So it's been a long time. As always, busy with the job.
Anyway, to what I've been up to -- if you follow the MAME git, you probably saw my latest submission.
By examining the 68k assembly output by MAME & FBA's debuggers and behavior that it uses, I was able to
figure out most of the remaining protection used by The Killing Blade. The remaining protection is a number
generated algorithmically by the 68k program as well as the protection device, which is compared and causes
the game to have a panic attack if it doesn't match.
The worst part is that even if you were to directly examine the cart's protection device, you would only be
able to trick the game into telling you the sequence for one region -- even though the 68k has 7 regions stored!
The first step is the last step actually used by the game -- assembling certain bits of the internal (hold) number.
Interestingly, this same order of bits is used by a ton of IGS games! Killing Blade, Oriental Legends Super, Dragon World 2,
Virtual Bowling, lbh2, and many more. ^^
After figuring this out, it is easy to hack/bypass the protection by reading the ram address of the internal (hold) value.
However, for MAME's purposes, this is not enough. We need to be able to generate this internal (hold) value.
The first step is finding where in the 68k's program it is assembled. Killing Blade is nasty, in particular, because it
has one of the routines that does this written to shared ram by the protection device! (We'll discuss this later).
After finding this, it was easy enough to figure the order the bits go in and whether they are inverted or not.
However, this still takes 3 different inputs!
It takes the old (previous) value
It selects a bit from the offset used to trigger the hold calculation and uses that against the first bit in the value.
It takes a third unknown (hilo) value
Again, it's easy enough to hack it to bypass calculating where the hilo value comes from... but for MAME's purposes, this is, again, not good enough.
So we go further, to calculate the hilo value, you have to look all over the code.
The game will pick two data tables, each is 0xec bytes large (236) and repeats them
again and again. The first table is always the same -- it is actually the copyright warning information! The second one is dependent on
the regional setting of the game.
The 68k uses data in "words" as in, two bytes at a time (16 bits), the hilo value is one byte from each table inverted by the other
then every other byte goes in either byte1 or byte2 of the hilo word (0,1 then 2,1, then 2,3, then 4,3, 4,5 and so on).
It took me a little while to realize that the initial value was actually a seed created by generating the hold 4 times and running the hilo generator 8 times. ^^
This pretty much finished up The Killing Blade's protection, but not olds
Olds has other functions that are incomplete -- the protection device can copy data from an external rom in a variety of ways.
It can swap the nibbles in a word around, it can invert the word by data from a table, it can add data from a table to each word
using it as a sort of encryption, it can subtract data from the table. It can also do a straight copy with no modification.
The problem was figuring out exactly which command did what, and figuring out why the outputted data wasn't always right.
After some work, I realized that the table it uses to decrypt the doesn't always wrap like it would logically when it reached the
end of the table. -- normally it should go 0, 1, 2, 3... 255,0,1, With this setup, it could go 0,1,2, 255,256,0,1,
This helped killing blade as well, though I'm not entirely sure it is actually used.
There is only one copy mode that I couldn't figure out -- mode 0, it seems to copy some 68k code to ram and the game tries to go there and run it.
right now, I am hacking it by using a "ret" command, basically telling the 68k to go back to where it came from.
Lastly the protection device uses "registers" that the game can write to and read back from the ram in a modified form. This is almost completely ignored in the current implementation of the protection device.
I hope some day myself or someone else can figure it out and get the game working 100%.
tldr; stuff and stuff. PGM, kittens, adventure.
