 5", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", NULL, "neogeo"},
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, mslug5RomInfo, mslug5RomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};

This is for the original bootleg metal slug 5 release.  

Code: [Select]

// Metal Slug 5 (Bootleg)

static struct BurnRomInfo mslug5bRomDesc[] = {
//(original release, bootleg)
{"268-p1b.bin", 0x800000, 0x3f1cf3d2, 0x10}, //  0 68K code

{"268-c1d.bin", 0x800000, 0x969c0d62,    1}, //  1 Sprite data
{"268-c2d.bin", 0x800000, 0xc69ae867,    1}, //  2
{"268-c3d.bin", 0x800000, 0xd7beaeaf,    1}, //  3
{"268-c4d.bin", 0x800000, 0xe1b1131b, 1}, //  4 (899fb2af is good CRC)
{"268-c5d.bin", 0x800000, 0x2fa1a5ad,    1}, //  5
{"268-c6d.bin", 0x800000, 0x6de89589,    1}, //  6
{"268-c7d.bin", 0x800000, 0x97bd0c0a,    1}, //  7
{"268-c8d.bin", 0x800000, 0xc0d5bc20,    1}, //  8

{"268-m1.bin", 0x020000, 0x6FA01C9A,  0x10}, //  9 Z80 code

{"268-v1.bin", 0x400000, 0xc3540e0d,     2}, //  10 Sound data
{"268-v2.bin", 0x400000, 0x077bd2f4,     2}, //  11
{"268-v3.bin", 0x400000, 0x39b14567,     2}, //  12
{"268-v4.bin", 0x400000, 0x969ff3b2,     2}, //  13
};

STDROMPICKEXT(mslug5b, mslug5b, neogeo);
STD_ROM_FN(mslug5b);

static void mslug5b_decrypt()
{
// Patch out protections
mslug5_patch();

// Swap 3rd & 4th MB
unsigned char* src = Neo68KROM01+0x200000;
unsigned char* dst = (unsigned char*)malloc(0x200000);
memcpy(dst+0x000000, src+0x100000, 0x100000);
memcpy(dst+0x100000, src+0x000000, 0x100000);
memcpy(src+0x000000, dst+0x000000, 0x200000);
free(dst);
}

static int mslug5bInit()
{
pNeoInitCallback=mslug5b_decrypt; // Remove Protections
nNeoTextROMSize = 0x020000;
return NeoInit();
}

struct BurnDriver BurnDrvmslug5b = {

{"mslug5b", "Metal Slug 5 (Bootleg)", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_GAME_WORKING | BDF_BOOTLEG | BDF_CLONE, 2, HARDWARE_SNK_NEOGEO,
NULL, mslug5bRomInfo, mslug5bRomName, neogeoInputInfo, neogeoDIPInfo,
mslug5bInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};

For ms5plus, make sure you have Ferchogtx's nNeoTextROMFixType code in your build.  Otherwise, you'll get an error when compiling. (I'll link to the code when it's posted again)

Code: [Select]

// Metal Slug 5 (Plus)

static struct BurnRomInfo ms5plusRomDesc[] = {
{"268-p1p.bin", 0x100000, 0x106B276F, 0x10}, //  0 68K code // protected
{"268-p2p.bin", 0x200000, 0xD6A458E8, 0x10}, //  1
{"268-p3p.bin", 0x200000, 0x439EC031, 0x10}, //  2

{"268-s1p.bin", 0x020000, 0x21E04432, 1}, //  3 Text data

{"268-c1.bin", 0x800000, 0x27d59de8,     1}, //  4 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1,     1}, //  5
{"268-c3.bin", 0x800000, 0xb650f098,     1}, //  6
{"268-c4.bin", 0x800000, 0x10499589,     1}, //  7
{"268-c5.bin", 0x800000, 0x19352405,     1}, //  8
{"268-c6.bin", 0x800000, 0xb1531523,     1}, //  9
{"268-c7.bin", 0x800000, 0xfe2c1338,     1}, //  10
{"268-c8.bin", 0x800000, 0xecce3141,     1}, //  11

{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, //  12 Decrypted Z80 code

{"268-v1.bin", 0x800000, 0x14848c5c,     2}, //  13 Sound data
{"268-v2.bin", 0x800000, 0x696cce3b,     2}, //  14
};

STDROMPICKEXT(ms5plus, ms5plus, neogeo);
STD_ROM_FN(ms5plus);

static void ms5plus_patch()
{
// Driver by IQ_132 - http://neosource.1emu.net/
// Patch out protections (Thanks to HappyASR)
*((unsigned short*)(Neo68KROM01 + 0xF0A02)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0xF0A08)) = 0x4E75;
*((unsigned short*)(Neo68KROM01 + 0xF1004)) = 0xE85F;
*((unsigned short*)(Neo68KROM01 + 0xF1006)) = 0x5307;
*((unsigned short*)(Neo68KROM01 + 0xF1008)) = 0x33C7;
*((unsigned short*)(Neo68KROM01 + 0xF100A)) = 0x002F;
*((unsigned short*)(Neo68KROM01 + 0xF100C)) = 0xFFF0;
*((unsigned short*)(Neo68KROM01 + 0xF100E)) = 0x4E75;

// Reload last 2 roms (fixes FBA load problem)
BurnLoadRom(Neo68KROM01+0x100000, 1, 0);
BurnLoadRom(Neo68KROM01+0x300000, 2, 0);
}

static int ms5plusInit()
{
pNeoInitCallback=ms5plus_patch;
nNeoTextROMFixType=1;
nNeoProtectionXor = 0x19;
return NeoInit();
}

struct BurnDriver BurnDrvms5plus = {

{"ms5plus", "Metal Slug 5 (Plus)", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_GAME_WORKING | BDF_CLONE, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, ms5plusRomInfo, ms5plusRomName, neogeoInputInfo, neogeoDIPInfo,
ms5plusInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};

[iq_132]

Also, here's... sort of a fix for ms5plus in AES mode.

in neo_run.cpp find this:

Code: [Select]

if (pNeoInitCallback) {
pNeoInitCallback();
}

Add this after:

Code: [Select]

if ((((NeoSystem & 0x07) ^ 4) == 0x06) && (!strcmp(BurnDrvText(0), "ms5plus")))
{
*((unsigned short*)(Neo68KROM01 + 0x264)) = 0x33C7;
*((unsigned short*)(Neo68KROM01 + 0x266)) = 0x002F;
*((unsigned short*)(Neo68KROM01 + 0x268)) = 0xFFF0;
*((unsigned short*)(Neo68KROM01 + 0x26A)) = 0x5247;
*((unsigned short*)(Neo68KROM01 + 0x26C)) = 0xE14F;
*((unsigned short*)(Neo68KROM01 + 0x270)) = 0x4E71;
*((unsigned short*)(Neo68KROM01 + 0x272)) = 0x4E71;
*((unsigned short*)(Neo68KROM01 + 0x274)) = 0x4E71;
}

I'll admit, it's a cheap hack, but it works.  (Note that you have to reload (not reset) the game after you load it first and change the dip to AES mode.)

[NJ7]

yeah, it's cheap and totally removes the plus in AES mode, but it's still better than disabling it completely I guess....

[iq_132]

Here's an updated, shortened, and untested version.

Code: [Select]

static void mslug5_patch() // Code by IQ_132 - Thanks to HappyASR for the info
{
for (int i = 0; i < 0x20000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 0)) == 0x33FC)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0)
{
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
}
if (*((unsigned short*)(Neo68KROM01 + i + 0 )) == 0x5247)
{
if (*((unsigned short*)(Neo68KROM01 + i + 4 )) == 0xe94f)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
}
}
}
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
}

[iq_132]

well, I got it even shorter!!

Code: [Select]

static void mslug5_patch() // Code by IQ_132 - Thanks to HappyASR for the info
{
for (int i = 0; i < 0x20000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0)
{
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
if (*((unsigned short*)(Neo68KROM01 + i)) == 0x5247)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
}
}
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
}

[CaptainCPS]

Cool!..Im gonna Update Now ^^

Good job!

SeeYaa!!
:):):)

[CaptainCPS]

Well here I post the code for the 'nNeoTextROMFixType' required by the
ms5plus Driver...

» Open neo_run.cpp

Find:

Code: [Select]

static int nSRAMProtAddress;
int nNeoSRAMProtection = -1;
Add After:

Code: [Select]

int nNeoTextROMFixType = 0; // Text fix for games that have TextBankswitch

Find:

Code: [Select]

if (pInfo->nTextOffset != -1) {
// Load S ROM data
BurnLoadRom(NeoTextROM + 0x020000, pInfo->nTextOffset, 1);
Add After:

Code: [Select]

/* Original code for MAME by fataku */
if (nNeoTextROMFixType == 1) {
       unsigned char* srom = NeoTextROM+0x20000;
       for (int i=0;i<0x20000;i++) {
        srom[i]=BITSWAP08(srom[i],3,2,4,5,1,6,0,7);
       }
}
/* Original code from mame traduced by FerchogtX */
if (nNeoTextROMFixType == 2) {
/* Descrambling S1 by FerchogtX, bassed on DorriGa's code */
unsigned char* srom = NeoTextROM+0x20000;
unsigned char* dst = (unsigned char*)malloc(0x20000);
memcpy( dst+0x00000, srom+0x10000, 0x10000 );
memcpy( dst+0x10000, srom+0x00000, 0x10000 );
memcpy( srom, dst, 0x20000 );
free(dst);
}
/* Thanks also to HappyASR for the info */
if (nNeoTextROMFixType == 3) {
unsigned char* srom = NeoTextROM+0x20000;
unsigned char* dst = (unsigned char*)malloc(0x20000);
if (dst)
{
memcpy(dst,srom,0x20000);
// descrambling the S1 by dorriGa
for (int j=0;j<0x20000 ; j+=0x000010)
{
memcpy(srom+j, dst+j+0x000008,8);
memcpy(srom+j+0x000008, dst+j,8);
}
}
free(dst);
}
/* Thanks to Badzou for the info */
if (nNeoTextROMFixType == 4) {
/* Descrambling S1 by dorriga */
unsigned char* srom = NeoTextROM+0x20000;
unsigned char* dst = (unsigned char*)malloc(0x80000);
memcpy( dst+0x00000, srom+0x60000, 0x20000 );
memcpy( dst+0x20000, srom+0x40000, 0x20000 );
memcpy( dst+0x40000, srom+0x20000, 0x20000 );
memcpy( dst+0x60000, srom+0x00000, 0x20000 );
memcpy( srom, dst, 0x80000 );
free(dst);
}
*EDIT* (code to edit in neogeo.h )

» Open neogeo.h

Find:

Code: [Select]

// neo_run.cpp
Add After:

Code: [Select]

extern int nNeoTextROMFixType;
EDIT 2* (ThanX To FerchogtX for the correction )

» In neo_run.cpp

Find:

Code: [Select]

#include "burn_ym2610.h"
Add After:

Code: [Select]

#include "bitswap.h"

That's All! ^^....I hope this help

SeeYaa!! Saludos!!!
:):):)

PD: If you find any error in the code posted here please post it so it
can be fixed

[FerchogtX]

Add at the top of the file this (fir the case 1)
#include "bitswap.h"
See ya!!!!!

[CaptainCPS]

If you use the 'nNeoTextROMFixType' code in the previous post,
you should update the 'ms5plus' driver with this...

»In d_neogeo.cpp

Find:

Code: [Select]

static int ms5plusInit()
{
pNeoInitCallback=ms5plus_patch;
nNeoTextROMFixType=1;
nNeoProtectionXor = 0x19;
return NeoInit();
}
Replace with:

Code: [Select]

static int ms5plusInit()
{
pNeoInitCallback=ms5plus_patch;
nNeoTextROMFixType=3;
nNeoProtectionXor = 0x19;
return NeoInit();
}
That's it ..the Text Layers should be fine with this now ^^

SeeYaa!!!Saludos!!!
:):):)

[iq_132]

Woohoo!! I got P rom interleaving working!! I'll have mslug5 working within an hour

*edit*
I was wrong... less time than that

Code: [Select]

// Metal Slug 5

static struct BurnRomInfo mslug5RomDesc[] = {
{"268-p1.bin", 0x400000, 0xd0466792,  0x10}, //  0 68K code
{"268-p2.bin", 0x400000, 0xfbf6b61e,  0x10}, //  1

{"268-c1.bin", 0x800000, 0x27d59de8,     1}, //  2 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1,     1}, //  3
{"268-c3.bin", 0x800000, 0xb650f098,     1}, //  4
{"268-c4.bin", 0x800000, 0x10499589,     1}, //  5
{"268-c5.bin", 0x800000, 0x19352405,     1}, //  6
{"268-c6.bin", 0x800000, 0xb1531523,     1}, //  7
{"268-c7.bin", 0x800000, 0xfe2c1338,     1}, //  8
{"268-c8.bin", 0x800000, 0xecce3141,     1}, //  9

{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, //  10 Z80 code
// {"268-m1.bin",  0x040000, 0x88c11f51, 0x10}, //  10

// {"268-v1.bin",  0x800000, 0x33c6305c,    2}, //  11 Sound data
// {"268-v2.bin",  0x800000, 0x1afb848e,    2}, //  12
{"268-v1d.bin", 0x800000, 0x14848c5c,    2}, //  11
{"268-v2d.bin", 0x800000, 0x696cce3b,    2}, //  12
};

STDROMPICKEXT(mslug5, mslug5, neogeo);
STD_ROM_FN(mslug5);

// This patches out the bankswitch protection
// Code by IQ_132 - Thanks to HappyASR for the info
static void mslug5_patch()
{
for (int i = 0; i < 0x20000; i=i+2)
{
if (*((unsigned short*)(Neo68KROM01 + i + 6)) == 0xfff0)
{
for (int j = i; j < (i+8); j=j+2)
{
*((unsigned short*)(Neo68KROM01 + j)) = 0x4e71;
}
}
if (*((unsigned short*)(Neo68KROM01 + i)) == 0x5247)
{
*((unsigned short*)(Neo68KROM01 + i + 0 )) = 0x33c7;
*((unsigned short*)(Neo68KROM01 + i + 2 )) = 0x002f;
*((unsigned short*)(Neo68KROM01 + i + 4 )) = 0xfff0;
}
}
*((unsigned short*)(Neo68KROM01 + 0x18430)) = 0x0001;
*((unsigned short*)(Neo68KROM01 + 0x0122A)) = 0x4e71; // AES Patch
*((unsigned short*)(Neo68KROM01 + 0x0122C)) = 0x4e71; // AES Patch
}

// Code by iq_132 -- http://neosource.1emu.net/
static void interleave_pdata()
{
int j=0,i;
unsigned char* src = Neo68KROM01;
unsigned char* dst = (unsigned char*)malloc(0x800000);
for (i=0;i<0x800000;i=i+4){
dst[i+0]=src[j];
dst[i+1]=src[j+1];
dst[i+2]=src[j+0x400000];
dst[i+3]=src[j+0x400001];
j=j+2;
}
memcpy(Neo68KROM01,dst,0x800000);
free(dst);
}

// Original code by(?) HalRIN -- http://www52.tok2.com/home/foge/
// Converted to FBA code by iq_132 -- http://neosource.1emu.net/
static void mslug5_px_decrypt()
{
interleave_pdata();

const unsigned char xor1[ 0x20 ] = {
0xc2, 0x4b, 0x74, 0xfd, 0x0b, 0x34, 0xeb, 0xd7, 0x10, 0x6d, 0xf9, 0xce, 0x5d, 0xd5, 0x61, 0x29,
0xf5, 0xbe, 0x0d, 0x82, 0x72, 0x45, 0x0f, 0x24, 0xb3, 0x34, 0x1b, 0x99, 0xea, 0x09, 0xf3, 0x03,
};

const unsigned char xor2[ 0x20 ] = {
0x36, 0x09, 0xb0, 0x64, 0x95, 0x0f, 0x90, 0x42, 0x6e, 0x0f, 0x30, 0xf6, 0xe5, 0x08, 0x30, 0x64,
0x08, 0x04, 0x00, 0x2f, 0x72, 0x09, 0xa0, 0x13, 0xc9, 0x0b, 0xa0, 0x3e, 0xc2, 0x00, 0x40, 0x2b,
};

int i;
unsigned char *rom, *buf;
int ofst;

rom = Neo68KROM01;

for( i = 0; i < 0x100000; i++ ){
rom[ i ] ^= xor1[ (i % 0x20) ];
}

for( i = 0x100000; i < 0x800000; i++ ){
rom[ i ] ^= xor2[ (i % 0x20) ];
}

for( i = 0x100000; i < 0x0800000; i += 4 ){
UINT16 *rom16 = (UINT16*)&rom[ i + 1 ];
*rom16 = BITSWAP16( *rom16, 15, 14, 13, 12, 10, 11, 8, 9, 6, 7, 4, 5, 3, 2, 1, 0 );
}

buf = (unsigned char*)malloc( 0x800000 );
memcpy( buf, rom, 0x800000 );

for( i = 0; i < 0x0100000 / 0x10000; i++ ){
ofst = (i & 0xf0) + BITSWAP08( (i & 0x0f), 7, 6, 5, 4, 1, 0, 3, 2 );
memcpy( &rom[ i * 0x10000 ], &buf[ ofst * 0x10000 ], 0x10000 );
}

for( i = 0x100000; i < 0x800000; i += 0x100 ){
ofst = (i & 0xf000ff) +
  ((i & 0x000f00) ^ 0x00700) +
  (BITSWAP08( ((i & 0x0ff000) >> 12), 5, 4, 7, 6, 1, 0, 3, 2 ) << 12);

memcpy( &rom[ i ], &buf[ ofst ], 0x100 );
}
free( buf );

mslug5_patch();
}

static int mslug5Init()
{
pNeoInitCallback=mslug5_px_decrypt;
nNeoProtectionXor = 0x19;
return NeoInit();
}

struct BurnDriver BurnDrvmslug5 = {

{"mslug5", "Metal Slug 5", NULL, "SNK Playmore Corporation", "Neo Geo", "2003", NULL, "neogeo"},
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, mslug5RomInfo, mslug5RomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};

[CaptainCPS]

ThanX Man!!! IQ_132 Rules!! xDD (My SRC is updated now with the new
code )..my ThanX to you are in comment in the code too

SeeYaa!!!Saludos!!!
:):):)

[FerchogtX]

Ok, here an attempt to translate the MAME code into FBA one... THis doesn't work properly, I think that the PCV chip is working but the bankswitch needs the read/writeByte handlers in order to work properly... here what i have...

Code: [Select]

// Metal Slug 5

static struct BurnRomInfo mslug5RomDesc[] = {
/* Original code, has PCB Protection */
{"268-p1.bin", 0x400000, 0xd0466792, 0x10}, //  0 68K code (encrypted)
{"268-p2.bin", 0x400000, 0xfbf6b61e, 0x10}, //  1

{"268-c1.bin", 0x800000, 0x27d59de8,    1}, //  1 Sprite data
{"268-c2.bin", 0x800000, 0xe600dee1,    1}, //  2
{"268-c3.bin", 0x800000, 0xb650f098,    1}, //  3
{"268-c4.bin", 0x800000, 0x10499589,    1}, //  4
{"268-c5.bin", 0x800000, 0x19352405,    1}, //  5
{"268-c6.bin", 0x800000, 0xb1531523,    1}, //  6
{"268-c7.bin", 0x800000, 0xfe2c1338,    1}, //  7
{"268-c8.bin", 0x800000, 0xecce3141,    1}, //  8

{"268-m1d.bin",0x040000, 0x6866d696, 0x10}, //  9 Z80 code (decrypted)
{"268-m1.bin", 0x040000, 0x88c11f51, 0x10}, // 10 Z80 code (encrypted)

/* Decrypted roms */
{"268-v1d.bin",0x800000, 0x14848c5c,    2}, // 11 Sound data
{"268-v2d.bin",0x800000, 0x696cce3b,    2}, // 12
/* Encrypted Vx roms, disabled by now */
// {"268-v1.bin", 0x800000, 0x33c6305c,    2}, // 13 Sound data (encrypted) /* kawaks dev dump */
// {"268-v2.bin", 0x800000, 0x1afb848e,    2}, // 14
};

STDROMPICKEXT(mslug5, mslug5, neogeo);
STD_ROM_FN(mslug5);

// Analyzed by HalRIN http://www52.tok2.com/home/foge/
// FBA convertion by FerchogtX
static void mslug5_PVC_Protection()
{
const unsigned char xor1[ 0x20 ] = {
0xc2, 0x4b, 0x74, 0xfd, 0x0b, 0x34, 0xeb, 0xd7, 0x10, 0x6d, 0xf9, 0xce, 0x5d, 0xd5, 0x61, 0x29,
0xf5, 0xbe, 0x0d, 0x82, 0x72, 0x45, 0x0f, 0x24, 0xb3, 0x34, 0x1b, 0x99, 0xea, 0x09, 0xf3, 0x03,
};

const unsigned char xor2[ 0x20 ] = {
0x36, 0x09, 0xb0, 0x64, 0x95, 0x0f, 0x90, 0x42, 0x6e, 0x0f, 0x30, 0xf6, 0xe5, 0x08, 0x30, 0x64,
0x08, 0x04, 0x00, 0x2f, 0x72, 0x09, 0xa0, 0x13, 0xc9, 0x0b, 0xa0, 0x3e, 0xc2, 0x00, 0x40, 0x2b,
};

int i;
unsigned char *rom, *buf;
int ofst;

rom = Neo68KROM01;

for( i = 0; i < 0x100000; i++ ){
rom[ i ] ^= xor1[ (i % 0x20) ];
}

for( i = 0x100000; i < 0x800000; i++ ){
rom[ i ] ^= xor2[ (i % 0x20) ];
}

for( i = 0x100000; i < 0x0800000; i += 4 ){
unsigned short *rom16 = (unsigned short*)&rom[ i + 1 ];
*rom16 = BITSWAP16( *rom16, 15, 14, 13, 12, 10, 11, 8, 9, 6, 7, 4, 5, 3, 2, 1, 0 );
}

buf = (unsigned char*)malloc( 0x800000 );
memcpy( buf, rom, 0x800000 );

for( i = 0; i < 0x0100000 / 0x10000; i++ ){
ofst = (i & 0xf0) + BITSWAP08( (i & 0x0f), 7, 6, 5, 4, 1, 0, 3, 2 );
memcpy( &rom[ i * 0x10000 ], &buf[ ofst * 0x10000 ], 0x10000 );
}

for( i = 0x100000; i < 0x800000; i += 0x100 ){
ofst = (i & 0xf000ff) +
  ((i & 0x000f00) ^ 0x00700) +
  (BITSWAP08( ((i & 0x0ff000) >> 12), 5, 4, 7, 6, 1, 0, 3, 2 ) << 12);

memcpy( &rom[ i ], &buf[ ofst ], 0x100 );
}

free( buf );

buf = (unsigned char*)malloc( 0x800000 );
memcpy( buf, rom, 0x800000 );
memcpy( &rom[ 0x100000 ], &buf[ 0x700000 ], 0x100000 );
memcpy( &rom[ 0x200000 ], &buf[ 0x100000 ], 0x600000 );
free( buf );
}

static unsigned short mv0_bankswitch_offset[ 2 ];
static int mv0_bankswitch_flg;

static unsigned short __fastcall ReadWord_mv0_bankswitch(unsigned int sekAddress)
{
unsigned short wordValue;
if( mv0_bankswitch_offset[ 0 ] == 0xffff && mv0_bankswitch_offset[ 1 ] == 0xffff ){

mv0_bankswitch_flg = 1;
if( sekAddress == 0 ){
return 0xfea0;
}else if( sekAddress == 1 ){
return 0x7fff;
}else{
return mv0_bankswitch_offset[ wordValue ];
}
}else if( mv0_bankswitch_offset[ 0 ] == 0x0000 && mv0_bankswitch_offset[ 1 ] == 0x0000 && mv0_bankswitch_flg == 1 ){

if( sekAddress == 0 ){
return 0x00a0;
}else if( sekAddress == 1 ){
mv0_bankswitch_flg = 0;
return 0x0000;
}else{
return mv0_bankswitch_offset[ wordValue ];
}
}else{
return mv0_bankswitch_offset[ wordValue ];
}
}

static void ms5WriteBankswitch(unsigned int sekAddress,unsigned short wordValue,unsigned short valueMask)
{
mv0_bankswitch_offset[wordValue]=
(mv0_bankswitch_offset[wordValue]&valueMask) | ((~valueMask)&mv0_bankswitch_offset[wordValue]);

sekAddress = (mv0_bankswitch_offset[ 0 ] >> 8)+(mv0_bankswitch_offset[ 1 ] << 8)+0x100000;
SekMapMemory(Neo68KROM02 + sekAddress, 0x200000, 0x2FFFFF, SM_ROM);
}

void __fastcall WriteWord_mv0_bankswitch(unsigned int sekAddress,unsigned short wordValue)
{
unsigned short valueMask=0xffff;
ms5WriteBankswitch(sekAddress,wordValue,valueMask);
}

static void mslug5MapHandler()
{
// Install BankSwitch handler
SekMapHandler(5, 0x2ffff0, 0x2ffff3, SM_READ);
SekSetReadWordHandler(5,  ReadWord_mv0_bankswitch);

SekMapHandler(5, 0x2ffff0, 0x2ffff3, SM_WRITE);
SekSetWriteWordHandler(5, WriteWord_mv0_bankswitch);
}

static int mslug5Init()
{
int nRet;

pNeoInitCallback = mslug5_PVC_Protection;
nNeoProtectionXor = 0x19;

nRet = NeoInit();
if (!nRet){
mslug5MapHandler();
}
return nRet;
}

struct BurnDriver BurnDrvmslug5 = {
{"mslug5", "Metal Slug 5", "Neo-PVC protection not emulated yet", "SNK Playmore", "Neo Geo", "2003", NULL, "neogeo"},
BDF_LOCKED, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B,
NULL, mslug5RomInfo, mslug5RomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};

// Metal Slug 5 (decrypted C & V)

static struct BurnRomInfo mslug5ndRomDesc[] = {
/* Original code, has PCB Protection */
{"268-p1.bin",  0x400000, 0xd0466792, 0x10}, //  0 68K code (encrypted)
{"268-p2.bin",  0x400000, 0xfbf6b61e, 0x10}, //  1

{"ms5n_c1.rom", 0x800000, 0x969C0D62,    1}, //  2 Sprite data
{"ms5n_c2.rom", 0x800000, 0xC69AE867,    1}, //  3
{"ms5n_c3.rom", 0x800000, 0xD7BEAEAF,    1}, //  4
{"ms5n_c4.rom", 0x800000, 0x899fb2af,    1}, //  5
{"ms5n_c5.rom", 0x800000, 0x2FA1A5AD,    1}, //  6
{"ms5n_c6.rom", 0x800000, 0x6DE89589,    1}, //  7
{"ms5n_c7.rom", 0x800000, 0x97BD0C0A,    1}, //  8
{"ms5n_c8.rom", 0x800000, 0xC0D5BC20,    1}, //  9

{"268-m1d.bin", 0x040000, 0x6866d696, 0x10}, //  10 Z80 code

{"268-v1d.bin", 0x800000, 0x14848c5c,    2}, // 11 Sound data
{"268-v2d.bin", 0x800000, 0x696cce3b,    2}, // 12
};

STDROMPICKEXT(mslug5nd, mslug5nd, neogeo);
STD_ROM_FN(mslug5nd);

struct BurnDriver BurnDrvmslug5nd = {
{"mslug5nd", "Metal Slug 5 (decrypted C & V)", "Decrypted C-ROMs", "SNK Playmore", "Neo Geo", "2003", "mslug5", "neogeo"},
BDF_CLONE | BDF_LOCKED, 2, HARDWARE_SNK_NEOGEO,
NULL, mslug5ndRomInfo, mslug5ndRomName, neogeoInputInfo, neogeoDIPInfo,
mslug5Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};Just for reference...
See ya!!!!!!

[iq_132]

lol, check the page before this with a working mslug5 (with neo_pvc protection) driver

[FerchogtX]

XD i didn't notice that you added a working driver already... Forget this stuff XD
See ya!!!!!!
P.D. I'm blind this last times XD

[FerchogtX]

Well, I tested the driver, boots prefectly in MVS mode, but AES has a loop and doesn't boot... is something related either with the NeoPVC or the bankswitch patch?
I'll try with another versions of you ms5patch code... but i report this to you just if you want to fix it
See ya!!!!!