Author Topic: Metal Slug 5 emulation infos  (Read 4867 times)

Offline X-or

  • Newbies
  • *
  • Posts: 38
  • Karma: +0/-0
Metal Slug 5 emulation infos
« on: October 31, 2004, 06:53:42 PM »
Hello :)
I'm back from monthes of retirement (schoolwork, holidays) and i'm going to compile 1st build for ages
I wonder what progress were made in emulation code of metal slug 5
does it still need those decrypted p-roms?
I may open other thread like this one about other major neogeo release to gather all emulation code available
waiting for your replies....

driver\neogeo.c
Code: [Select]
ROM_START( mslug5 ) /* Original Version - Encrypted */
/* Encrypted */
ROM_REGION( 0x800000, REGION_CPU1, 0 )
ROM_LOAD( "268-p1.bin", 0x000000, 0x400000, CRC(d0466792) SHA1(880819933d997fab398f91061e9dbccb959ae8a1) )
ROM_LOAD( "268-p2.bin", 0x400000, 0x400000, CRC(fbf6b61e) SHA1(9ec743d5988b5e3183f37f8edf45c72a8c0c893e) )

ROM_REGION( 0x20000, REGION_GFX1, 0 )
ROM_FILL(      0x000000, 0x20000, 0 )
ROM_REGION( 0x20000, REGION_GFX2, 0 )
ROM_LOAD( "sfix.sfx",  0x000000, 0x20000, CRC(354029fc) SHA1(4ae4bf23b4c2acff875775d4cbff5583893ce2a1) )

/* The M1 ROM is encrypted, we load it here for reference and replace it with a decrypted version */
ROM_REGION( 0x40000, REGION_USER4, 0 )
ROM_LOAD_OPTIONAL( "268-m1.bin", 0x00000, 0x40000, CRC(88c11f51) SHA1(5592819be64b69ab361d3b6b139fc68d8cabd29d) )
NEO_BIOS_SOUND_256K( "268-m1d.bin", CRC(6866d696) SHA1(3638b072e44277a6bffea5a78a915a14c6afcba0) )

/* Encrypted, we load these here for reference and replace with decrypted ROMs */
ROM_REGION( 0x1000000, REGION_SOUND1, ROMREGION_SOUNDONLY )
ROM_LOAD_OPTIONAL( "268-v1.bin", 0x000000, 0x800000, CRC(33c6305c) SHA1(67fce35a62941d2dcec75f0e6319677d6df7a4dc) )
ROM_LOAD_OPTIONAL( "268-v2.bin", 0x800000, 0x800000, CRC(1afb848e) SHA1(368e950043deebc91f7b38be770fa1045a0153af) )
ROM_LOAD( "268-v1d.bin", 0x000000, 0x800000, CRC(14848c5c) SHA1(8f67daa54738f8b217cce1f1d0a7872fd06d91b6) )
ROM_LOAD( "268-v2d.bin", 0x800000, 0x800000, CRC(696cce3b) SHA1(538d4a25befa4ffd25a48df97380469c13980f7a) )

NO_DELTAT_REGION

/* Encrypted */
ROM_REGION( 0x4000000, REGION_GFX3, 0 )
ROM_LOAD16_BYTE( "268-c1.bin", 0x0000000, 0x800000, CRC(27d59de8) SHA1(0447a675d885721cedc079788cf41ae3f797834b) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c2.bin", 0x0000001, 0x800000, CRC(e600dee1) SHA1(e55e5a25616c4daf09692d1b53a92d6f31e842ac) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c3.bin", 0x1000000, 0x800000, CRC(b650f098) SHA1(4cd729153bd5b2054fbe10c96d2bb370084d1d24) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c4.bin", 0x1000001, 0x800000, CRC(10499589) SHA1(24542a3b70080e5a61fdab04ab314450a1d821ef) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c5.bin", 0x2000000, 0x800000, CRC(19352405) SHA1(5ee255403739c11a65608dcff0984480f067d824) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c6.bin", 0x2000001, 0x800000, CRC(b1531523) SHA1(786f342dbb7fea50139d6421e5b82e551772bf0a) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c7.bin", 0x3000000, 0x800000, CRC(fe2c1338) SHA1(de9d257574881dd1684956f60011a20c1dd5a0d9) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c8.bin", 0x3000001, 0x800000, CRC(ecce3141) SHA1(103247b57f8ea5746dd1cf92dda95a6dc9268c78) ) /* Plane 2,3 */
ROM_END

ROM_START( mslug5n ) /* Encryted GFX and Sounds */
ROM_REGION( 0x500000, REGION_CPU1, 0 )
ROM_LOAD16_WORD_SWAP( "268-p1n.bin", 0x000000, 0x100000, CRC(e6d297af) SHA1(5bb3f72ce26e3f46c523b955f425056eb246e855) )
ROM_LOAD16_WORD_SWAP( "268-p2n.bin", 0x100000, 0x400000, CRC(84def63e) SHA1(fddd68e8879d6f5c1aac42997ff2245ea54d5869) )

ROM_REGION( 0x20000, REGION_GFX1, 0 )
ROM_FILL(      0x000000, 0x20000, 0 )
ROM_REGION( 0x20000, REGION_GFX2, 0 )
ROM_LOAD( "sfix.sfx",  0x000000, 0x20000, CRC(354029fc) SHA1(4ae4bf23b4c2acff875775d4cbff5583893ce2a1) )

/* The M1 ROM is encrypted, we load it here for reference and replace it with a decrypted version */
ROM_REGION( 0x40000, REGION_USER4, 0 )
ROM_LOAD_OPTIONAL( "268-m1.bin", 0x00000, 0x40000, CRC(88c11f51) SHA1(5592819be64b69ab361d3b6b139fc68d8cabd29d) )
NEO_BIOS_SOUND_256K( "268-m1d.bin", CRC(6866d696) SHA1(3638b072e44277a6bffea5a78a915a14c6afcba0) )

/* Encrypted, we load these here for reference and replace with decrypted ROMs */
ROM_REGION( 0x1000000, REGION_SOUND1, ROMREGION_SOUNDONLY )
ROM_LOAD_OPTIONAL( "268-v1.bin", 0x000000, 0x800000, CRC(33c6305c) SHA1(67fce35a62941d2dcec75f0e6319677d6df7a4dc) )
ROM_LOAD_OPTIONAL( "268-v2.bin", 0x800000, 0x800000, CRC(1afb848e) SHA1(368e950043deebc91f7b38be770fa1045a0153af) )
ROM_LOAD( "268-v1d.bin", 0x000000, 0x800000, CRC(14848c5c) SHA1(8f67daa54738f8b217cce1f1d0a7872fd06d91b6) )
ROM_LOAD( "268-v2d.bin", 0x800000, 0x800000, CRC(696cce3b) SHA1(538d4a25befa4ffd25a48df97380469c13980f7a) )

NO_DELTAT_REGION

/* Encrypted */
ROM_REGION( 0x4000000, REGION_GFX3, 0 )
ROM_LOAD16_BYTE( "268-c1.bin", 0x0000000, 0x800000, CRC(27d59de8) SHA1(0447a675d885721cedc079788cf41ae3f797834b) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c2.bin", 0x0000001, 0x800000, CRC(e600dee1) SHA1(e55e5a25616c4daf09692d1b53a92d6f31e842ac) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c3.bin", 0x1000000, 0x800000, CRC(b650f098) SHA1(4cd729153bd5b2054fbe10c96d2bb370084d1d24) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c4.bin", 0x1000001, 0x800000, CRC(10499589) SHA1(24542a3b70080e5a61fdab04ab314450a1d821ef) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c5.bin", 0x2000000, 0x800000, CRC(19352405) SHA1(5ee255403739c11a65608dcff0984480f067d824) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c6.bin", 0x2000001, 0x800000, CRC(b1531523) SHA1(786f342dbb7fea50139d6421e5b82e551772bf0a) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c7.bin", 0x3000000, 0x800000, CRC(fe2c1338) SHA1(de9d257574881dd1684956f60011a20c1dd5a0d9) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c8.bin", 0x3000001, 0x800000, CRC(ecce3141) SHA1(103247b57f8ea5746dd1cf92dda95a6dc9268c78) ) /* Plane 2,3 */
ROM_END

ROM_START( ms5plus ) /* This is a korean bootlegged hack of mslug5 */
/* Encrypted */
ROM_REGION( 0x500000, REGION_CPU1, 0 )
ROM_LOAD16_WORD_SWAP( "268-p1p.bin", 0x000000, 0x100000, CRC(106b276f) SHA1(0e840df95f3813145e5043573483c7610d2d3e68) )
ROM_LOAD16_WORD_SWAP( "268-p2p.bin", 0x100000, 0x200000, CRC(d6a458e8) SHA1(c0a8bdae06d62859fb6734766ccc190eb2a809a4) )
ROM_LOAD16_WORD_SWAP( "268-p3p.bin", 0x300000, 0x200000, CRC(439ec031) SHA1(f0ad8f9be7d26bc504593c1321bd23c286a221f0) )

NEO_SFIX_128K( "268-s1p.bin", CRC(21e04432) SHA1(10057a2aa487087f7143d1d69fdad978a6bef0f7) )

/* Decrypted */
ROM_REGION( 0x40000, REGION_USER4, 0 )
NEO_BIOS_SOUND_256K( "268-m1d.bin", CRC(6866d696) SHA1(3638b072e44277a6bffea5a78a915a14c6afcba0) )

/* Decrypted */
ROM_REGION( 0x1000000, REGION_SOUND1, ROMREGION_SOUNDONLY )
ROM_LOAD( "268-v1d.bin", 0x000000, 0x800000, CRC(14848c5c) SHA1(8f67daa54738f8b217cce1f1d0a7872fd06d91b6) )
ROM_LOAD( "268-v2d.bin", 0x800000, 0x800000, CRC(696cce3b) SHA1(538d4a25befa4ffd25a48df97380469c13980f7a) )
NO_DELTAT_REGION

/* Encrypted */
ROM_REGION( 0x4000000, REGION_GFX3, 0 )
ROM_LOAD16_BYTE( "268-c1.bin", 0x0000000, 0x800000, CRC(27d59de8) SHA1(0447a675d885721cedc079788cf41ae3f797834b) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c2.bin", 0x0000001, 0x800000, CRC(e600dee1) SHA1(e55e5a25616c4daf09692d1b53a92d6f31e842ac) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c3.bin", 0x1000000, 0x800000, CRC(b650f098) SHA1(4cd729153bd5b2054fbe10c96d2bb370084d1d24) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c4.bin", 0x1000001, 0x800000, CRC(10499589) SHA1(24542a3b70080e5a61fdab04ab314450a1d821ef) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c5.bin", 0x2000000, 0x800000, CRC(19352405) SHA1(5ee255403739c11a65608dcff0984480f067d824) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c6.bin", 0x2000001, 0x800000, CRC(b1531523) SHA1(786f342dbb7fea50139d6421e5b82e551772bf0a) ) /* Plane 2,3 */
ROM_LOAD16_BYTE( "268-c7.bin", 0x3000000, 0x800000, CRC(fe2c1338) SHA1(de9d257574881dd1684956f60011a20c1dd5a0d9) ) /* Plane 0,1 */
ROM_LOAD16_BYTE( "268-c8.bin", 0x3000001, 0x800000, CRC(ecce3141) SHA1(103247b57f8ea5746dd1cf92dda95a6dc9268c78) ) /* Plane 2,3 */
ROM_END

DRIVER_INIT( mslug5n )
{
/* the S data comes from the end of the C data */
{
int i;
int tx_size = memory_region_length(REGION_GFX1);
int rom_size = memory_region_length(REGION_GFX3);

UINT8 *src = memory_region(REGION_GFX3)+rom_size-tx_size;
UINT8 *dst = memory_region(REGION_GFX1);

for (i = 0;i < tx_size;i++)
dst[i] = src[(i & ~0x1f) + ((i & 7) << 2) + ((~i & 8) >> 2) + ((i & 0x10) >> 4)];
}
neogeo_fix_bank_type = 1;
kof2000_neogeo_gfx_decrypt(0x19);
init_neogeo();
}

DRIVER_INIT ( ms5plus )
{
/* Descrambling S1 by dorriga */
int j;
UINT8 *s1 = (memory_region(REGION_GFX1));
UINT8 *dst = malloc(0x20000);
if ( dst )
{
memcpy(dst,s1,0x20000);
for (j=0;j<0x20000 ; j+=0x000010)
{
memcpy( s1+j, dst+j+0x000008,8);
memcpy( s1+j+0x000008, dst+j,8);
}
}
free( dst );
neogeo_fix_bank_type = 1;
kof2000_neogeo_gfx_decrypt(0x19);
init_neogeo();
}

GAMEBX( 2003, mslug5,   neogeo,   neogeo, neogeo, neogeo,  mslug5,   ROT0, "SNK Playmore Corporation", "Metal Slug 5", GAME_NOT_WORKING )
GAMEB( 2003, mslug5n,  mslug5,   neogeo, neogeo, neogeo,  mslug5n,  ROT0, "SNK Playmore Corporation", "Metal Slug 5 (not encrypted)" )
GAMEB( 2003, ms5plus,  mslug5,   neogeo, neogeo, neogeo,  ms5plus,  ROT0, "bootleg", "Metal Slug 5 Plus" )

machine\neogeo.c
Code: [Select]
/* mslug5 */
int ms5_bank_offset = 0;

static WRITE16_HANDLER( mslug5_calc_bankoffset_w )
{
ms5_bank_offset = (data>>12)%0x03;
}

static WRITE16_HANDLER( mslug5_bankswitch_w )
{
neogeo_set_cpu1_second_bank( (neogeo_ram16[0x10/2] + ms5_bank_offset) << 20 );
}

static READ16_HANDLER( mslug5_prot_r )
{
logerror("PC %06x: access protected\n",activecpu_get_pc());
return 0xa0;
}

static WRITE16_HANDLER ( mslug5p_bankswitch_w )
{
unsigned char *RAM = memory_region(REGION_CPU1);
int bankaddress;
logerror("offset: %06x PC %06x: set banking %04x\n",offset,activecpu_get_pc(),data);
if ((offset == 0)&&(data == 0xa0))
{
bankaddress=0xa0;
cpu_setbank(4,&RAM[bankaddress]);
//neogeo_set_cpu1_second_bank(bankaddress);
logerror("offset: %06x PC %06x: set banking %04x\n\n",offset,activecpu_get_pc(),bankaddress);
}
else if(offset == 2)
{ data=data>>4;
//data=data&7;
bankaddress=data*0x100000;
cpu_setbank(4,&RAM[bankaddress]);
//neogeo_set_cpu1_second_bank(bankaddress);
logerror("offset: %06x PC %06x: set banking %04x\n\n",offset,activecpu_get_pc(),bankaddress);
}
}

if (!strcmp(Machine->gamedrv->name,"mslug5n"))
{
memory_install_write16_handler(0, ADDRESS_SPACE_PROGRAM, 0x2ffff0, 0x2ffff1, 0, 0, mslug5_bankswitch_w);
memory_install_write16_handler(0, ADDRESS_SPACE_PROGRAM, 0x2ffff2, 0x2ffff3, 0, 0, mslug5_calc_bankoffset_w);
/* Patch out loop to disable console mode */
data16_t *mem16 = (data16_t *)memory_region(REGION_CPU1);
mem16[0x122a >> 1] = 0x4e75;
}

if (!strcmp(Machine->gamedrv->name,"ms5plus") )
{
/* special ROM banking handler */
memory_install_read16_handler(0, ADDRESS_SPACE_PROGRAM, 0x2ffff0, 0x2fffff, 0, 0, mslug5_prot_r);
memory_install_write16_handler(0, ADDRESS_SPACE_PROGRAM, 0x2ffff0, 0x2fffff, 0, 0, mslug5p_bankswitch_w);
}

machine\neocrypt.c
Code: [Select]
/* X-or edit start */
/* the S data comes from the end of the C data */
{
[COLOR=RoyalBlue]if (strcmp(Machine->gamedrv->name,"ms5plus"))[/COLOR]
{
int i;
int tx_size = memory_region_length(REGION_GFX1);
UINT8 *src = memory_region(REGION_GFX3)+rom_size-tx_size;
UINT8 *dst = memory_region(REGION_GFX1);

for (i = 0;i < tx_size;i++)
dst[i] = src[(i & ~0x1f) + ((i & 7) << 2) + ((~i & 8) >> 2) + ((i & 0x10) >> 4)];
}
}
}
/* X-or edit end */
« Last Edit: May 10, 2005, 01:23:17 PM by iq_132 »

Offline FerchogtX

  • FBA Dev
  • ******
  • Posts: 375
  • Karma: +7/-0
  • FB Alpha Team ;)
    • FB Alpha Plus! Web Site
Metal Slug 5 emulation infos
« Reply #1 on: October 31, 2004, 07:21:38 PM »
Well, the Original P-ROMs need the Neo-PVC protection driver in order to be completly emulated, bankswitch is emulated but this still need the mentioned protection.
BTW, there is a bootleg that comes from the Protected P-ROMs that ois emulated :P
See ya!!!!! :D

Good and evil co-exist because of the balance, lies are not part of it...

FB Alpha Plus! site infos updated, see the latest info clicking on my profile link...

Offline iq_132

  • Administrator
  • *****
  • Posts: 3612
  • Karma: +385/-0
  • Bare Knuckle!
    • NeoSource
Metal Slug 5 emulation infos
« Reply #2 on: October 31, 2004, 07:27:55 PM »
Yup. The bootleg P roms are almost the same as the P roms saved from Kawak's Memory, So I'm betting that the bankswitch code for the bootleg P is the same as the original's.
2 parts are swapped, and there's a 2 byte difference.


Offline X-or

  • Newbies
  • *
  • Posts: 38
  • Karma: +0/-0
Metal Slug 5 emulation infos
« Reply #3 on: November 01, 2004, 07:42:07 AM »
I see.... no progress in monthes and the neo pvc code still isn't public
what have you been doing!  :p
I'm going to edit the first post with my last driver
you're welcome to suggest improvements if you know any :)

Offline iq_132

  • Administrator
  • *****
  • Posts: 3612
  • Karma: +385/-0
  • Bare Knuckle!
    • NeoSource
Metal Slug 5 emulation infos
« Reply #4 on: November 10, 2004, 02:35:41 AM »
Here's the MAME version of the mslug5 code I made. (yes, I know there is already code for the bankswitching and such, I'm just sharing because someone may like this solution better.

BTW.  THIS IS NOT FOR THE KAWAKS SET.

It's for this P rom:
"268-p1d.bin", 0x000000, 0x800000, CRC(2ECC772D) ) // Neo-PVC Removed

Code: [Select]
DRIVER_INIT( mslug5 )
{
// Code by IQ_132 - Thanks to HappyASR for the info
data16_t *mem16 = (data16_t *)memory_region(REGION_CPU1);
for (int i = 0; i < 0x100000/2; i++)
{
if ((mem16[i] == 0x33FC) || (mem16[i] == 0x5247))
{
if (mem16[i+3] == 0xfff0)
{
for (int j = i; j < (i+4); j++)
{
mem16[j] = 0x4e71;
}
}
if (mem16[i+3] == 0x33c7)
{
mem16[i+0] = 0x33c7;
mem16[i+1] = 0x002f;
mem16[i+2] = 0xfff0;
mem16[i+3] = 0x5247;
mem16[i+4] = 0xe14f;
mem16[i+5] = 0xe94f;
}
}
}
mem16[0x18430/2] = 0x0001;
mem16[0x18434/2] = 0xFFF0;

neogeo_fix_bank_type = 1;
kof2000_neogeo_gfx_decrypt(0x19);
init_neogeo();
}


Offline X-or

  • Newbies
  • *
  • Posts: 38
  • Karma: +0/-0
Metal Slug 5 emulation infos
« Reply #5 on: November 10, 2004, 06:48:30 PM »
Nice IQ :)

I have updated the first post:
-added the apparently legit mslug5n set
-moved mslug5 to NOT_WORKING status (since there's a working clone)

current sets are:
Code: [Select]
GAMEBX( 2003, mslug5,   neogeo,   neogeo, neogeo, neogeo,  mslug5,   ROT0, "SNK Playmore Corporation", "Metal Slug 5", GAME_NOT_WORKING )
GAMEB( 2003, mslug5n,  mslug5,   neogeo, neogeo, neogeo,  mslug5n,  ROT0, "SNK Playmore Corporation", "Metal Slug 5 (not encrypted)" )
GAMEB( 2003, ms5plus,  mslug5,   neogeo, neogeo, neogeo,  ms5plus,  ROT0, "bootleg", "Metal Slug 5 Plus" )

hopefully the neo_pvc code will be released soon to promote mslug5 from not_warking :)
« Last Edit: May 10, 2005, 01:23:50 PM by iq_132 »

Offline iq_132

  • Administrator
  • *****
  • Posts: 3612
  • Karma: +385/-0
  • Bare Knuckle!
    • NeoSource
Metal Slug 5 emulation infos
« Reply #6 on: November 10, 2004, 09:38:15 PM »
You know you don't need all of the lines of code in the ms5plus code?

Here's a shortened down version ;)
Code: [Select]
static WRITE16_HANDLER ( mslug5p_bankswitch_w )
{
if ((offset == 0)&&(data == 0xa0))
{
cpu_setbank(4,&memory_region(REGION_CPU1)[0xa0]);
}
if(offset == 2)
{
int bankaddress=(data>>4)*0x100000;
cpu_setbank(4,&memory_region(REGION_CPU1)[bankaddress]);
}
}


Offline iq_132

  • Administrator
  • *****
  • Posts: 3612
  • Karma: +385/-0
  • Bare Knuckle!
    • NeoSource
Metal Slug 5 emulation infos
« Reply #7 on: November 20, 2004, 07:44:57 PM »
Here's a shortened version of my code :)

Code: [Select]
DRIVER_INIT( mslug5 ) // Code by IQ_132 - Thanks to HappyASR for the info
{
data16_t *mem16 = (data16_t *)memory_region(REGION_CPU1);
for (int i = 0; i < 0x100000/2; i++)
{
if (mem16[i+3] == 0xfff0)
{
for (int j = i; j < (i+4); j++)
{
mem16[j] = 0x4e71;
}
}
if (mem16[i+0] == 0x5247)
{
mem16[i+0] = 0x33c7;
mem16[i+1] = 0x002f;
mem16[i+2] = 0xfff0;
}
}
mem16[0x18430/2] = 0x0001;
mem16[0x0122C/2] = 0x4E71; // AES Patch

neogeo_fix_bank_type = 1;
kof2000_neogeo_gfx_decrypt(0x19);
init_neogeo();
}