MESS SVN History

15994 Revisions

r14799 Sunday 25th March, 2012 at 14:15:12 UTC by Miodrag Milanović
Sync with MAME r15775 (no whatsnew)

[src]	version.c
[src/emu/cpu/powerpc]	ppcdrc.c
[src/emu/machine]	6526cia.c
[src/mame]	mame.lst mame.mak
[src/mame/drivers]	8080bw.c aerofgt.c bfm_sc2.c bigstrkb.c bublbobl.c cninja.c cps1.c dec0.c galaxia.c goldnpkr.c igs_m027.c jankenmn.c pgm.c rastan.c sderby.c sfcbox.c sidepckt.c snk.c system1.c
[src/mame/includes]	pgm.h
[src/mame/machine]	pgmprot.c pgmprot1.c* pgmprot2.c* pgmprot3.c* pgmprot4.c* pgmprot5.c* pgmprot6.c* r2crypt.c seicop.c
[src/tools]	unidasm.c

src/mame/mame.lst
r14798	r14799
8537	8537	croupier // (c) 1997 Playmark
8538	8538	croupiera // (c) 1997 Playmark
8539	8539	spacewin
	8540	luckboom
8540	8541
8541	8542	// Pacific Novelty games
8542	8543	sharkatt // (c) 1980
r14798	r14799
8927	8928	mgfx // (c) 200?
8928	8929	gonefsh2 // (c) 200?
8929	8930	chessc2 // (c) 200?
	8931	haunthig // (c) 200?
8930	8932
8931	8933	// IGS PGM System Games
8932	8934	pgm
r14798	r14799
10600	10602	wupndownc // (c) 1998, Video Klein
10601	10603	wupndownd // (c) 1998, Video Klein
10602	10604	wstrike // (c) 1992, Video Klein
10603		wstrikea // (c) 1992, Video Klein
	10605	wstrikea // (c) 1992, Video Klein
10604	10606	wtchjack // (c) 1992-1996, Video Klein
10605	10607	wtchjacka // (c) 1992-1996, Video Klein
10606	10608	wtchjackb // (c) 1992-1996, Video Klein

src/mame/machine/pgmprot1.c
r0	r14799
	1	/***********************************************************************
	2	PGM IGA027A (55857E type) ARM protection simulations & emulation
	3
	4	these are simulations of the 'kov' type ARM device
	5	used by
	6
	7	Knights of Valor (kov) + bootlegs
	8	Knights of Valor Plus (kovplus)
	9	Puzzli 2 Super (puzzli2)
	10	Photo Y2k2 (py2k2)
	11	Puzzle Star (puzlstar)
	12
	13	the following appear to use this scheme but are post 2001 so
	14	might use a newer revision of the chip with EO area
	15
	16	DoDonPachi Dai-ou-jou (ddpdoj)
	17	Espgaluda (espgal)
	18	Ketsui (ket)
	19	Oriental Legend Super Plus (oldsplus)
	20	Knights of Valor Super Plus (kovshp) + bootlegs
	21
	22	the following also use the 55857E type and we emulate the
	23	internal ROM
	24
	25	Photo Y2k (photoy2k)
	26	Knights of Valor Superheros (kovsh) + bootlegs
	27
	28	----
	29
	30	Many of the simulations are preliminary. If functions to access
	31	internal tables exist it is sometimes possible to extract the ROM
	32	via these functions if the buffers are unchecked, however many
	33	games have no table accesses.
	34
	35	----
	36
	37	The basic protection communication is the same between all games
	38	however the commands differ
	39
	40	None of these games have an external ARM rom, although it appears
	41	the program code does check for the possibility of one existing.
	42
	43	68k code is encrypted on these, decryption table is uploaded to
	44	ARM space.
	45
	46	Game Region is supplied by internal ARM rom.
	47
	48
	49	***********************************************************************/
	50
	51	#include "emu.h"
	52	#include "includes/pgm.h"
	53
	54	/************************** EMULATION *****************************/
	55	/* used by photoy2k, kovsh */
	56
	57	static READ32_HANDLER( kovsh_arm7_protlatch_r )
	58	{
	59	pgm_state *state = space->machine().driver_data<pgm_state>();
	60
	61	space->machine().scheduler().synchronize(); // force resync
	62
	63	return (state->m_kovsh_highlatch_68k_w << 16) \| (state->m_kovsh_lowlatch_68k_w);
	64	}
	65
	66	static WRITE32_HANDLER( kovsh_arm7_protlatch_w )
	67	{
	68	pgm_state *state = space->machine().driver_data<pgm_state>();
	69
	70	space->machine().scheduler().synchronize(); // force resync
	71
	72	if (ACCESSING_BITS_16_31)
	73	{
	74	state->m_kovsh_highlatch_arm_w = data >> 16;
	75	state->m_kovsh_highlatch_68k_w = 0;
	76	}
	77	if (ACCESSING_BITS_0_15)
	78	{
	79	state->m_kovsh_lowlatch_arm_w = data;
	80	state->m_kovsh_lowlatch_68k_w = 0;
	81	}
	82	}
	83
	84	static READ16_HANDLER( kovsh_68k_protlatch_r )
	85	{
	86	pgm_state *state = space->machine().driver_data<pgm_state>();
	87
	88	space->machine().scheduler().synchronize(); // force resync
	89
	90	switch (offset)
	91	{
	92	case 1: return state->m_kovsh_highlatch_arm_w;
	93	case 0: return state->m_kovsh_lowlatch_arm_w;
	94	}
	95	return -1;
	96	}
	97
	98	static WRITE16_HANDLER( kovsh_68k_protlatch_w )
	99	{
	100	pgm_state *state = space->machine().driver_data<pgm_state>();
	101
	102	space->machine().scheduler().synchronize(); // force resync
	103
	104	switch (offset)
	105	{
	106	case 1:
	107	state->m_kovsh_highlatch_68k_w = data;
	108	break;
	109
	110	case 0:
	111	state->m_kovsh_lowlatch_68k_w = data;
	112	break;
	113	}
	114	}
	115
	116	static READ16_HANDLER( kovsh_arm7_ram_r )
	117	{
	118	pgm_state *state = space->machine().driver_data<pgm_state>();
	119	UINT16 share16 = (UINT16 )state->m_arm7_shareram;
	120
	121	if (PGMARM7LOGERROR)
	122	logerror("M68K: ARM7 Shared RAM Read: %04x = %04x (%08x) (%06x)\n", BYTE_XOR_LE(offset), share16[BYTE_XOR_LE(offset)], mem_mask, cpu_get_pc(&space->device()));
	123	return share16[BYTE_XOR_LE(offset << 1)];
	124	}
	125
	126	static WRITE16_HANDLER( kovsh_arm7_ram_w )
	127	{
	128	pgm_state *state = space->machine().driver_data<pgm_state>();
	129	UINT16 share16 = (UINT16 )state->m_arm7_shareram;
	130
	131	if (PGMARM7LOGERROR)
	132	logerror("M68K: ARM7 Shared RAM Write: %04x = %04x (%04x) (%06x)\n", BYTE_XOR_LE(offset), data, mem_mask, cpu_get_pc(&space->device()));
	133	COMBINE_DATA(&share16[BYTE_XOR_LE(offset << 1)]);
	134	}
	135
	136
	137
	138
	139	static READ32_HANDLER( kovsh_arm7_unk_r )
	140	{
	141	pgm_state *state = space->machine().driver_data<pgm_state>();
	142	return state->m_kovsh_counter++;
	143	}
	144
	145	static READ32_HANDLER( kovsh_exrom_r )
	146	{
	147	return 0x00000000;
	148	}
	149
	150	static READ32_HANDLER( arm7_shareram_r )
	151	{
	152	pgm_state *state = space->machine().driver_data<pgm_state>();
	153
	154	if (PGMARM7LOGERROR)
	155	logerror("ARM7: ARM7 Shared RAM Read: %04x = %08x (%08x) (%06x)\n", offset << 2, state->m_arm7_shareram[offset], mem_mask, cpu_get_pc(&space->device()));
	156	return state->m_arm7_shareram[offset];
	157	}
	158
	159	static WRITE32_HANDLER( arm7_shareram_w )
	160	{
	161	pgm_state *state = space->machine().driver_data<pgm_state>();
	162
	163	if (PGMARM7LOGERROR)
	164	logerror("ARM7: ARM7 Shared RAM Write: %04x = %08x (%08x) (%06x)\n", offset << 2, data, mem_mask, cpu_get_pc(&space->device()));
	165	COMBINE_DATA(&state->m_arm7_shareram[offset]);
	166	}
	167
	168	/* 55857E? */
	169	/* Knights of Valor, Photo Y2k */
	170	/* no execute only space? */
	171	static ADDRESS_MAP_START( kov_map, AS_PROGRAM, 16)
	172	AM_IMPORT_FROM(pgm_mem)
	173	AM_RANGE(0x100000, 0x4effff) AM_ROMBANK("bank1") /* Game ROM */
	174	AM_RANGE(0x4f0000, 0x4f003f) AM_READWRITE(kovsh_arm7_ram_r, kovsh_arm7_ram_w) /* ARM7 Shared RAM */
	175	AM_RANGE(0x500000, 0x500005) AM_READWRITE(kovsh_68k_protlatch_r, kovsh_68k_protlatch_w) /* ARM7 Latch */
	176	ADDRESS_MAP_END
	177
	178	static ADDRESS_MAP_START( 55857E_arm7_map, AS_PROGRAM, 32 )
	179	AM_RANGE(0x00000000, 0x00003fff) AM_ROM
	180	AM_RANGE(0x08100000, 0x083fffff) AM_READ(kovsh_exrom_r) // unpopulated, returns 0 to keep checksum happy
	181	AM_RANGE(0x10000000, 0x100003ff) AM_RAM // internal ram for asic
	182	AM_RANGE(0x40000000, 0x40000003) AM_READWRITE(kovsh_arm7_protlatch_r, kovsh_arm7_protlatch_w)
	183	AM_RANGE(0x40000008, 0x4000000b) AM_WRITENOP // ?
	184	AM_RANGE(0x4000000c, 0x4000000f) AM_READ(kovsh_arm7_unk_r)
	185	AM_RANGE(0x50800000, 0x5080003f) AM_READWRITE(arm7_shareram_r, arm7_shareram_w) AM_BASE_MEMBER(pgm_state, m_arm7_shareram)
	186	AM_RANGE(0x50000000, 0x500003ff) AM_RAM // uploads xor table to decrypt 68k rom here
	187	ADDRESS_MAP_END
	188
	189
	190	MACHINE_CONFIG_DERIVED( kov, pgm )
	191	MCFG_CPU_MODIFY("maincpu")
	192	MCFG_CPU_PROGRAM_MAP(kov_map)
	193
	194	/* protection CPU */
	195	MCFG_CPU_ADD("prot", ARM7, 20000000) // 55857E?
	196	MCFG_CPU_PROGRAM_MAP(55857E_arm7_map)
	197	MACHINE_CONFIG_END
	198
	199	/************************** SIMULATIONS ***************************/
	200
	201	static ADDRESS_MAP_START( kov_sim_map, AS_PROGRAM, 16)
	202	AM_IMPORT_FROM(pgm_mem)
	203	AM_RANGE(0x100000, 0x4effff) AM_ROMBANK("bank1") /* Game ROM */
	204	ADDRESS_MAP_END
	205
	206	static ADDRESS_MAP_START( cavepgm_mem, AS_PROGRAM, 16)
	207	AM_IMPORT_FROM(pgm_base_mem)
	208	AM_RANGE(0x000000, 0x3fffff) AM_ROM
	209	/* protection devices installed (simulated) later */
	210	ADDRESS_MAP_END
	211
	212
	213	static MACHINE_START( cavepgm )
	214	{
	215	MACHINE_START_CALL(pgm);
	216
	217	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	218
	219	state->save_item(NAME(state->m_value0));
	220	state->save_item(NAME(state->m_value1));
	221	state->save_item(NAME(state->m_valuekey));
	222	state->save_item(NAME(state->m_valueresponse));
	223	state->save_item(NAME(state->m_ddp3internal_slot));
	224	state->save_item(NAME(state->m_ddp3slots));
	225	}
	226
	227	MACHINE_CONFIG_START( cavepgm, pgm_kovarmsim_state )
	228
	229	/* basic machine hardware */
	230	MCFG_CPU_ADD("maincpu", M68000, 20000000)
	231	MCFG_CPU_PROGRAM_MAP(cavepgm_mem)
	232	MCFG_TIMER_ADD_SCANLINE("scantimer", pgm_interrupt, "screen", 0, 1)
	233
	234	MCFG_CPU_ADD("soundcpu", Z80, 33868800/4)
	235	MCFG_CPU_PROGRAM_MAP(pgm_z80_mem)
	236	MCFG_CPU_IO_MAP(pgm_z80_io)
	237
	238	MCFG_MACHINE_START( cavepgm )
	239	MCFG_MACHINE_RESET( pgm )
	240	MCFG_NVRAM_ADD_0FILL("sram")
	241
	242	MCFG_V3021_ADD("rtc")
	243
	244	/* video hardware */
	245	MCFG_SCREEN_ADD("screen", RASTER)
	246	MCFG_SCREEN_REFRESH_RATE(59.17) // verified on pcb
	247	MCFG_SCREEN_VBLANK_TIME(ATTOSECONDS_IN_USEC(0))
	248	MCFG_SCREEN_SIZE(648, 648)
	249	MCFG_SCREEN_VISIBLE_AREA(08, 568-1, 08, 288-1)
	250	MCFG_SCREEN_UPDATE_STATIC(pgm)
	251	MCFG_SCREEN_VBLANK_STATIC(pgm)
	252
	253	MCFG_GFXDECODE(pgm)
	254	MCFG_PALETTE_LENGTH(0x1200/2)
	255
	256	MCFG_VIDEO_START(pgm)
	257
	258	/sound hardware /
	259	MCFG_SPEAKER_STANDARD_MONO("mono")
	260	MCFG_ICS2115_ADD("ics", 0, pgm_sound_irq)
	261	MCFG_SOUND_ROUTE(ALL_OUTPUTS, "mono", 5.0)
	262	MACHINE_CONFIG_END
	263
	264	MACHINE_CONFIG_DERIVED( kov_simulated_arm, cavepgm )
	265	MCFG_CPU_MODIFY("maincpu")
	266	MCFG_CPU_PROGRAM_MAP(kov_sim_map)
	267
	268	/* protection CPU */
	269	MCFG_CPU_ADD("prot", ARM7, 20000000) // 55857E?
	270	MCFG_CPU_PROGRAM_MAP(55857E_arm7_map)
	271	MCFG_DEVICE_DISABLE()
	272	MACHINE_CONFIG_END
	273
	274	void kovsh_latch_init( running_machine &machine )
	275	{
	276	pgm_state *state = machine.driver_data<pgm_state>();
	277
	278	state->m_kovsh_highlatch_arm_w = 0;
	279	state->m_kovsh_lowlatch_arm_w = 0;
	280	state->m_kovsh_highlatch_68k_w = 0;
	281	state->m_kovsh_lowlatch_68k_w = 0;
	282	state->m_kovsh_counter = 1;
	283
	284	state->save_item(NAME(state->m_kovsh_highlatch_arm_w));
	285	state->save_item(NAME(state->m_kovsh_lowlatch_arm_w));
	286	state->save_item(NAME(state->m_kovsh_highlatch_68k_w));
	287	state->save_item(NAME(state->m_kovsh_lowlatch_68k_w));
	288	state->save_item(NAME(state->m_kovsh_counter));
	289	}
	290
	291	static READ16_HANDLER( kovsh_fake_region_r )
	292	{
	293	pgm_state *state = space->machine().driver_data<pgm_state>();
	294	int regionhack = input_port_read(space->machine(), "RegionHack");
	295	if (regionhack != 0xff) return regionhack;
	296
	297	offset = 0x4;
	298	UINT16 share16 = (UINT16 )state->m_arm7_shareram;
	299	return share16[BYTE_XOR_LE(offset << 1)];
	300	}
	301
	302	DRIVER_INIT( photoy2k )
	303	{
	304	pgm_basic_init(machine);
	305	pgm_photoy2k_decrypt(machine);
	306	kovsh_latch_init(machine);
	307	/* we only have a china internal ROM dumped for now.. allow region to be changed for debugging (to ensure all alt titles / regions can be seen) */
	308	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0008, 0x4f0009, FUNC(kovsh_fake_region_r));
	309	}
	310
	311	DRIVER_INIT( kovsh )
	312	{
	313	pgm_basic_init(machine);
	314	pgm_kovsh_decrypt(machine);
	315	kovsh_latch_init(machine);
	316	/* we only have a china internal ROM dumped for now.. allow region to be changed for debugging (to ensure all alt titles / regions can be seen) */
	317	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0008, 0x4f0009, FUNC(kovsh_fake_region_r));
	318	}
	319
	320	DRIVER_INIT( kovshp )
	321	{
	322	pgm_basic_init(machine);
	323	pgm_kovshp_decrypt(machine);
	324	kovsh_latch_init(machine);
	325	/* we only have a china internal ROM dumped for now.. allow region to be changed for debugging (to ensure all alt titles / regions can be seen) */
	326	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0008, 0x4f0009, FUNC(kovsh_fake_region_r));
	327	}
	328
	329	/* bootleg inits */
	330
	331	static void pgm_decode_kovlsqh2_tiles( running_machine &machine )
	332	{
	333	int i, j;
	334	UINT16 src = (UINT16 )(machine.region("tiles")->base() + 0x180000);
	335	UINT16 *dst = auto_alloc_array(machine, UINT16, 0x800000);
	336
	337	for (i = 0; i < 0x800000 / 2; i++)
	338	{
	339	j = BITSWAP24(i, 23, 22, 9, 8, 21, 18, 0, 1, 2, 3, 16, 15, 14, 13, 12, 11, 10, 19, 20, 17, 7, 6, 5, 4);
	340
	341	dst[j] = BITSWAP16(src[i], 1, 14, 8, 7, 0, 15, 6, 9, 13, 2, 5, 10, 12, 3, 4, 11);
	342	}
	343
	344	memcpy( src, dst, 0x800000 );
	345
	346	auto_free( machine, dst );
	347	}
	348
	349	static void pgm_decode_kovlsqh2_sprites( running_machine &machine, UINT8 *src )
	350	{
	351	int i, j;
	352	UINT8 *dst = auto_alloc_array(machine, UINT8, 0x800000);
	353
	354	for (i = 0; i < 0x800000; i++)
	355	{
	356	j = BITSWAP24(i, 23, 10, 9, 22, 19, 18, 20, 21, 17, 16, 15, 14, 13, 12, 11, 8, 7, 6, 5, 4, 3, 2, 1, 0);
	357
	358	dst[j] = src[i];
	359	}
	360
	361	memcpy( src, dst, 0x800000 );
	362
	363	auto_free( machine, dst );
	364	}
	365
	366	static void pgm_decode_kovlsqh2_samples( running_machine &machine )
	367	{
	368	int i;
	369	UINT8 src = (UINT8 )(machine.region("ics")->base() + 0x400000);
	370
	371	for (i = 0; i < 0x400000; i+=2) {
	372	src[i + 0x000001] = src[i + 0x400001];
	373	}
	374
	375	memcpy( src + 0x400000, src, 0x400000 );
	376	}
	377
	378	static void pgm_decode_kovqhsgs_program( running_machine &machine )
	379	{
	380	int i;
	381	UINT16 src = (UINT16 )(machine.region("maincpu")->base() + 0x100000);
	382	UINT16 *dst = auto_alloc_array(machine, UINT16, 0x400000);
	383
	384	for (i = 0; i < 0x400000 / 2; i++)
	385	{
	386	int j = BITSWAP24(i, 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13, 12, 11, 10, 9, 8, 6, 7, 5, 4, 3, 2, 1, 0);
	387
	388	dst[j] = BITSWAP16(src[i], 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 4, 5, 3, 2, 1, 0);
	389	}
	390
	391	memcpy( src, dst, 0x400000 );
	392
	393	auto_free( machine, dst );
	394	}
	395
	396	static void pgm_decode_kovqhsgs2_program( running_machine &machine )
	397	{
	398	int i;
	399	UINT16 src = (UINT16 )(machine.region("maincpu")->base() + 0x100000);
	400	UINT16 *dst = auto_alloc_array(machine, UINT16, 0x400000);
	401
	402	for (i = 0; i < 0x400000 / 2; i++)
	403	{
	404	int j = BITSWAP24(i, 23, 22, 21, 20, 19, 16, 15, 14, 13, 12, 11, 10, 9, 8, 0, 1, 2, 3, 4, 5, 6, 18, 17, 7);
	405
	406	dst[j] = src[i];
	407	}
	408
	409	memcpy( src, dst, 0x400000 );
	410
	411	auto_free( machine, dst );
	412	}
	413
	414
	415	DRIVER_INIT( kovlsqh2 )
	416	{
	417	pgm_decode_kovqhsgs2_program(machine);
	418	pgm_decode_kovlsqh2_tiles(machine);
	419
	420	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x0000000);
	421	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x0800000);
	422	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x1000000);
	423	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x1800000);
	424	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x2000000);
	425	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x2800000);
	426	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprmask")->base() + 0x0000000);
	427	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprmask")->base() + 0x0800000);
	428
	429	pgm_decode_kovlsqh2_samples(machine);
	430	pgm_basic_init(machine);
	431	kovsh_latch_init(machine);
	432	/* we only have a china internal ROM dumped for now.. allow region to be changed for debugging (to ensure all alt titles / regions can be seen) */
	433	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0008, 0x4f0009, FUNC(kovsh_fake_region_r));
	434	}
	435
	436	DRIVER_INIT( kovqhsgs )
	437	{
	438	pgm_decode_kovqhsgs_program(machine);
	439	pgm_decode_kovlsqh2_tiles(machine);
	440
	441	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x0000000);
	442	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x0800000);
	443	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x1000000);
	444	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x1800000);
	445	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x2000000);
	446	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x2800000);
	447	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprmask")->base() + 0x0000000);
	448	pgm_decode_kovlsqh2_sprites(machine, machine.region("sprmask")->base() + 0x0800000);
	449
	450	pgm_decode_kovlsqh2_samples(machine);
	451	pgm_basic_init(machine);
	452	kovsh_latch_init(machine);
	453	/* we only have a china internal ROM dumped for now.. allow region to be changed for debugging (to ensure all alt titles / regions can be seen) */
	454	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0008, 0x4f0009, FUNC(kovsh_fake_region_r));
	455	}
	456
	457	/*
	458	in Ketsui (ket) @ 000A719C (move.w)
	459
	460	if you change D0 to 0x12
	461	the game will runs to "Asic27 Test" mode
	462
	463	bp A71A0,1,{d0=0x12;g}
	464	*/
	465
	466	static READ16_HANDLER( ddp3_asic_r )
	467	{
	468	pgm_kovarmsim_state *state = space->machine().driver_data<pgm_kovarmsim_state>();
	469
	470	if (offset == 0)
	471	{
	472	UINT16 d = state->m_valueresponse & 0xffff;
	473	UINT16 realkey = state->m_valuekey >> 8;
	474	realkey \|= state->m_valuekey;
	475	d ^= realkey;
	476
	477	return d;
	478
	479	}
	480	else if (offset == 1)
	481	{
	482	UINT16 d = state->m_valueresponse >> 16;
	483	UINT16 realkey = state->m_valuekey >> 8;
	484	realkey \|= state->m_valuekey;
	485	d ^= realkey;
	486	return d;
	487
	488	}
	489	return 0xffff;
	490	}
	491
	492	/* working */
	493	void command_handler_ddp3(pgm_kovarmsim_state *state, int pc)
	494	{
	495	switch (state->m_ddp3lastcommand)
	496	{
	497	default:
	498	printf("%06x command %02x \| %04x\n", pc, state->m_ddp3lastcommand, state->m_value0);
	499	state->m_valueresponse = 0x880000;
	500	break;
	501
	502	case 0x40:
	503	state->m_valueresponse = 0x880000;
	504	state->m_ddp3slots[(state->m_value0>>10)&0x1F]=
	505	(state->m_ddp3slots[(state->m_value0>>5)&0x1F]+
	506	state->m_ddp3slots[(state->m_value0>>0)&0x1F])&0xffffff;
	507	break;
	508
	509	case 0x67: // set high bits
	510	// printf("%06x command %02x \| %04x\n", cpu_get_pc(&space->device()), state->m_ddp3lastcommand, state->m_value0);
	511	state->m_valueresponse = 0x880000;
	512	state->m_ddp3internal_slot = (state->m_value0 & 0xff00)>>8;
	513	state->m_ddp3slots[state->m_ddp3internal_slot] = (state->m_value0 & 0x00ff) << 16;
	514	break;
	515
	516	case 0xe5: // set low bits for operation?
	517	// printf("%06x command %02x \| %04x\n", cpu_get_pc(&space->device()), state->m_ddp3lastcommand, state->m_value0);
	518	state->m_valueresponse = 0x880000;
	519	state->m_ddp3slots[state->m_ddp3internal_slot] \|= (state->m_value0 & 0xffff);
	520	break;
	521
	522
	523	case 0x8e: // read back result of operations
	524	// printf("%06x command %02x \| %04x\n", cpu_get_pc(&space->device()), state->m_ddp3lastcommand, state->m_value0);
	525	state->m_valueresponse = state->m_ddp3slots[state->m_value0&0xff];
	526	break;
	527
	528
	529	case 0x99: // reset?
	530	state->m_valuekey = 0x100;
	531	state->m_valueresponse = 0x00880000;
	532	break;
	533
	534	}
	535	}
	536
	537	/* preliminary */
	538	static INT32 puzzli_54_trigger = 0;
	539	void command_handler_puzzli2(pgm_kovarmsim_state *state, int pc)
	540	{
	541	printf("%08x: %02x %04x\n",pc, state->m_ddp3lastcommand, state->m_value0);
	542
	543	switch (state->m_ddp3lastcommand)
	544	{
	545	case 0x13: // ASIC status?
	546	state->m_valueresponse = 0x74<<16; // 2d or 74! (based on?)
	547	break;
	548
	549	case 0x31:
	550	{
	551	// how is this selected? command 54?
	552
	553	// just a wild guess
	554	if (puzzli_54_trigger) {
	555	// pc == 1387de
	556	state->m_valueresponse = 0x63<<16; // ?
	557	} else {
	558	// pc == 14cf58
	559	state->m_valueresponse = 0xd2<<16;
	560	}
	561
	562	puzzli_54_trigger = 0;
	563	}
	564	break;
	565
	566	case 0x38: // Reset
	567	state->m_valueresponse = 0x78<<16;
	568	state->m_valuekey = 0x100;
	569	puzzli_54_trigger = 0;
	570	break;
	571
	572	case 0x41: // ASIC status?
	573	state->m_valueresponse = 0x74<<16;
	574	break;
	575
	576	case 0x47: // ASIC status?
	577	state->m_valueresponse = 0x74<<16;
	578	break;
	579
	580	case 0x52: // ASIC status?
	581	{
	582	// how is this selected?
	583
	584	//if (state->m_value0 == 6) {
	585	state->m_valueresponse = (0x74<<16)\|1; // \|1?
	586	//} else {
	587	// state->m_valueresponse = 0x74<<16;
	588	//}
	589	}
	590	break;
	591
	592	case 0x54: // ??
	593	puzzli_54_trigger = 1;
	594	state->m_valueresponse = 0x36<<16;
	595	break;
	596
	597	case 0x61: // ??
	598	state->m_valueresponse = 0x36<<16;
	599	break;
	600
	601	case 0x63: // used as a read address by the 68k code (related to previous uploaded values like cave?) should point at a table of ~0x80 in size? seems to use values as further pointers?
	602	state->m_valueresponse = 0x00600000;
	603	break;
	604
	605	case 0x67: // used as a read address by the 68k code (related to previous uploaded values like cave?) directly reads ~0xDBE from the address..
	606	state->m_valueresponse = 0x00400000;
	607	break;
	608
	609	default:
	610	state->m_valueresponse = 0x74<<16;
	611	break;
	612	}
	613	}
	614
	615	/* preliminary */
	616	void command_handler_py2k2(pgm_kovarmsim_state *state, int pc)
	617	{
	618	switch (state->m_ddp3lastcommand)
	619	{
	620	default:
	621	printf("%06x command %02x \| %04x\n", pc, state->m_ddp3lastcommand, state->m_value0);
	622	state->m_valueresponse = 0x880000;
	623	break;
	624
	625	case 0xc0:
	626	printf("%06x command %02x \| %04x\n", pc, state->m_ddp3lastcommand, state->m_value0);
	627	state->m_valueresponse = 0x880000;
	628	break;
	629
	630	case 0x99: // reset?
	631	state->m_valuekey = 0x100;
	632	state->m_valueresponse = 0x00880000;
	633	break;
	634	}
	635	}
	636
	637	/* preliminary */
	638
	639
	640	static const int pstar_ba[0x1E]={
	641	0x02,0x00,0x00,0x01,0x00,0x03,0x00,0x00, //0
	642	0x02,0x00,0x06,0x00,0x22,0x04,0x00,0x03, //8
	643	0x00,0x00,0x06,0x00,0x20,0x07,0x00,0x03, //10
	644	0x00,0x21,0x01,0x00,0x00,0x63
	645	};
	646
	647	static const int pstar_b0[0x10]={
	648	0x09,0x0A,0x0B,0x00,0x01,0x02,0x03,0x04,
	649	0x05,0x06,0x07,0x08,0x00,0x00,0x00,0x00
	650	};
	651
	652	static const int pstar_ae[0x10]={
	653	0x5D,0x86,0x8C ,0x8B,0xE0,0x8B,0x62,0xAF,
	654	0xB6,0xAF,0x10A,0xAF,0x00,0x00,0x00,0x00
	655	};
	656
	657	static const int pstar_a0[0x10]={
	658	0x02,0x03,0x04,0x05,0x06,0x01,0x0A,0x0B,
	659	0x0C,0x0D,0x0E,0x09,0x00,0x00,0x00,0x00,
	660	};
	661
	662	static const int pstar_9d[0x10]={
	663	0x05,0x03,0x00,0x00,0x00,0x00,0x00,0x00,
	664	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	665	};
	666
	667	static const int pstar_90[0x10]={
	668	0x0C,0x10,0x0E,0x0C,0x00,0x00,0x00,0x00,
	669	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
	670	};
	671	static const int pstar_8c[0x23]={
	672	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	673	0x00,0x00,0x00,0x00,0x00,0x01,0x01,0x01,
	674	0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,
	675	0x02,0x02,0x03,0x03,0x03,0x04,0x04,0x04,
	676	0x03,0x03,0x03
	677	};
	678
	679	static const int pstar_80[0x1a3]={
	680	0x03,0x03,0x04,0x04,0x04,0x04,0x05,0x05,
	681	0x05,0x05,0x06,0x06,0x03,0x03,0x04,0x04,
	682	0x05,0x05,0x05,0x05,0x06,0x06,0x07,0x07,
	683	0x03,0x03,0x04,0x04,0x05,0x05,0x05,0x05,
	684	0x06,0x06,0x07,0x07,0x06,0x06,0x06,0x06,
	685	0x06,0x06,0x06,0x07,0x07,0x07,0x07,0x07,
	686	0x06,0x06,0x06,0x06,0x06,0x06,0x07,0x07,
	687	0x07,0x07,0x08,0x08,0x05,0x05,0x05,0x05,
	688	0x05,0x05,0x05,0x06,0x06,0x06,0x07,0x07,
	689	0x06,0x06,0x06,0x07,0x07,0x07,0x08,0x08,
	690	0x09,0x09,0x09,0x09,0x07,0x07,0x07,0x07,
	691	0x07,0x08,0x08,0x08,0x08,0x09,0x09,0x09,
	692	0x06,0x06,0x07,0x07,0x07,0x08,0x08,0x08,
	693	0x08,0x08,0x09,0x09,0x05,0x05,0x06,0x06,
	694	0x06,0x07,0x07,0x08,0x08,0x08,0x08,0x09,
	695	0x07,0x07,0x07,0x07,0x07,0x08,0x08,0x08,
	696	0x08,0x09,0x09,0x09,0x06,0x06,0x07,0x03,
	697	0x07,0x06,0x07,0x07,0x08,0x07,0x05,0x04,
	698	0x03,0x03,0x04,0x04,0x05,0x05,0x06,0x06,
	699	0x06,0x06,0x06,0x06,0x03,0x04,0x04,0x04,
	700	0x04,0x05,0x05,0x06,0x06,0x06,0x06,0x07,
	701	0x04,0x04,0x05,0x05,0x06,0x06,0x06,0x06,
	702	0x06,0x07,0x07,0x08,0x05,0x05,0x06,0x07,
	703	0x07,0x08,0x08,0x08,0x08,0x08,0x08,0x08,
	704	0x05,0x05,0x05,0x07,0x07,0x07,0x07,0x07,
	705	0x07,0x08,0x08,0x08,0x08,0x08,0x09,0x09,
	706	0x09,0x09,0x03,0x04,0x04,0x05,0x05,0x05,
	707	0x06,0x06,0x07,0x07,0x07,0x07,0x08,0x08,
	708	0x08,0x09,0x09,0x09,0x03,0x04,0x05,0x05,
	709	0x04,0x03,0x04,0x04,0x04,0x05,0x05,0x04,
	710	0x03,0x03,0x03,0x03,0x03,0x03,0x03,0x03,
	711	0x03,0x03,0x03,0x04,0x04,0x04,0x04,0x04,
	712	0x04,0x04,0x04,0x04,0x04,0x03,0x03,0x03,
	713	0x03,0x03,0x03,0x00,0x00,0x00,0x00,0x00,
	714	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	715	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	716	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	717	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	718	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	719	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	720	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	721	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	722	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	723	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	724	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	725	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	726	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	727	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	728	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	729	0x00,0x00,0x00,0x00,0xFF,0x00,0x00,0x00,
	730	0x00,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,
	731	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	732	0x00,0x00,0x00
	733	};
	734
	735	void command_handler_pstars(pgm_kovarmsim_state *state, int pc)
	736	{
	737	switch (state->m_ddp3lastcommand)
	738	{
	739	case 0x99:
	740	state->m_valuekey = 0x100;
	741	state->m_valueresponse = 0x880000;
	742	break;
	743
	744	case 0xe0:
	745	state->m_valueresponse = 0xa00000 + (state->m_value0 << 6);
	746	break;
	747
	748	case 0xdc:
	749	state->m_valueresponse = 0xa00800 + (state->m_value0 << 6);
	750	break;
	751
	752	case 0xd0:
	753	state->m_valueresponse = 0xa01000 + (state->m_value0 << 5);
	754	break;
	755
	756	case 0xb1:
	757	state->m_pstar_b1 = state->m_value0;
	758	state->m_valueresponse = 0x890000;
	759	break;
	760
	761	case 0xbf:
	762	state->m_valueresponse = state->m_pstar_b1 * state->m_value0;
	763	break;
	764
	765	case 0xc1: //TODO:TIMER 0,1,2,FIX TO 0 should be OK?
	766	state->m_valueresponse = 0;
	767	break;
	768
	769	case 0xce: //TODO:TIMER 0,1,2
	770	state->m_pstar_ce = state->m_value0;
	771	state->m_valueresponse=0x890000;
	772	break;
	773
	774	case 0xcf: //TODO:TIMER 0,1,2
	775	state->m_extra_ram[state->m_pstar_ce] = state->m_value0;
	776	state->m_valueresponse = 0x890000;
	777	break;
	778
	779	case 0xe7:
	780	state->m_pstar_e7 = (state->m_value0 >> 12) & 0xf;
	781	state->m_ddp3slots[state->m_pstar_e7] &= 0xffff;
	782	state->m_ddp3slots[state->m_pstar_e7] \|= (state->m_value0 & 0xff) << 16;
	783	state->m_valueresponse = 0x890000;
	784	break;
	785
	786	case 0xe5:
	787	state->m_ddp3slots[state->m_pstar_e7] &= 0xff0000;
	788	state->m_ddp3slots[state->m_pstar_e7] \|= state->m_value0;
	789	state->m_valueresponse = 0x890000;
	790	break;
	791
	792	case 0xf8: //@73C
	793	state->m_valueresponse = state->m_ddp3slots[state->m_value0 & 0xf] & 0xffffff;
	794	break;
	795
	796	case 0xba:
	797	state->m_valueresponse = pstar_ba[state->m_value0];
	798	break;
	799
	800	case 0xb0:
	801	state->m_valueresponse = pstar_b0[state->m_value0];
	802	break;
	803
	804	case 0xae:
	805	state->m_valueresponse = pstar_ae[state->m_value0];
	806	break;
	807
	808	case 0xa0:
	809	state->m_valueresponse = pstar_a0[state->m_value0];
	810	break;
	811
	812	case 0x9d:
	813	state->m_valueresponse = pstar_9d[state->m_value0];
	814	break;
	815
	816	case 0x90:
	817	state->m_valueresponse = pstar_90[state->m_value0];
	818	break;
	819
	820	case 0x8c:
	821	state->m_valueresponse = pstar_8c[state->m_value0];
	822	break;
	823
	824	case 0x80:
	825	state->m_valueresponse = pstar_80[state->m_value0];
	826	break;
	827
	828	default:
	829	state->m_valueresponse = 0x890000;
	830	logerror("PSTARS PC(%06x) UNKNOWN %4X %4X\n", pc, state->m_value1, state->m_value0);
	831	}
	832	}
	833
	834	/* Old KOV and bootlegs sim ... really these should be read out... */
	835
	836	static const UINT8 kov_BATABLE[0x40] = {
	837	0x00,0x29,0x2c,0x35,0x3a,0x41,0x4a,0x4e,0x57,0x5e,0x77,0x79,0x7a,0x7b,0x7c,0x7d,
	838	0x7e,0x7f,0x80,0x81,0x82,0x85,0x86,0x87,0x88,0x89,0x8a,0x8b,0x8c,0x8d,0x8e,0x90,
	839	0x95,0x96,0x97,0x98,0x99,0x9a,0x9b,0x9c,0x9e,0xa3,0xd4,0xa9,0xaf,0xb5,0xbb,0xc1
	840	};
	841
	842	static const UINT8 kov_B0TABLE[16] = { 2, 0, 1, 4, 3 }; // Maps char portraits to tables
	843
	844	static UINT32 kov_slots[16];
	845	static UINT16 kov_internal_slot;
	846	static UINT16 kov_c0_value;
	847	static UINT16 kov_cb_value;
	848	static UINT16 kov_fe_value;
	849
	850	void command_handler_kov(pgm_kovarmsim_state *state, int pc)
	851	{
	852	switch (state->m_ddp3lastcommand)
	853	{
	854	case 0x67: // unknown or status check?
	855	case 0x8e:
	856	case 0xa3:
	857	case 0x33: // kovsgqyz (a3)
	858	case 0x3a: // kovplus
	859	case 0xc5: // kovplus
	860	state->m_valueresponse = 0x880000;
	861	break;
	862
	863	case 0x99: // Reset
	864	state->m_valueresponse = 0x880000;
	865	state->m_valuekey = 0x100;
	866	break;
	867
	868	case 0x9d: // Sprite palette offset
	869	state->m_valueresponse = 0xa00000 + ((state->m_value0 & 0x1f) * 0x40);
	870	break;
	871
	872	case 0xb0: // Read from data table
	873	state->m_valueresponse = kov_B0TABLE[state->m_value0 & 0x0f];
	874	break;
	875
	876	case 0xb4: // Copy slot 'a' to slot 'b'
	877	case 0xb7: // kovsgqyz (b4)
	878	{
	879	state->m_valueresponse = 0x880000;
	880
	881	if (state->m_value0 == 0x0102) state->m_value0 = 0x0100; // why?
	882
	883	kov_slots[(state->m_value0 >> 8) & 0x0f] = kov_slots[(state->m_value0 >> 0) & 0x0f];
	884	}
	885	break;
	886
	887	case 0xba: // Read from data table
	888	state->m_valueresponse = kov_BATABLE[state->m_value0 & 0x3f];
	889	break;
	890
	891	case 0xc0: // Text layer 'x' select
	892	state->m_valueresponse = 0x880000;
	893	kov_c0_value = state->m_value0;
	894	break;
	895
	896	case 0xc3: // Text layer offset
	897	state->m_valueresponse = 0x904000 + ((kov_c0_value + (state->m_value0 * 0x40)) * 4);
	898	break;
	899
	900	case 0xcb: // Background layer 'x' select
	901	state->m_valueresponse = 0x880000;
	902	kov_cb_value = state->m_value0;
	903	break;
	904
	905	case 0xcc: // Background layer offset
	906	if (state->m_value0 & 0x400) state->m_value0 = -(0x400 - (state->m_value0 & 0x3ff));
	907	state->m_valueresponse = 0x900000 + ((kov_cb_value + (state->m_value0 * 0x40)) * 4);
	908	break;
	909
	910	case 0xd0: // Text palette offset
	911	case 0xcd: // kovsgqyz (d0)
	912	state->m_valueresponse = 0xa01000 + (state->m_value0 * 0x20);
	913	break;
	914
	915	case 0xd6: // Copy slot to slot 0
	916	state->m_valueresponse = 0x880000;
	917	kov_slots[0] = kov_slots[state->m_value0 & 0x0f];
	918	break;
	919
	920	case 0xdc: // Background palette offset
	921	case 0x11: // kovsgqyz (dc)
	922	state->m_valueresponse = 0xa00800 + (state->m_value0 * 0x40);
	923	break;
	924
	925	case 0xe0: // Sprite palette offset
	926	case 0x9e: // kovsgqyz (e0)
	927	state->m_valueresponse = 0xa00000 + ((state->m_value0 & 0x1f) * 0x40);
	928	break;
	929
	930	case 0xe5: // Write slot (low)
	931	{
	932	state->m_valueresponse = 0x880000;
	933
	934	INT32 sel = (kov_internal_slot >> 12) & 0x0f;
	935	kov_slots[sel] = (kov_slots[sel] & 0x00ff0000) \| ((state->m_value0 & 0xffff) << 0);
	936	}
	937	break;
	938
	939	case 0xe7: // Write slot (and slot select) (high)
	940	{
	941	state->m_valueresponse = 0x880000;
	942	kov_internal_slot = state->m_value0;
	943
	944	INT32 sel = (kov_internal_slot >> 12) & 0x0f;
	945	kov_slots[sel] = (kov_slots[sel] & 0x0000ffff) \| ((state->m_value0 & 0x00ff) << 16);
	946	}
	947	break;
	948
	949	case 0xf0: // Some sort of status read?
	950	state->m_valueresponse = 0x00c000;
	951	break;
	952
	953	case 0xf8: // Read slot
	954	case 0xab: // kovsgqyz (f8)
	955	state->m_valueresponse = kov_slots[state->m_value0 & 0x0f] & 0x00ffffff;
	956	break;
	957
	958	case 0xfc: // Adjust damage level to char experience level
	959	state->m_valueresponse = (state->m_value0 * kov_fe_value) >> 6;
	960	break;
	961
	962	case 0xfe: // Damage level adjust
	963	state->m_valueresponse = 0x880000;
	964	kov_fe_value = state->m_value0;
	965	break;
	966
	967	default:
	968	state->m_valueresponse = 0x880000;
	969	// bprintf (PRINT_NORMAL, _T("Unknown ASIC27 command: %2.2x data: %4.4x\n"), (data ^ state->m_valuekey) & 0xff, state->m_value0);
	970	break;
	971	}
	972	}
	973
	974
	975	/* Oriental Legend Super Plus ARM simulation */
	976
	977	static const int oldsplus_80[0x5]={
	978	0xbb8,0x1770,0x2328,0x2ee0,0xf4240
	979	};
	980
	981	static const int oldsplus_fc[0x20]={
	982	0x00,0x00,0x0a,0x3a,0x4e,0x2e,0x03,0x40,
	983	0x33,0x43,0x26,0x2c,0x00,0x00,0x00,0x00,
	984	0x00,0x00,0x44,0x4d,0xb,0x27,0x3d,0x0f,
	985	0x37,0x2b,0x02,0x2f,0x15,0x45,0x0e,0x30
	986	};
	987
	988	static const int oldsplus_a0[0x20]={
	989	0x000,0x023,0x046,0x069,0x08c,0x0af,0x0d2,0x0f5,
	990	0x118,0x13b,0x15e,0x181,0x1a4,0x1c7,0x1ea,0x20d,
	991	0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,
	992	0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,
	993	};
	994
	995	static const int oldsplus_90[0x7]={
	996	0x50,0xa0,0xc8,0xf0,0x190,0x1f4,0x258
	997	};
	998
	999	static const int oldsplus_5e[0x20]={
	1000	0x04,0x04,0x04,0x04,0x04,0x03,0x03,0x03,
	1001	0x02,0x02,0x02,0x01,0x01,0x01,0x01,0x01,
	1002	0x01,0x01,0x01,0x01,0x01,0x00,0x00,0x00,
	1003	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
	1004	};
	1005
	1006	static const int oldsplus_b0[0xe0]={
	1007	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1008	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1009	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1010	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1011
	1012	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1013	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1014	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1015	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1016
	1017	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1018	0x00,0x00,0x00,0x00,0x01,0x02,0x03,0x04,
	1019	0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,
	1020	0x0d,0x0e,0x0f,0x10,0x11,0x12,0x13,0x14,
	1021
	1022	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	1023	0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,
	1024	0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0x10,
	1025	0x11,0x12,0x13,0x14,0x15,0x16,0x17,0x18,
	1026
	1027	0x00,0x00,0x00,0x00,0x01,0x02,0x03,0x04,
	1028	0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,
	1029	0x0d,0x0e,0x0f,0x10,0x11,0x12,0x13,0x14,
	1030	0x15,0x16,0x17,0x18,0x19,0x1a,0x1b,0x1c,
	1031
	1032	0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
	1033	0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,
	1034	0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,
	1035	0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,0x1f,
	1036
	1037	0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,
	1038	0x0c,0x0d,0x0e,0x0f,0x10,0x11,0x12,0x13,
	1039	0x14,0x15,0x16,0x17,0x18,0x19,0x1a,0x1b,
	1040	0x1c,0x1d,0x1e,0x1f,0x1f,0x1f,0x1f,0x1f
	1041	};
	1042
	1043	static const int oldsplus_ae[0xe0]={
	1044	0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
	1045	0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
	1046	0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
	1047	0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
	1048
	1049	0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
	1050	0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
	1051	0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
	1052	0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
	1053
	1054	0x1E,0x1F,0x20,0x21,0x22,0x23,0x23,0x23,
	1055	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1056	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1057	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1058
	1059	0x1F,0x20,0x21,0x22,0x23,0x23,0x23,0x23,
	1060	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1061	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1062	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1063
	1064	0x20,0x21,0x22,0x23,0x23,0x23,0x23,0x23,
	1065	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1066	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1067	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1068
	1069	0x21,0x22,0x23,0x23,0x23,0x23,0x23,0x23,
	1070	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1071	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1072	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1073
	1074	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1075	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1076	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
	1077	0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23
	1078	};
	1079
	1080	static const int oldsplus_ba[0x4]={
	1081	0x3138,0x2328,0x1C20,0x1518
	1082	};
	1083
	1084	static const int oldsplus_9d[0x111]={
	1085	0x0000,0x0064,0x00c8,0x012c,0x0190,0x01f4,0x0258,0x02bc,
	1086	0x02f8,0x0334,0x0370,0x03ac,0x03e8,0x0424,0x0460,0x049c,
	1087	0x04d8,0x0514,0x0550,0x058c,0x05c8,0x0604,0x0640,0x06bc,
	1088	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1089	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x0000,
	1090	0x0064,0x00c8,0x012c,0x0190,0x01f4,0x0258,0x02bc,0x0302,
	1091	0x0348,0x038e,0x03d4,0x041a,0x0460,0x04a6,0x04ec,0x0532,
	1092	0x0578,0x05be,0x0604,0x064a,0x0690,0x06d6,0x06bc,0x06bc,
	1093	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1094	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x0000,0x0064,
	1095	0x00c8,0x012c,0x0190,0x01f4,0x0258,0x02bc,0x0316,0x0370,
	1096	0x03ca,0x0424,0x047e,0x04d8,0x0532,0x058c,0x05e6,0x0640,
	1097	0x069a,0x06f4,0x074e,0x07a8,0x0802,0x06bc,0x06bc,0x06bc,
	1098	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1099	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x0000,0x0064,0x00c8,
	1100	0x012c,0x0190,0x01f4,0x0258,0x02bc,0x032a,0x0398,0x0406,
	1101	0x0474,0x04e2,0x0550,0x05be,0x062c,0x069a,0x0708,0x0776,
	1102	0x07e4,0x0852,0x08c0,0x092e,0x06bc,0x06bc,0x06bc,0x06bc,
	1103	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1104	0x06bc,0x06bc,0x06bc,0x06bc,0x0000,0x0064,0x00c8,0x012c,
	1105	0x0190,0x01f4,0x0258,0x02bc,0x0348,0x03d4,0x0460,0x04ec,
	1106	0x0578,0x0604,0x0690,0x071c,0x07a8,0x0834,0x08c0,0x094c,
	1107	0x09d8,0x0a64,0x0af0,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1108	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1109	0x06bc,0x06bc,0x06bc,0x0000,0x0064,0x00c8,0x012c,0x0190,
	1110	0x01f4,0x0258,0x02bc,0x0384,0x044c,0x0514,0x05dc,0x06a4,
	1111	0x076c,0x0834,0x08fc,0x09c4,0x0a8c,0x0b54,0x0c1c,0x0ce4,
	1112	0x0dac,0x0e74,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1113	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1114	0x06bc,0x06bc,0x0000,0x0064,0x00c8,0x012c,0x0190,0x01f4,
	1115	0x0258,0x02bc,0x030c,0x035c,0x03ac,0x03fc,0x044c,0x049c,
	1116	0x04ec,0x053c,0x058c,0x05dc,0x062c,0x067c,0x06cc,0x071c,
	1117	0x076c,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1118	0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
	1119	0x06bc
	1120	};
	1121
	1122	static const int oldsplus_8c[0x20]={
	1123	0x0032,0x0032,0x0064,0x0096,0x0096,0x00fa,0x012c,0x015e,
	1124	0x0032,0x0064,0x0096,0x00c8,0x00c8,0x012c,0x015e,0x0190,
	1125	0x0064,0x0096,0x00c8,0x00fa,0x00fa,0x015e,0x0190,0x01c2,
	1126	0x0096,0x00c8,0x00fa,0x012c,0x012c,0x0190,0x01c2,0x01f4
	1127	};
	1128
	1129
	1130	void command_handler_oldsplus(pgm_kovarmsim_state *state, int pc)
	1131	{
	1132	switch (state->m_ddp3lastcommand)
	1133	{
	1134	case 0x88:
	1135	state->m_valuekey = 0x100;
	1136	state->m_valueresponse = 0x990000;
	1137	break;
	1138
	1139	case 0xd0:
	1140	state->m_valueresponse = 0xa01000 + (state->m_value0 << 5);
	1141	break;
	1142
	1143	case 0xc0:
	1144	state->m_valueresponse = 0xa00000 + (state->m_value0 << 6);
	1145	break;
	1146
	1147	case 0xc3:
	1148	state->m_valueresponse = 0xa00800 + (state->m_value0 << 6);
	1149	break;
	1150
	1151	case 0x36:
	1152	state->m_extra_ram[0x36] = state->m_value0;
	1153	state->m_valueresponse = 0x990000;
	1154	break;
	1155
	1156	case 0x33:
	1157	state->m_extra_ram[0x33] = state->m_value0;
	1158	state->m_valueresponse = 0x990000;
	1159	break;
	1160
	1161	case 0x35:
	1162	state->m_extra_ram[0x36] += state->m_value0;
	1163	state->m_valueresponse = 0x990000;
	1164	break;
	1165
	1166	case 0x37:
	1167	state->m_extra_ram[0x33] += state->m_value0;
	1168	state->m_valueresponse = 0x990000;
	1169	break;
	1170
	1171	case 0x34:
	1172	state->m_valueresponse = state->m_extra_ram[0x36];
	1173	break;
	1174
	1175	case 0x38:
	1176	state->m_valueresponse = state->m_extra_ram[0x33];
	1177	break;
	1178
	1179	case 0x80:
	1180	state->m_valueresponse = oldsplus_80[state->m_value0];
	1181	break;
	1182
	1183	case 0xe7:
	1184	state->m_extra_ram[0xe7] = state->m_value0;
	1185	state->m_valueresponse = 0x990000;
	1186	break;
	1187
	1188	case 0xe5:
	1189	switch (state->m_extra_ram[0xe7])
	1190	{
	1191	case 0xb000:
	1192	state->m_ddp3slots[0xb] = state->m_value0;
	1193	state->m_ddp3slots[0xc] = 0;
	1194	break;
	1195
	1196	case 0xc000:
	1197	state->m_ddp3slots[0xc] = state->m_value0;
	1198	break;
	1199
	1200	case 0xd000:
	1201	state->m_ddp3slots[0xd] = state->m_value0;
	1202	break;
	1203
	1204	case 0xf000:
	1205	state->m_ddp3slots[0xf] = state->m_value0;
	1206	break;
	1207	}
	1208	state->m_valueresponse = 0x990000;
	1209	break;
	1210
	1211	case 0xf8:
	1212	state->m_valueresponse = state->m_ddp3slots[state->m_value0];
	1213	break;
	1214
	1215	case 0xfc:
	1216	state->m_valueresponse = oldsplus_fc[state->m_value0];
	1217	break;
	1218
	1219	case 0xc5:
	1220	state->m_ddp3slots[0xd] --;
	1221	state->m_valueresponse = 0x990000;
	1222	break;
	1223
	1224	case 0xd6:
	1225	state->m_ddp3slots[0xb] ++;
	1226	state->m_valueresponse = 0x990000;
	1227	break;
	1228
	1229	case 0x3a:
	1230	state->m_ddp3slots[0xf] = 0;
	1231	state->m_valueresponse = 0x990000;
	1232	break;
	1233
	1234	case 0xf0:
	1235	state->m_extra_ram[0xf0] = state->m_value0;
	1236	state->m_valueresponse = 0x990000;
	1237	break;
	1238
	1239	case 0xed:
	1240	state->m_valueresponse = state->m_value0 << 0x6;
	1241	state->m_valueresponse += state->m_extra_ram[0xf0];
	1242	state->m_valueresponse = state->m_valueresponse << 0x2;
	1243	state->m_valueresponse += 0x900000;
	1244	break;
	1245
	1246	case 0xe0:
	1247	state->m_extra_ram[0xe0] = state->m_value0;
	1248	state->m_valueresponse = 0x990000;
	1249	break;
	1250
	1251	case 0xdc:
	1252	state->m_valueresponse = state->m_value0 << 0x6;
	1253	state->m_valueresponse += state->m_extra_ram[0xe0];
	1254	state->m_valueresponse = state->m_valueresponse << 0x2;
	1255	state->m_valueresponse += 0x904000;
	1256	break;
	1257
	1258	case 0xcb:
	1259	state->m_valueresponse = 0xc000;
	1260	break;
	1261
	1262	case 0xa0:
	1263	state->m_valueresponse = oldsplus_a0[state->m_value0];
	1264	break;
	1265
	1266	case 0xba:
	1267	state->m_valueresponse = oldsplus_ba[state->m_value0];
	1268	break;
	1269
	1270	case 0x5e:
	1271	state->m_valueresponse = oldsplus_5e[state->m_value0];
	1272	break;
	1273
	1274	case 0xb0:
	1275	state->m_valueresponse = oldsplus_b0[state->m_value0];
	1276	break;
	1277
	1278	case 0xae:
	1279	state->m_valueresponse = oldsplus_ae[state->m_value0];
	1280	break;
	1281
	1282	case 0x9d:
	1283	state->m_valueresponse = oldsplus_9d[state->m_value0];
	1284	break;
	1285
	1286	case 0x90:
	1287	state->m_valueresponse = oldsplus_90[state->m_value0];
	1288	break;
	1289
	1290	case 0x8c:
	1291	state->m_valueresponse = oldsplus_8c[state->m_value0];
	1292	break;
	1293
	1294	default:
	1295	state->m_valueresponse = 0x990000;
	1296	printf("%06X: oldsplus_UNKNOWN W CMD %X VAL %X\n", pc,state->m_value1,state->m_value0);
	1297	break;
	1298	}
	1299	}
	1300
	1301	static WRITE16_HANDLER( ddp3_asic_w )
	1302	{
	1303	pgm_kovarmsim_state *state = space->machine().driver_data<pgm_kovarmsim_state>();
	1304	int pc = cpu_get_pc(&space->device());
	1305
	1306	if (offset == 0)
	1307	{
	1308	state->m_value0 = data;
	1309	return;
	1310	}
	1311	else if (offset == 1)
	1312	{
	1313	UINT16 realkey;
	1314	if ((data >> 8) == 0xff)
	1315	state->m_valuekey = 0xff00;
	1316	realkey = state->m_valuekey >> 8;
	1317	realkey \|= state->m_valuekey;
	1318	{
	1319	state->m_valuekey += 0x0100;
	1320	state->m_valuekey &= 0xff00;
	1321	if (state->m_valuekey == 0xff00)
	1322	state->m_valuekey = 0x0100;
	1323	}
	1324	data ^= realkey;
	1325	state->m_value1 = data;
	1326	state->m_value0 ^= realkey;
	1327
	1328	state->m_ddp3lastcommand = state->m_value1 & 0xff;
	1329
	1330	state->arm_sim_handler(state, pc);
	1331	}
	1332	else if (offset==2)
	1333	{
	1334
	1335	}
	1336	}
	1337
	1338
	1339	static READ16_HANDLER( sango_protram_r )
	1340	{
	1341	// at offset == 4 is region (supplied by device)
	1342	// 0 = china
	1343	// 1 = taiwan
	1344	// 2 = japan
	1345	// 3 = korea
	1346	// 4 = hong kong
	1347	// 5 = world
	1348
	1349	if (offset == 4)
	1350	return input_port_read(space->machine(), "Region");
	1351
	1352	// otherwise it doesn't seem to use the ram for anything important, we return 0 to avoid test mode corruption
	1353	// kovplus reads from offset 000e a lot ... why?
	1354	#ifdef MAME_DEBUG
	1355	popmessage ("protection ram r %04x",offset);
	1356	#endif
	1357	return 0x0000;
	1358	}
	1359
	1360	static READ16_HANDLER( pstars_protram_r )
	1361	{
	1362	pgm_kovarmsim_state *state = space->machine().driver_data<pgm_kovarmsim_state>();
	1363
	1364	if (offset == 4) //region
	1365	return input_port_read(space->machine(), "Region");
	1366	else if (offset >= 0x10) //timer
	1367	{
	1368	logerror("PSTARS ACCESS COUNTER %6X\n", state->m_extra_ram[offset - 0x10]);
	1369	return state->m_extra_ram[offset - 0x10]--;
	1370	}
	1371	return 0x0000;
	1372	}
	1373
	1374
	1375	static READ16_HANDLER( puzzli2_protram_r )
	1376	{
	1377	if (offset == 4)
	1378	return input_port_read(space->machine(), "Region");
	1379
	1380	printf("%06x puzzli2_protram_r %02x\n", cpu_get_pc(&space->device()), offset);
	1381
	1382	return 0x0000;
	1383	}
	1384
	1385	static READ16_HANDLER( oldsplus_protram_r )
	1386	{
	1387	if (offset == 4)
	1388	return input_port_read(space->machine(), "Region");
	1389
	1390	return 0x0000;
	1391	}
	1392
	1393	DRIVER_INIT( ddp3 )
	1394	{
	1395	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1396	pgm_basic_init(machine, false);
	1397	pgm_py2k2_decrypt(machine); // yes, it's the same as photo y2k2
	1398	state->arm_sim_handler = command_handler_ddp3;
	1399	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1400	}
	1401
	1402	DRIVER_INIT( ket )
	1403	{
	1404	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1405	pgm_basic_init(machine, false);
	1406	pgm_ket_decrypt(machine);
	1407	state->arm_sim_handler = command_handler_ddp3;
	1408	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x400000, 0x400005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1409	}
	1410
	1411	DRIVER_INIT( espgal )
	1412	{
	1413	pgm_basic_init(machine, false);
	1414	pgm_espgal_decrypt(machine);
	1415	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1416	state->arm_sim_handler = command_handler_ddp3;
	1417	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x400000, 0x400005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1418	}
	1419
	1420	DRIVER_INIT( puzzli2 )
	1421	{
	1422	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1423	pgm_basic_init(machine);
	1424	pgm_puzzli2_decrypt(machine);
	1425	state->arm_sim_handler = command_handler_puzzli2;
	1426	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1427	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4f003f, FUNC(puzzli2_protram_r));
	1428	state->m_irq4_disabled = 1; // // doesn't like this irq??
	1429	}
	1430
	1431	DRIVER_INIT( py2k2 )
	1432	{
	1433	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1434	pgm_basic_init(machine);
	1435	pgm_py2k2_decrypt(machine);
	1436	state->arm_sim_handler = command_handler_py2k2;
	1437	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1438	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4f003f, FUNC(puzzli2_protram_r));
	1439	}
	1440
	1441	DRIVER_INIT( pstar )
	1442	{
	1443	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1444
	1445	pgm_basic_init(machine);
	1446	pgm_pstar_decrypt(machine);
	1447	kovsh_latch_init(machine);
	1448
	1449	state->m_pstar_e7 = 0;
	1450	state->m_pstar_b1 = 0;
	1451	state->m_pstar_ce = 0;
	1452	state->m_extra_ram[0] = 0;
	1453	state->m_extra_ram[1] = 0;
	1454	state->m_extra_ram[2] = 0;
	1455	memset(state->m_ddp3slots, 0, 16);
	1456
	1457	state->arm_sim_handler = command_handler_pstars;
	1458	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1459	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4f003f, FUNC(pstars_protram_r));
	1460
	1461	state->save_item(NAME(state->m_pstar_e7));
	1462	state->save_item(NAME(state->m_pstar_b1));
	1463	state->save_item(NAME(state->m_pstar_ce));
	1464	state->save_item(NAME(state->m_extra_ram));
	1465	}
	1466
	1467	DRIVER_INIT( kov )
	1468	{
	1469	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1470	pgm_basic_init(machine);
	1471	pgm_kov_decrypt(machine);
	1472	kovsh_latch_init(machine);
	1473	kov_internal_slot = 0;
	1474	kov_c0_value = 0;
	1475	kov_cb_value = 0;
	1476	kov_fe_value = 0;
	1477	state->arm_sim_handler = command_handler_kov;
	1478	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1479	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4f003f, FUNC(sango_protram_r));
	1480	}
	1481
	1482	DRIVER_INIT( kovboot )
	1483	{
	1484	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1485	pgm_basic_init(machine);
	1486	// pgm_kov_decrypt(machine);
	1487	kovsh_latch_init(machine);
	1488	kov_internal_slot = 0;
	1489	kov_c0_value = 0;
	1490	kov_cb_value = 0;
	1491	kov_fe_value = 0;
	1492	state->arm_sim_handler = command_handler_kov;
	1493	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1494	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4f003f, FUNC(sango_protram_r));
	1495
	1496	}
	1497
	1498	DRIVER_INIT( oldsplus )
	1499	{
	1500	pgm_kovarmsim_state *state = machine.driver_data<pgm_kovarmsim_state>();
	1501	pgm_basic_init(machine);
	1502	pgm_oldsplus_decrypt(machine);
	1503	kovsh_latch_init(machine);
	1504	memset(state->m_extra_ram, 0, 0x100);
	1505	memset(state->m_ddp3slots, 0, 0x100);
	1506	state->arm_sim_handler = command_handler_oldsplus;
	1507	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
	1508	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4f003f, FUNC(oldsplus_protram_r));
	1509	state_save_register_global_array(machine, state->m_extra_ram);
	1510	state_save_register_global_array(machine, state->m_ddp3slots);
	1511	}
	1512
	1513	INPUT_PORTS_START( photoy2k )
	1514	PORT_INCLUDE ( pgm )
	1515
	1516	PORT_START("RegionHack") /* Region - supplied by protection device */
	1517	PORT_CONFNAME( 0x00ff, 0x00ff, DEF_STR( Region ) )
	1518	PORT_CONFSETTING( 0x0000, DEF_STR( Taiwan ) )
	1519	PORT_CONFSETTING( 0x0001, DEF_STR( China ) )
	1520	PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
	1521	PORT_CONFSETTING( 0x0003, DEF_STR( World ) )
	1522	PORT_CONFSETTING( 0x0004, DEF_STR( Korea ) )
	1523	PORT_CONFSETTING( 0x0005, DEF_STR( Hong_Kong ) )
	1524	PORT_CONFSETTING( 0x00ff, "Untouched" ) // don't hack the region
	1525	INPUT_PORTS_END
	1526
	1527
	1528
	1529	INPUT_PORTS_START( kovsh )
	1530	PORT_INCLUDE ( pgm )
	1531
	1532	PORT_START("RegionHack") /* Region - supplied by protection device */
	1533	PORT_CONFNAME( 0x00ff, 0x00ff, DEF_STR( Region ) )
	1534	PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
	1535	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	1536	PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
	1537	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	1538	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	1539	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	1540	PORT_CONFSETTING( 0x00ff, "Untouched" ) // don't hack the region
	1541	INPUT_PORTS_END
	1542
	1543
	1544
	1545	INPUT_PORTS_START( sango )
	1546	PORT_INCLUDE ( pgm )
	1547
	1548	PORT_MODIFY("Region") /* Region - supplied by protection device */
	1549	PORT_CONFNAME( 0x000f, 0x0005, DEF_STR( Region ) )
	1550	PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
	1551	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	1552	PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
	1553	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	1554	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	1555	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	1556	INPUT_PORTS_END
	1557
	1558	INPUT_PORTS_START( sango_ch )
	1559	PORT_INCLUDE ( pgm )
	1560
	1561	PORT_MODIFY("Region") /* Region - supplied by protection device */
	1562	PORT_CONFNAME( 0x000f, 0x0000, DEF_STR( Region ) )
	1563	PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
	1564	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	1565	PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
	1566	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	1567	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	1568	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	1569	INPUT_PORTS_END
	1570
	1571
	1572	INPUT_PORTS_START( oldsplus )
	1573	PORT_INCLUDE ( pgm )
	1574
	1575	PORT_MODIFY("Region") /* Region - supplied by protection device */
	1576	PORT_CONFNAME( 0x000f, 0x0001, DEF_STR( Region ) )
	1577	PORT_CONFSETTING( 0x0001, DEF_STR( China ) )
	1578	PORT_CONFSETTING( 0x0002, DEF_STR( Japan ) )
	1579	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	1580	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	1581	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	1582	PORT_CONFSETTING( 0x0006, DEF_STR( Taiwan ) )
	1583	INPUT_PORTS_END
	1584
	1585	INPUT_PORTS_START( pstar )
	1586	PORT_INCLUDE ( pgm )
	1587
	1588	PORT_MODIFY("Region") /* Region - supplied by protection device */
	1589	PORT_CONFNAME( 0x000f, 0x0005, DEF_STR( Region ) )
	1590	PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
	1591	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	1592	PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
	1593	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	1594	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	1595	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	1596	INPUT_PORTS_END
	1597
	1598	INPUT_PORTS_START( py2k2 )
	1599	PORT_INCLUDE ( pgm )
	1600
	1601	PORT_MODIFY("Region") /* Region - supplied by protection device */
	1602	PORT_CONFNAME( 0x000f, 0x0003, DEF_STR( Region ) )
	1603	PORT_CONFSETTING( 0x0000, DEF_STR( Taiwan ) )
	1604	PORT_CONFSETTING( 0x0001, DEF_STR( China ) )
	1605	PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
	1606	PORT_CONFSETTING( 0x0003, DEF_STR( World ) )
	1607	PORT_CONFSETTING( 0x0004, DEF_STR( Korea ) )
	1608	PORT_CONFSETTING( 0x0005, DEF_STR( Hong_Kong ) )
	1609	PORT_CONFSETTING( 0x0006, "Singapore, Malaysia" )
	1610	INPUT_PORTS_END
	1611
	1612
	1613	INPUT_PORTS_START( puzzli2 )
	1614	PORT_INCLUDE ( pgm )
	1615
	1616	PORT_MODIFY("Region") /* Region - supplied by protection device */
	1617	PORT_CONFNAME( 0x000f, 0x0005, DEF_STR( Region ) )
	1618	PORT_CONFSETTING( 0x0000, DEF_STR( Taiwan ) )
	1619	PORT_CONFSETTING( 0x0001, DEF_STR( China ) )
	1620	PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
	1621	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	1622	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	1623	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	1624	INPUT_PORTS_END

src/mame/machine/pgmprot2.c
r0	r14799
	1	/***********************************************************************
	2	PGM IGA027A (55857F type) ARM protection emulation
	3
	4	these are emulation of the 'kov2' type ARM device
	5	used by
	6
	7	Knights of Valor 2 (kov2)
	8	Knights of Valor 2 Nine Dragons (kov2p) *
	9	DoDonPachi 2 - Bee Storm (ddp2)
	10	Martial Masters (martmast)
	11
	12	* using a hacked kov2 internal ROM
	13
	14	the following also use this device, but the internal
	15	ROMs are not yet dumped
	16
	17	Dragon World 2001 (dw2001)
	18
	19	----
	20
	21	These games use a larger region of shared RAM than the 55857E
	22	type and have a communication based on interrupts
	23
	24	----
	25
	26	All of these games have an external ARM rom.
	27
	28	The external ARM roms are encrypted, the internal ARM rom uploads
	29	the decryption tables.
	30
	31	Game Region is supplied by internal ARM rom.
	32
	33	***********************************************************************/
	34
	35	#include "emu.h"
	36	#include "includes/pgm.h"
	37
	38
	39	static READ32_HANDLER( arm7_latch_arm_r )
	40	{
	41	pgm_state *state = space->machine().driver_data<pgm_state>();
	42
	43	device_set_input_line(state->m_prot, ARM7_FIRQ_LINE, CLEAR_LINE ); // guess
	44
	45	if (PGMARM7LOGERROR)
	46	logerror("ARM7: Latch read: %08x (%08x) (%06x)\n", state->m_kov2_latchdata_68k_w, mem_mask, cpu_get_pc(&space->device()));
	47	return state->m_kov2_latchdata_68k_w;
	48	}
	49
	50	static WRITE32_HANDLER( arm7_latch_arm_w )
	51	{
	52	pgm_state *state = space->machine().driver_data<pgm_state>();
	53
	54	if (PGMARM7LOGERROR)
	55	logerror("ARM7: Latch write: %08x (%08x) (%06x)\n", data, mem_mask, cpu_get_pc(&space->device()));
	56
	57	COMBINE_DATA(&state->m_kov2_latchdata_arm_w);
	58	}
	59
	60	static READ32_HANDLER( arm7_shareram_r )
	61	{
	62	pgm_state *state = space->machine().driver_data<pgm_state>();
	63
	64	if (PGMARM7LOGERROR)
	65	logerror("ARM7: ARM7 Shared RAM Read: %04x = %08x (%08x) (%06x)\n", offset << 2, state->m_arm7_shareram[offset], mem_mask, cpu_get_pc(&space->device()));
	66	return state->m_arm7_shareram[offset];
	67	}
	68
	69	static WRITE32_HANDLER( arm7_shareram_w )
	70	{
	71	pgm_state *state = space->machine().driver_data<pgm_state>();
	72
	73	if (PGMARM7LOGERROR)
	74	logerror("ARM7: ARM7 Shared RAM Write: %04x = %08x (%08x) (%06x)\n", offset << 2, data, mem_mask, cpu_get_pc(&space->device()));
	75	COMBINE_DATA(&state->m_arm7_shareram[offset]);
	76	}
	77
	78	static READ16_HANDLER( arm7_latch_68k_r )
	79	{
	80	pgm_state *state = space->machine().driver_data<pgm_state>();
	81
	82	if (PGMARM7LOGERROR)
	83	logerror("M68K: Latch read: %04x (%04x) (%06x)\n", state->m_kov2_latchdata_arm_w & 0x0000ffff, mem_mask, cpu_get_pc(&space->device()));
	84	return state->m_kov2_latchdata_arm_w;
	85	}
	86
	87	static WRITE16_HANDLER( arm7_latch_68k_w )
	88	{
	89	pgm_state *state = space->machine().driver_data<pgm_state>();
	90
	91	if (PGMARM7LOGERROR)
	92	logerror("M68K: Latch write: %04x (%04x) (%06x)\n", data & 0x0000ffff, mem_mask, cpu_get_pc(&space->device()));
	93	COMBINE_DATA(&state->m_kov2_latchdata_68k_w);
	94
	95	device_set_input_line(state->m_prot, ARM7_FIRQ_LINE, ASSERT_LINE ); // guess
	96	}
	97
	98	static READ16_HANDLER( arm7_ram_r )
	99	{
	100	pgm_state *state = space->machine().driver_data<pgm_state>();
	101	UINT16 share16 = (UINT16 )state->m_arm7_shareram;
	102
	103	if (PGMARM7LOGERROR)
	104	logerror("M68K: ARM7 Shared RAM Read: %04x = %04x (%08x) (%06x)\n", BYTE_XOR_LE(offset), share16[BYTE_XOR_LE(offset)], mem_mask, cpu_get_pc(&space->device()));
	105	return share16[BYTE_XOR_LE(offset)];
	106	}
	107
	108	static WRITE16_HANDLER( arm7_ram_w )
	109	{
	110	pgm_state *state = space->machine().driver_data<pgm_state>();
	111	UINT16 share16 = (UINT16 )state->m_arm7_shareram;
	112
	113	if (PGMARM7LOGERROR)
	114	logerror("M68K: ARM7 Shared RAM Write: %04x = %04x (%04x) (%06x)\n", BYTE_XOR_LE(offset), data, mem_mask, cpu_get_pc(&space->device()));
	115	COMBINE_DATA(&share16[BYTE_XOR_LE(offset)]);
	116	}
	117
	118	/* 55857F? */
	119	/* Knights of Valor 2, Martial Masters, DoDonpachi 2 */
	120	/* no execute only space? */
	121	static ADDRESS_MAP_START( kov2_mem, AS_PROGRAM, 16)
	122	AM_IMPORT_FROM(pgm_mem)
	123	AM_RANGE(0x100000, 0x5fffff) AM_ROMBANK("bank1") /* Game ROM */
	124	AM_RANGE(0xd00000, 0xd0ffff) AM_READWRITE(arm7_ram_r, arm7_ram_w) /* ARM7 Shared RAM */
	125	AM_RANGE(0xd10000, 0xd10001) AM_READWRITE(arm7_latch_68k_r, arm7_latch_68k_w) /* ARM7 Latch */
	126	ADDRESS_MAP_END
	127
	128
	129	static ADDRESS_MAP_START( 55857F_arm7_map, AS_PROGRAM, 32 )
	130	AM_RANGE(0x00000000, 0x00003fff) AM_ROM
	131	AM_RANGE(0x08000000, 0x083fffff) AM_ROM AM_REGION("user1", 0)
	132	AM_RANGE(0x10000000, 0x100003ff) AM_RAM
	133	AM_RANGE(0x18000000, 0x1800ffff) AM_RAM AM_BASE_MEMBER(pgm_state, m_arm_ram)
	134	AM_RANGE(0x38000000, 0x38000003) AM_READWRITE(arm7_latch_arm_r, arm7_latch_arm_w) /* 68k Latch */
	135	AM_RANGE(0x48000000, 0x4800ffff) AM_READWRITE(arm7_shareram_r, arm7_shareram_w) AM_BASE_MEMBER(pgm_state, m_arm7_shareram)
	136	AM_RANGE(0x50000000, 0x500003ff) AM_RAM
	137	ADDRESS_MAP_END
	138
	139
	140	/***** ARM 55857F *****/
	141
	142	MACHINE_CONFIG_DERIVED( kov2, pgm )
	143	MCFG_CPU_MODIFY("maincpu")
	144	MCFG_CPU_PROGRAM_MAP(kov2_mem)
	145
	146	/* protection CPU */
	147	MCFG_CPU_ADD("prot", ARM7, 20000000) // 55857F
	148	MCFG_CPU_PROGRAM_MAP(55857F_arm7_map)
	149	MACHINE_CONFIG_END
	150
	151
	152
	153
	154	static void kov2_latch_init( running_machine &machine )
	155	{
	156	pgm_state *state = machine.driver_data<pgm_state>();
	157
	158	state->m_kov2_latchdata_68k_w = 0;
	159	state->m_kov2_latchdata_arm_w = 0;
	160
	161	state->save_item(NAME(state->m_kov2_latchdata_68k_w));
	162	state->save_item(NAME(state->m_kov2_latchdata_arm_w));
	163	}
	164
	165	static WRITE32_HANDLER( kov2_arm_region_w )
	166	{
	167	pgm_state *state = space->machine().driver_data<pgm_state>();
	168	int pc = cpu_get_pc(&space->device());
	169	int regionhack = input_port_read(space->machine(), "RegionHack");
	170	if (pc==0x190 && regionhack != 0xff) data = (data & 0xffff0000) \| (regionhack << 0);
	171	COMBINE_DATA(&state->m_arm7_shareram[0x138/4]);
	172	}
	173
	174	DRIVER_INIT( kov2 )
	175	{
	176	pgm_basic_init(machine);
	177	pgm_kov2_decrypt(machine);
	178	kov2_latch_init(machine);
	179
	180	// we only have a HK internal ROM dumped for now, allow us to override that for debugging purposes.
	181	machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_write_handler(0x48000138, 0x4800013b, FUNC(kov2_arm_region_w));
	182	}
	183
	184
	185	DRIVER_INIT( kov2p )
	186	{
	187	// this hacks the identification of the kov2 rom to return the string required for kov2p
	188	// this isn't guaranteed to work properly (and definitely wouldn't on real hardware due to the internal
	189	// ROM uploading the encryption table) The internal ROM should be dumped properly.
	190	pgm_basic_init(machine);
	191	pgm_kov2p_decrypt(machine);
	192	kov2_latch_init(machine);
	193
	194	UINT8 mem8 = (UINT8 )machine.region("user1")->base();
	195	mem8[0xDE] = 0xC0;
	196	mem8[0xDF] = 0x46;
	197	mem8[0x4ED8] = 0xA8;// B0
	198	mem8[0x4EDC] = 0x9C;// A4
	199	mem8[0x4EE0] = 0x5C;// 64
	200	mem8[0x4EE4] = 0x94;// 9C
	201	mem8[0x4EE8] = 0xE8;// F0
	202	mem8[0x4EEC] = 0x6C;// 74
	203	mem8[0x4EF0] = 0xD4;// DC
	204	mem8[0x4EF4] = 0x50;// 58
	205	mem8[0x4EF8] = 0x80;// 88
	206	mem8[0x4EFC] = 0x9C;// A4
	207	mem8[0x4F00] = 0x28;// 30
	208	mem8[0x4F04] = 0x30;// 38
	209	mem8[0x4F08] = 0x34;// 3C
	210	mem8[0x4F0C] = 0x1C;// 24
	211	mem8[0x1FFFFC] = 0x33;
	212	mem8[0x1FFFFD] = 0x99;
	213
	214	// we only have a HK internal ROM dumped for now, allow us to override that for debugging purposes.
	215	machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_write_handler(0x48000138, 0x4800013b, FUNC(kov2_arm_region_w));
	216	}
	217
	218	static WRITE32_HANDLER( martmast_arm_region_w )
	219	{
	220	pgm_state *state = space->machine().driver_data<pgm_state>();
	221	int pc = cpu_get_pc(&space->device());
	222	int regionhack = input_port_read(space->machine(), "RegionHack");
	223	if (pc==0x170 && regionhack != 0xff) data = (data & 0xffff0000) \| (regionhack << 0);
	224	COMBINE_DATA(&state->m_arm7_shareram[0x138/4]);
	225	}
	226
	227
	228	DRIVER_INIT( martmast )
	229	{
	230	pgm_basic_init(machine);
	231	pgm_mm_decrypt(machine);
	232	kov2_latch_init(machine);
	233
	234	// we only have a USA / CHINA internal ROMs dumped for now, allow us to override that for debugging purposes.
	235	machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_write_handler(0x48000138, 0x4800013b, FUNC(martmast_arm_region_w));
	236	}
	237
	238
	239	static WRITE32_HANDLER( ddp2_arm_region_w )
	240	{
	241	pgm_state *state = space->machine().driver_data<pgm_state>();
	242	int pc = cpu_get_pc(&space->device());
	243	int regionhack = input_port_read(space->machine(), "RegionHack");
	244	if (pc==0x0174 && regionhack != 0xff) data = (data & 0x0000ffff) \| (regionhack << 16);
	245	COMBINE_DATA(&state->m_arm7_shareram[0x0]);
	246	}
	247
	248	static READ32_HANDLER( ddp2_speedup_r )
	249	{
	250	pgm_state *state = space->machine().driver_data<pgm_state>();
	251	int pc = cpu_get_pc(&space->device());
	252	UINT32 data = state->m_arm_ram[0x300c/4];
	253
	254	if (pc==0x080109b4)
	255	{
	256	/* if we've hit the loop where this is read and both values are 0 then the only way out is an interrupt */
	257	int r4 = (cpu_get_reg(&space->device(), ARM7_R4));
	258	r4 += 0xe;
	259
	260	if (r4==0x18002f9e)
	261	{
	262	UINT32 data2 = state->m_arm_ram[0x2F9C/4]&0xffff0000;
	263	if ((data==0x00000000) && (data2==0x00000000)) device_spin_until_interrupt(&space->device());
	264	}
	265	}
	266
	267	return data;
	268	}
	269
	270	static READ16_HANDLER( ddp2_main_speedup_r )
	271	{
	272
	273	UINT16 data = pgm_mainram[0x0ee54/2];
	274	int pc = cpu_get_pc(&space->device());
	275
	276	if (pc == 0x149dce) device_spin_until_interrupt(&space->device());
	277	if (pc == 0x149cfe) device_spin_until_interrupt(&space->device());
	278
	279	return data;
	280
	281	}
	282
	283	DRIVER_INIT( ddp2 )
	284	{
	285	pgm_basic_init(machine);
	286	pgm_ddp2_decrypt(machine);
	287	kov2_latch_init(machine);
	288
	289	// we only have a Japan internal ROM dumped for now, allow us to override that for debugging purposes.
	290	machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_write_handler(0x48000000, 0x48000003, FUNC(ddp2_arm_region_w));
	291
	292	machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x1800300c, 0x1800300f, FUNC(ddp2_speedup_r));
	293	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x80ee54, 0x80ee55, FUNC(ddp2_main_speedup_r));
	294	}
	295
	296
	297	DRIVER_INIT( dw2001 )
	298	{
	299	//pgm_state *state = machine.driver_data<pgm_state>();
	300	UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
	301
	302	pgm_basic_init(machine);
	303	kov2_latch_init(machine);
	304	pgm_mm_decrypt(machine); // encryption is the same as martial masters
	305
	306	mem16[0x11e90c / 2] = 0x4e71;
	307	mem16[0x11e90e / 2] = 0x4e71;
	308
	309	mem16[0x11e91a / 2] = 0x4e71;
	310
	311	mem16[0x11eaf6 / 2] = 0x4e71;
	312	mem16[0x11eaf8 / 2] = 0x4e71;
	313
	314	mem16[0x11eb04 / 2] = 0x4e71;
	315
	316	/* patch ARM area with fake code */
	317	UINT16 temp16 = (UINT16 )machine.region("prot")->base();
	318	temp16[(0x0000)/2] = 0xd088;
	319	temp16[(0x0002)/2] = 0xe59f;
	320	temp16[(0x0004)/2] = 0x0680;
	321	temp16[(0x0006)/2] = 0xe3a0;
	322	temp16[(0x0008)/2] = 0x0001;
	323	temp16[(0x000a)/2] = 0xe280;
	324	temp16[(0x000c)/2] = 0xff10;
	325	temp16[(0x000e)/2] = 0xe12f;
	326
	327	temp16[(0x0090)/2] = 0x0400;
	328	temp16[(0x0092)/2] = 0x1000;
	329
	330	}
	331
	332	INPUT_PORTS_START( ddp2 )
	333	PORT_INCLUDE ( pgm )
	334
	335	PORT_START("RegionHack") /* Region - actually supplied by protection device */
	336	PORT_CONFNAME( 0x00ff, 0x00ff, DEF_STR( Region ) )
	337	PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
	338	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	339	PORT_CONFSETTING( 0x0002, "Japan (Cave license)" )
	340	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	341	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	342	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	343	PORT_CONFSETTING( 0x00ff, "Untouched" ) // don't hack the region
	344	INPUT_PORTS_END
	345
	346	INPUT_PORTS_START( kov2 )
	347	PORT_INCLUDE ( pgm )
	348
	349	PORT_START("RegionHack") /* Region - actually supplied by protection device */
	350	PORT_CONFNAME( 0x00ff, 0x00ff, DEF_STR( Region ) )
	351	PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
	352	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	353	PORT_CONFSETTING( 0x0002, "Japan (Cave license)" )
	354	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	355	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	356	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	357	PORT_CONFSETTING( 0x00ff, "Untouched" ) // don't hack the region
	358	INPUT_PORTS_END
	359
	360	INPUT_PORTS_START( martmast )
	361	PORT_INCLUDE ( pgm )
	362
	363	PORT_START("RegionHack") /* Region - actually supplied by protection device */
	364	PORT_CONFNAME( 0x00ff, 0x00ff, DEF_STR( Region ) )
	365	PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
	366	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	367	PORT_CONFSETTING( 0x0002, DEF_STR( Japan ) )
	368	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	369	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	370	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	371	PORT_CONFSETTING( 0x0006, DEF_STR( USA ) )
	372	PORT_CONFSETTING( 0x00ff, "Untouched" ) // don't hack the region
	373	INPUT_PORTS_END
	374
	375
	376	INPUT_PORTS_START( dw2001 )
	377	PORT_INCLUDE ( pgm )
	378
	379	PORT_MODIFY("Region") /* Region - supplied by protection device */
	380	PORT_CONFNAME( 0x000f, 0x0005, DEF_STR( Region ) )
	381	PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
	382	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	383	PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
	384	PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
	385	PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
	386	PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
	387	INPUT_PORTS_END

src/mame/machine/pgmprot.c
r14798	r14799
1		#include "emu.h"
2		#include "includes/pgm.h"
	1	/***********************************************************************
	2	PGM ASIC3 PGM protection emulation
3	3
	4	these are simulations of the IGS 012 and 025 protection combination
	5	used on the following PGM games
4	6
	7	Oriental Legend
5	8
6		/* ~~ASIC27a (Puzzle Star) -- ARM but with no external rom? behaves a bit like KOV~~ */
	9	***********************************************************************/
7	10
	11	#include "emu.h"
	12	#include "includes/pgm.h"
8	13
9		/* (pstarS) */
10
11		static const int pstar_ba[0x1E]={
12		0x02,0x00,0x00,0x01,0x00,0x03,0x00,0x00, //0
13		0x02,0x00,0x06,0x00,0x22,0x04,0x00,0x03, //8
14		0x00,0x00,0x06,0x00,0x20,0x07,0x00,0x03, //10
15		0x00,0x21,0x01,0x00,0x00,0x63
16		};
17
18		static const int pstar_b0[0x10]={
19		0x09,0x0A,0x0B,0x00,0x01,0x02,0x03,0x04,
20		0x05,0x06,0x07,0x08,0x00,0x00,0x00,0x00
21		};
22
23		static const int pstar_ae[0x10]={
24		0x5D,0x86,0x8C ,0x8B,0xE0,0x8B,0x62,0xAF,
25		0xB6,0xAF,0x10A,0xAF,0x00,0x00,0x00,0x00
26		};
27
28		static const int pstar_a0[0x10]={
29		0x02,0x03,0x04,0x05,0x06,0x01,0x0A,0x0B,
30		0x0C,0x0D,0x0E,0x09,0x00,0x00,0x00,0x00,
31		};
32
33		static const int pstar_9d[0x10]={
34		0x05,0x03,0x00,0x00,0x00,0x00,0x00,0x00,
35		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
36		};
37
38		static const int pstar_90[0x10]={
39		0x0C,0x10,0x0E,0x0C,0x00,0x00,0x00,0x00,
40		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
41		};
42		static const int pstar_8c[0x23]={
43		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
44		0x00,0x00,0x00,0x00,0x00,0x01,0x01,0x01,
45		0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,
46		0x02,0x02,0x03,0x03,0x03,0x04,0x04,0x04,
47		0x03,0x03,0x03
48		};
49
50		static const int pstar_80[0x1a3]={
51		0x03,0x03,0x04,0x04,0x04,0x04,0x05,0x05,
52		0x05,0x05,0x06,0x06,0x03,0x03,0x04,0x04,
53		0x05,0x05,0x05,0x05,0x06,0x06,0x07,0x07,
54		0x03,0x03,0x04,0x04,0x05,0x05,0x05,0x05,
55		0x06,0x06,0x07,0x07,0x06,0x06,0x06,0x06,
56		0x06,0x06,0x06,0x07,0x07,0x07,0x07,0x07,
57		0x06,0x06,0x06,0x06,0x06,0x06,0x07,0x07,
58		0x07,0x07,0x08,0x08,0x05,0x05,0x05,0x05,
59		0x05,0x05,0x05,0x06,0x06,0x06,0x07,0x07,
60		0x06,0x06,0x06,0x07,0x07,0x07,0x08,0x08,
61		0x09,0x09,0x09,0x09,0x07,0x07,0x07,0x07,
62		0x07,0x08,0x08,0x08,0x08,0x09,0x09,0x09,
63		0x06,0x06,0x07,0x07,0x07,0x08,0x08,0x08,
64		0x08,0x08,0x09,0x09,0x05,0x05,0x06,0x06,
65		0x06,0x07,0x07,0x08,0x08,0x08,0x08,0x09,
66		0x07,0x07,0x07,0x07,0x07,0x08,0x08,0x08,
67		0x08,0x09,0x09,0x09,0x06,0x06,0x07,0x03,
68		0x07,0x06,0x07,0x07,0x08,0x07,0x05,0x04,
69		0x03,0x03,0x04,0x04,0x05,0x05,0x06,0x06,
70		0x06,0x06,0x06,0x06,0x03,0x04,0x04,0x04,
71		0x04,0x05,0x05,0x06,0x06,0x06,0x06,0x07,
72		0x04,0x04,0x05,0x05,0x06,0x06,0x06,0x06,
73		0x06,0x07,0x07,0x08,0x05,0x05,0x06,0x07,
74		0x07,0x08,0x08,0x08,0x08,0x08,0x08,0x08,
75		0x05,0x05,0x05,0x07,0x07,0x07,0x07,0x07,
76		0x07,0x08,0x08,0x08,0x08,0x08,0x09,0x09,
77		0x09,0x09,0x03,0x04,0x04,0x05,0x05,0x05,
78		0x06,0x06,0x07,0x07,0x07,0x07,0x08,0x08,
79		0x08,0x09,0x09,0x09,0x03,0x04,0x05,0x05,
80		0x04,0x03,0x04,0x04,0x04,0x05,0x05,0x04,
81		0x03,0x03,0x03,0x03,0x03,0x03,0x03,0x03,
82		0x03,0x03,0x03,0x04,0x04,0x04,0x04,0x04,
83		0x04,0x04,0x04,0x04,0x04,0x03,0x03,0x03,
84		0x03,0x03,0x03,0x00,0x00,0x00,0x00,0x00,
85		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
86		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
87		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
88		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
89		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
90		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
91		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
92		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
93		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
94		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
95		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
96		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
97		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
98		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
99		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
100		0x00,0x00,0x00,0x00,0xFF,0x00,0x00,0x00,
101		0x00,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,
102		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
103		0x00,0x00,0x00
104		};
105
106
107
108
109		READ16_HANDLER( pstars_protram_r )
110		{
111		pgm_state *state = space->machine().driver_data<pgm_state>();
112
113		if (offset == 4) //region
114		return input_port_read(space->machine(), "Region");
115		else if (offset >= 0x10) //timer
116		{
117		logerror("PSTARS ACCESS COUNTER %6X\n", state->m_pstar_ram[offset - 0x10]);
118		return state->m_pstar_ram[offset - 0x10]--;
119		}
120		return 0x0000;
121		}
122
123		READ16_HANDLER( pstars_r )
124		{
125		pgm_state *state = space->machine().driver_data<pgm_state>();
126
127		if (offset == 0)
128		{
129		UINT16 d = state->m_pstars_val & 0xffff;
130		UINT16 realkey = state->m_pstars_key >> 8;
131		realkey \|= state->m_pstars_key;
132		d ^= realkey;
133		// logerror("PSTARS A27 R %6X\n", state->m_pstars_val);
134		return d;
135		}
136		else if (offset == 1)
137		{
138		UINT16 d = state->m_pstars_val >> 16;
139		UINT16 realkey = state->m_pstars_key >> 8;
140		realkey \|= state->m_pstars_key;
141		d ^= realkey;
142		return d;
143
144		}
145		return 0xff;
146		}
147
148		WRITE16_HANDLER( pstars_w )
149		{
150		pgm_state *state = space->machine().driver_data<pgm_state>();
151
152		if (offset == 0)
153		{
154		state->m_pstars_int[0] = data;
155		return;
156		}
157
158		if (offset == 1)
159		{
160		UINT16 realkey;
161		if ((data >> 8) == 0xff)
162		state->m_pstars_key = 0xff00;
163		realkey = state->m_pstars_key >> 8;
164		realkey \|= state->m_pstars_key;
165		{
166		state->m_pstars_key += 0x100;
167		state->m_pstars_key &= 0xff00;
168		if (state->m_pstars_key == 0xff00)
169		state->m_pstars_key = 0x100;
170		}
171		data ^= realkey;
172		state->m_pstars_int[1] = data;
173		state->m_pstars_int[0] ^= realkey;
174
175		switch (state->m_pstars_int[1] & 0xff)
176		{
177		case 0x99:
178		state->m_pstars_key = 0x100;
179		state->m_pstars_val = 0x880000;
180		break;
181
182		case 0xe0:
183		state->m_pstars_val = 0xa00000 + (state->m_pstars_int[0] << 6);
184		break;
185
186		case 0xdc:
187		state->m_pstars_val = 0xa00800 + (state->m_pstars_int[0] << 6);
188		break;
189
190		case 0xd0:
191		state->m_pstars_val = 0xa01000 + (state->m_pstars_int[0] << 5);
192		break;
193
194		case 0xb1:
195		state->m_pstar_b1 = state->m_pstars_int[0];
196		state->m_pstars_val = 0x890000;
197		break;
198
199		case 0xbf:
200		state->m_pstars_val = state->m_pstar_b1 * state->m_pstars_int[0];
201		break;
202
203		case 0xc1: //TODO:TIMER 0,1,2,FIX TO 0 should be OK?
204		state->m_pstars_val = 0;
205		break;
206
207		case 0xce: //TODO:TIMER 0,1,2
208		state->m_pstar_ce = state->m_pstars_int[0];
209		state->m_pstars_val=0x890000;
210		break;
211
212		case 0xcf: //TODO:TIMER 0,1,2
213		state->m_pstar_ram[state->m_pstar_ce] = state->m_pstars_int[0];
214		state->m_pstars_val = 0x890000;
215		break;
216
217		case 0xe7:
218		state->m_pstar_e7 = (state->m_pstars_int[0] >> 12) & 0xf;
219		state->m_pstars_regs[state->m_pstar_e7] &= 0xffff;
220		state->m_pstars_regs[state->m_pstar_e7] \|= (state->m_pstars_int[0] & 0xff) << 16;
221		state->m_pstars_val = 0x890000;
222		break;
223
224		case 0xe5:
225		state->m_pstars_regs[state->m_pstar_e7] &= 0xff0000;
226		state->m_pstars_regs[state->m_pstar_e7] \|= state->m_pstars_int[0];
227		state->m_pstars_val = 0x890000;
228		break;
229
230		case 0xf8: //@73C
231		state->m_pstars_val = state->m_pstars_regs[state->m_pstars_int[0] & 0xf] & 0xffffff;
232		break;
233
234		case 0xba:
235		state->m_pstars_val = pstar_ba[state->m_pstars_int[0]];
236		break;
237
238		case 0xb0:
239		state->m_pstars_val = pstar_b0[state->m_pstars_int[0]];
240		break;
241
242		case 0xae:
243		state->m_pstars_val = pstar_ae[state->m_pstars_int[0]];
244		break;
245
246		case 0xa0:
247		state->m_pstars_val = pstar_a0[state->m_pstars_int[0]];
248		break;
249
250		case 0x9d:
251		state->m_pstars_val = pstar_9d[state->m_pstars_int[0]];
252		break;
253
254		case 0x90:
255		state->m_pstars_val = pstar_90[state->m_pstars_int[0]];
256		break;
257
258		case 0x8c:
259		state->m_pstars_val = pstar_8c[state->m_pstars_int[0]];
260		break;
261
262		case 0x80:
263		state->m_pstars_val = pstar_80[state->m_pstars_int[0]];
264		break;
265
266		default:
267		state->m_pstars_val = 0x890000;
268		logerror("PSTARS PC(%06x) UNKNOWN %4X %4X\n", cpu_get_pc(&space->device()), state->m_pstars_int[1], state->m_pstars_int[0]);
269
270		}
271
272		}
273		}
274
275	14	/* ASIC 3 (oriental legends protection) **************************************/
276	15
277	16	static void asic3_compute_hold(running_machine &machine)
r14798	r14799
399	138	state->m_asic3_reg = data & 0xff;
400	139	}
401	140
402		/* Knights of Valour / Sango / PhotoY2k Protection (from ElSemi) (ASIC28) */
403	141
404		static const UINT32 B0TABLE[16] = {2, 0, 1, 4, 3}; //maps char portraits to tables
405	142
406		// photo2yk bonus stage
407		static const UINT32 AETABLE[16]={0x00,0x0a,0x14,
408		0x01,0x0b,0x15,
409		0x02,0x0c,0x16
410		};
411	143
412		//Not sure if BATABLE is complete
413		static const UINT32 BATABLE[0x40]= {
414		0x00,0x29,0x2c,0x35,0x3a,0x41,0x4a,0x4e, //0x00
415		0x57,0x5e,0x77,0x79,0x7a,0x7b,0x7c,0x7d, //0x08
416		0x7e,0x7f,0x80,0x81,0x82,0x85,0x86,0x87, //0x10
417		0x88,0x89,0x8a,0x8b,0x8c,0x8d,0x8e,0x90, //0x18
418		0x95,0x96,0x97,0x98,0x99,0x9a,0x9b,0x9c,
419		0x9e,0xa3,0xd4,0xa9,0xaf,0xb5,0xbb,0xc1
420		};
421	144
	145	/* Oriental Legend INIT */
422	146
423
424		READ16_HANDLER( sango_protram_r )
	147	DRIVER_INIT( orlegend )
425	148	{
426		// at offset == 4 is region (supplied by device)
427		// 0 = china
428		// 1 = taiwan
429		// 2 = japan
430		// 3 = korea
431		// 4 = hong kong
432		// 5 = world
	149	pgm_state *state = machine.driver_data<pgm_state>();
	150	pgm_basic_init(machine);
433	151
434		if (offset == 4)
435		return input_port_read(space->machine(), "Region");
	152	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0xC0400e, 0xC0400f, FUNC(pgm_asic3_r), FUNC(pgm_asic3_w));
	153	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_write_handler(0xC04000, 0xC04001, FUNC(pgm_asic3_reg_w));
436	154
437		// otherwise it doesn't seem to use the ram for anything important, we return 0 to avoid test mode corruption
438		// kovplus reads from offset 000e a lot ... why?
439		#ifdef MAME_DEBUG
440		popmessage ("protection ram r %04x",offset);
441		#endif
442		return 0x0000;
443		}
	155	state->m_asic3_reg = 0;
	156	state->m_asic3_latch[0] = 0;
	157	state->m_asic3_latch[1] = 0;
	158	state->m_asic3_latch[2] = 0;
	159	state->m_asic3_x = 0;
	160	state->m_asic3_y = 0;
	161	state->m_asic3_z = 0;
	162	state->m_asic3_h1 = 0;
	163	state->m_asic3_h2 = 0;
	164	state->m_asic3_hold = 0;
444	165
445		#define BITSWAP10(val,B9,B8,B7,B6,B5,B4,B3,B2,B1,B0) \
446		((BIT(val, B9) << 9) \| \
447		(BIT(val, B8) << 8) \| \
448		(BIT(val, B7) << 7) \| \
449		(BIT(val, B6) << 6) \| \
450		(BIT(val, B5) << 5) \| \
451		(BIT(val, B4) << 4) \| \
452		(BIT(val, B3) << 3) \| \
453		(BIT(val, B2) << 2) \| \
454		(BIT(val, B1) << 1) \| \
455		(BIT(val, B0) << 0))
456
457
458		READ16_HANDLER( asic28_r )
459		{
460		pgm_state *state = space->machine().driver_data<pgm_state>();
461		UINT32 val = (state->m_asic28_regs[1] << 16) \| (state->m_asic28_regs[0]);
462
463		//logerror("Asic28 Read PC = %06x Command = %02x ??\n", cpu_get_pc(&space->device()), state->m_asic28_regs[1]);
464
465		switch (state->m_asic28_regs[1] & 0xff)
466		{
467		case 0x99:
468		val = 0x880000;
469		break;
470
471		case 0x9d: // spr palette
472		val = 0xa00000 + ((state->m_asic28_regs[0] & 0x1f) << 6);
473		break;
474
475		case 0xb0:
476		val = B0TABLE[state->m_asic28_regs[0] & 0xf];
477		break;
478
479		case 0xb4:
480		{
481		//UINT16 tmp = state->m_eoregs[v2];
482		int v2 = state->m_asic28_regs[0] & 0x0f;
483		int v1 = (state->m_asic28_regs[0] & 0x0f00) >> 8;
484		//state->m_eoregs[v2] = state->m_eoregs[v1];
485		//state->m_eoregs[v1] = tmp;
486		if (state->m_asic28_regs[0] == 0x102)
487		state->m_eoregs[1] = state->m_eoregs[0];
488		else
489		state->m_eoregs[v1] = state->m_eoregs[v2];
490
491		val = 0x880000;
492		}
493		break;
494
495		case 0xba:
496		val = BATABLE[state->m_asic28_regs[0] & 0x3f];
497		if (state->m_asic28_regs[0] > 0x2f)
498		popmessage("Unmapped BA com %02x, contact ElSemi / MameDev", state->m_asic28_regs[0]);
499		break;
500
501		case 0xc0:
502		val = 0x880000;
503		break;
504
505		case 0xc3: //TXT tile position Uses C0 to select column
506		val = 0x904000 + (state->m_asic_params[0xc0] + state->m_asic_params[0xc3] * 64) * 4;
507		break;
508
509		case 0xcb:
510		val = 0x880000;
511		break;
512
513		case 0xcc: //BG
514		{
515		int y = state->m_asic_params[0xcc];
516		if (y & 0x400) //y is signed (probably x too and it also applies to TXT, but I've never seen it used)
517		y -= (0x400 - (y & 0x3ff));
518		val = 0x900000 + (((state->m_asic_params[0xcb] + (y) * 64) * 4) /&0x1fff/);
519		}
520		break;
521
522		case 0xd0: //txt palette
523		val = 0xa01000 + (state->m_asic28_regs[0] << 5);
524		break;
525
526		case 0xd6: //???? check it
527		{
528		int v2 = state->m_asic28_regs[0] & 0xf;
529		//int v1 = (state->m_asic28_regs[0] & 0xf0) >> 4;
530		state->m_eoregs[0] = state->m_eoregs[v2];
531		//state->m_eoregs[v2] = 0;
532		val = 0x880000;
533		}
534		break;
535
536		case 0xdc: //bg palette
537		val = 0xa00800 + (state->m_asic28_regs[0] << 6);
538		break;
539
540		case 0xe0: //spr palette
541		val = 0xa00000 + ((state->m_asic28_regs[0] & 0x1f) << 6);
542		break;
543
544		case 0xe5:
545		val = 0x880000;
546		break;
547
548		case 0xe7:
549		val = 0x880000;
550		break;
551
552		case 0xf0:
553		val = 0x00C000;
554		break;
555
556		case 0xf8:
557		val = state->m_eoregs[state->m_asic28_regs[0] & 0xf] & 0xffffff;
558		break;
559
560		case 0xfc: //Adjust damage level to char experience level
561		{
562		val = (state->m_asic_params[0xfc] * state->m_asic_params[0xfe]) >> 6;
563		break;
564		}
565
566		case 0xfe: //todo
567		val = 0x880000;
568		break;
569
570
571		default:
572		val = 0x880000;
573		}
574
575		if(offset == 0)
576		{
577		UINT16 d = val & 0xffff;
578		UINT16 realkey = state->m_asic28_key >> 8;
579		realkey \|= state->m_asic28_key;
580		d ^= realkey;
581		return d;
582		}
583		else if (offset == 1)
584		{
585		UINT16 d = val >> 16;
586		UINT16 realkey = state->m_asic28_key >> 8;
587		realkey \|= state->m_asic28_key;
588		d ^= realkey;
589		state->m_asic28_rcnt++;
590		if (!(state->m_asic28_rcnt & 0xf))
591		{
592		state->m_asic28_key += 0x100;
593		state->m_asic28_key &= 0xff00;
594		}
595		return d;
596		}
597		return 0xff;
	166	state->save_item(NAME(state->m_asic3_reg));
	167	state->save_item(NAME(state->m_asic3_latch));
	168	state->save_item(NAME(state->m_asic3_x));
	169	state->save_item(NAME(state->m_asic3_y));
	170	state->save_item(NAME(state->m_asic3_z));
	171	state->save_item(NAME(state->m_asic3_h1));
	172	state->save_item(NAME(state->m_asic3_h2));
	173	state->save_item(NAME(state->m_asic3_hold));
598	174	}
599	175
600		WRITE16_HANDLER( asic28_w )
601		{
602		pgm_state *state = space->machine().driver_data<pgm_state>();
603	176
604		if (offset == 0)
605		{
606		UINT16 realkey =state->m_asic28_key >> 8;
607		realkey \|= state->m_asic28_key;
608		data ^= realkey;
609		state->m_asic28_regs[0] = data;
610		return;
611		}
612		if (offset == 1)
613		{
614		UINT16 realkey;
	177	INPUT_PORTS_START( orlegend )
	178	PORT_INCLUDE ( pgm )
615	179
616		state->m_asic28_key = data & 0xff00;
	180	PORT_MODIFY("Region")
	181	PORT_DIPNAME( 0x0003, 0x0000, DEF_STR( Region ) )
	182	PORT_CONFSETTING( 0x0000, DEF_STR( World ) )
	183	PORT_CONFSETTING( 0x0001, "World (duplicate)" ) // again?
	184	PORT_CONFSETTING( 0x0002, DEF_STR( Korea ) )
	185	PORT_CONFSETTING( 0x0003, DEF_STR( China ) )
	186	INPUT_PORTS_END
617	187
618		realkey = state->m_asic28_key >> 8;
619		realkey \|= state->m_asic28_key;
620		data ^= realkey;
621		state->m_asic28_regs[1] = data;
622		logerror("ASIC28 CMD %04x PARAM %04x\n", state->m_asic28_regs[1], state->m_asic28_regs[0]);
	188	INPUT_PORTS_START( orld105k )
	189	PORT_INCLUDE ( pgm )
623	190
624		state->m_asic_params[state->m_asic28_regs[1] & 0xff] = state->m_asic28_regs[0];
625		if (state->m_asic28_regs[1] == 0xE7)
626		{
627		UINT32 E0R = (state->m_asic_params[0xe7] >> 12) & 0xf;
628		state->m_eoregs[E0R] &= 0xffff;
629		state->m_eoregs[E0R] \|= state->m_asic28_regs[0] << 16;
630		}
631		if (state->m_asic28_regs[1]==0xE5)
632		{
633		UINT32 E0R = (state->m_asic_params[0xe7] >> 12) & 0xf;
634		state->m_eoregs[E0R] &= 0xff0000;
635		state->m_eoregs[E0R] \|= state->m_asic28_regs[0];
636		}
637		state->m_asic28_rcnt = 0;
638		}
639		}
	191	PORT_MODIFY("Region")
	192	PORT_DIPNAME( 0x0003, 0x0002, DEF_STR( Unused ) ) // region switch
	193	PORT_DIPSETTING( 0x0002, DEF_STR( Off ) ) // if enabled, game gives
	194	PORT_DIPSETTING( 0x0000, DEF_STR( On ) ) // "incorrect version" error
	195	INPUT_PORTS_END
640	196
641		/* Dragon World 2 */
642
643		#define DW2BITSWAP(s,d,bs,bd) d=((d&(~(1<<bd)))\|(((s>>bs)&1)<<bd))
644		//Use this handler for reading from 0xd80000-0xd80002
645		READ16_HANDLER( dw2_d80000_r )
646		{
647		// addr&=0xff;
648		// if(dw2reg<0x20) //NOT SURE!!
649		{
650		//The value at 0x80EECE is computed in the routine at 0x107c18
651		UINT16 d = pgm_mainram[0xEECE/2];
652		UINT16 d2 = 0;
653		d = (d >> 8) \| (d << 8);
654		DW2BITSWAP(d, d2, 7, 0);
655		DW2BITSWAP(d, d2, 4, 1);
656		DW2BITSWAP(d, d2, 5, 2);
657		DW2BITSWAP(d, d2, 2, 3);
658		DW2BITSWAP(d, d2, 15, 4);
659		DW2BITSWAP(d, d2, 1, 5);
660		DW2BITSWAP(d, d2, 10, 6);
661		DW2BITSWAP(d, d2, 13, 7);
662		// ... missing bitswaps here (8-15) there is not enough data to know them
663		// the code only checks the lowest 8 bytes
664		return d2;
665		}
666		}
667
668		/* Dragon World 3
669
670		Dragon World 3 has 2 protection chips
671		ASIC022 and ASIC025
672		one of them also has an external data rom (encrypted?)
673
674		code below is ElSemi's preliminary code, it doesn't work properly and isn't used, much of the protection isn't understood */
675
676		#if 0
677		AddWriteArea(0xda0000,0xdaffff,0,dw3_w8,dw3_w16,dw3_w32);
678		AddReadArea (0xda0000,0xdaffff,0,dw3_r8,dw3_r16,dw3_r32);
679
680		#define DW3BITSWAP(s,d,bs,bd) d=((d&(~(1<<bd)))\|(((s>>bs)&1)<<bd))
681
682		UINT16 dw3_Rw[8];
683		UINT8 dw3_R=(UINT8 ) dw3_Rw;
684
685		UINT8 dw3_r8(UINT32 addr)
686		{
687		if(addr>=0xDA5610 && addr<=0xDA5613)
688		return ((UINT8 ) (dw3_R+((addr-0xDA5610)^1)));
689		return 0;
690		}
691
692		UINT16 dw3_r16(UINT32 addr)
693		{
694		if(addr>=0xDA5610 && addr<=0xDA5613)
695		return ((UINT16 ) (dw3_R+(addr-0xDA5610)));
696		return 0;
697		}
698
699		UINT32 dw3_r32(UINT32 addr)
700		{
701		return 0;
702		}
703
704		void dw3_w8(UINT32 addr,UINT8 val)
705		{
706		if(addr==0xDA5610)
707		dw3_R[1]=val;
708		if(addr==0xDA5611)
709		dw3_R[0]=val;
710		if(addr==0xDA5612)
711		dw3_R[3]=val;
712		if(addr==0xDA5613)
713		dw3_R[2]=val;
714		}
715
716		void dw3_w16(UINT32 addr,UINT16 val)
717		{
718		if(addr>=0xDA5610 && addr<=0xDA5613)
719		{
720		UINT16 s=((UINT16 ) (dw3_R+(addr-0xDA5610)));
721		*s=val;
722		if(addr==0xDA5610)
723		{
724		if(val==1)
725		{
726		UINT16 v1=dw3_Rw[1];
727		UINT16 v2=0;
728		DW3BITSWAP(v1,v2,0,0);
729		DW3BITSWAP(v1,v2,1,1);
730		DW3BITSWAP(v1,v2,7,2);
731		DW3BITSWAP(v1,v2,6,3);
732		DW3BITSWAP(v1,v2,5,4);
733		DW3BITSWAP(v1,v2,4,5);
734		DW3BITSWAP(v1,v2,3,6);
735		DW3BITSWAP(v1,v2,2,7);
736
737		dw3_Rw[1]=v2;
738		}
739		}
740		}
741
742		}
743
744
745		void dw3_w32(UINT32 addr,UINT32 val)
746		{
747
748		}
749		#endif
750
751		/* Oriental Legend Super Plus ARM simulation */
752
753		static const int oldsplus_80[0x5]={
754		0xbb8,0x1770,0x2328,0x2ee0,0xf4240
755		};
756
757		static const int oldsplus_fc[0x20]={
758		0x00,0x00,0x0a,0x3a,0x4e,0x2e,0x03,0x40,
759		0x33,0x43,0x26,0x2c,0x00,0x00,0x00,0x00,
760		0x00,0x00,0x44,0x4d,0xb,0x27,0x3d,0x0f,
761		0x37,0x2b,0x02,0x2f,0x15,0x45,0x0e,0x30
762		};
763
764		static const int oldsplus_a0[0x20]={
765		0x000,0x023,0x046,0x069,0x08c,0x0af,0x0d2,0x0f5,
766		0x118,0x13b,0x15e,0x181,0x1a4,0x1c7,0x1ea,0x20d,
767		0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,
768		0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,0x20d,
769		};
770
771		static const int oldsplus_90[0x7]={
772		0x50,0xa0,0xc8,0xf0,0x190,0x1f4,0x258
773		};
774
775		static const int oldsplus_5e[0x20]={
776		0x04,0x04,0x04,0x04,0x04,0x03,0x03,0x03,
777		0x02,0x02,0x02,0x01,0x01,0x01,0x01,0x01,
778		0x01,0x01,0x01,0x01,0x01,0x00,0x00,0x00,
779		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
780		};
781
782		static const int oldsplus_b0[0xe0]={
783		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
784		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
785		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
786		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
787
788		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
789		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
790		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
791		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
792
793		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
794		0x00,0x00,0x00,0x00,0x01,0x02,0x03,0x04,
795		0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,
796		0x0d,0x0e,0x0f,0x10,0x11,0x12,0x13,0x14,
797
798		0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
799		0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,
800		0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0x10,
801		0x11,0x12,0x13,0x14,0x15,0x16,0x17,0x18,
802
803		0x00,0x00,0x00,0x00,0x01,0x02,0x03,0x04,
804		0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,
805		0x0d,0x0e,0x0f,0x10,0x11,0x12,0x13,0x14,
806		0x15,0x16,0x17,0x18,0x19,0x1a,0x1b,0x1c,
807
808		0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
809		0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,
810		0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,
811		0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,0x1f,
812
813		0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,
814		0x0c,0x0d,0x0e,0x0f,0x10,0x11,0x12,0x13,
815		0x14,0x15,0x16,0x17,0x18,0x19,0x1a,0x1b,
816		0x1c,0x1d,0x1e,0x1f,0x1f,0x1f,0x1f,0x1f
817		};
818
819		static const int oldsplus_ae[0xe0]={
820		0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
821		0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
822		0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
823		0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
824
825		0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
826		0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
827		0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
828		0x50,0x50,0x50,0x50,0x50,0x50,0x50,0x50,
829
830		0x1E,0x1F,0x20,0x21,0x22,0x23,0x23,0x23,
831		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
832		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
833		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
834
835		0x1F,0x20,0x21,0x22,0x23,0x23,0x23,0x23,
836		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
837		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
838		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
839
840		0x20,0x21,0x22,0x23,0x23,0x23,0x23,0x23,
841		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
842		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
843		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
844
845		0x21,0x22,0x23,0x23,0x23,0x23,0x23,0x23,
846		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
847		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
848		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
849
850		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
851		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
852		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23,
853		0x23,0x23,0x23,0x23,0x23,0x23,0x23,0x23
854		};
855
856		static const int oldsplus_ba[0x4]={
857		0x3138,0x2328,0x1C20,0x1518
858		};
859
860		static const int oldsplus_9d[0x111]={
861		0x0000,0x0064,0x00c8,0x012c,0x0190,0x01f4,0x0258,0x02bc,
862		0x02f8,0x0334,0x0370,0x03ac,0x03e8,0x0424,0x0460,0x049c,
863		0x04d8,0x0514,0x0550,0x058c,0x05c8,0x0604,0x0640,0x06bc,
864		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
865		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x0000,
866		0x0064,0x00c8,0x012c,0x0190,0x01f4,0x0258,0x02bc,0x0302,
867		0x0348,0x038e,0x03d4,0x041a,0x0460,0x04a6,0x04ec,0x0532,
868		0x0578,0x05be,0x0604,0x064a,0x0690,0x06d6,0x06bc,0x06bc,
869		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
870		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x0000,0x0064,
871		0x00c8,0x012c,0x0190,0x01f4,0x0258,0x02bc,0x0316,0x0370,
872		0x03ca,0x0424,0x047e,0x04d8,0x0532,0x058c,0x05e6,0x0640,
873		0x069a,0x06f4,0x074e,0x07a8,0x0802,0x06bc,0x06bc,0x06bc,
874		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
875		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x0000,0x0064,0x00c8,
876		0x012c,0x0190,0x01f4,0x0258,0x02bc,0x032a,0x0398,0x0406,
877		0x0474,0x04e2,0x0550,0x05be,0x062c,0x069a,0x0708,0x0776,
878		0x07e4,0x0852,0x08c0,0x092e,0x06bc,0x06bc,0x06bc,0x06bc,
879		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
880		0x06bc,0x06bc,0x06bc,0x06bc,0x0000,0x0064,0x00c8,0x012c,
881		0x0190,0x01f4,0x0258,0x02bc,0x0348,0x03d4,0x0460,0x04ec,
882		0x0578,0x0604,0x0690,0x071c,0x07a8,0x0834,0x08c0,0x094c,
883		0x09d8,0x0a64,0x0af0,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
884		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
885		0x06bc,0x06bc,0x06bc,0x0000,0x0064,0x00c8,0x012c,0x0190,
886		0x01f4,0x0258,0x02bc,0x0384,0x044c,0x0514,0x05dc,0x06a4,
887		0x076c,0x0834,0x08fc,0x09c4,0x0a8c,0x0b54,0x0c1c,0x0ce4,
888		0x0dac,0x0e74,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
889		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
890		0x06bc,0x06bc,0x0000,0x0064,0x00c8,0x012c,0x0190,0x01f4,
891		0x0258,0x02bc,0x030c,0x035c,0x03ac,0x03fc,0x044c,0x049c,
892		0x04ec,0x053c,0x058c,0x05dc,0x062c,0x067c,0x06cc,0x071c,
893		0x076c,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
894		0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,0x06bc,
895		0x06bc
896		};
897
898		static const int oldsplus_8c[0x20]={
899		0x0032,0x0032,0x0064,0x0096,0x0096,0x00fa,0x012c,0x015e,
900		0x0032,0x0064,0x0096,0x00c8,0x00c8,0x012c,0x015e,0x0190,
901		0x0064,0x0096,0x00c8,0x00fa,0x00fa,0x015e,0x0190,0x01c2,
902		0x0096,0x00c8,0x00fa,0x012c,0x012c,0x0190,0x01c2,0x01f4
903		};
904
905		READ16_HANDLER( oldsplus_protram_r )
906		{
907		if (offset == 4)
908		return input_port_read(space->machine(), "Region");
909
910		return 0x0000;
911		}
912
913		READ16_HANDLER( oldsplus_r )
914		{
915		pgm_state *state = space->machine().driver_data<pgm_state>();
916
917		if (offset == 0)
918		{
919		UINT16 d = state->m_oldsplus_val & 0xffff;
920		UINT16 realkey = state->m_oldsplus_key >> 8;
921		realkey \|= state->m_oldsplus_key;
922		d ^= realkey;
923		return d;
924		}
925		else if (offset == 1)
926		{
927		UINT16 d = state->m_oldsplus_val >> 16;
928		UINT16 realkey = state->m_oldsplus_key >> 8;
929		realkey \|= state->m_oldsplus_key;
930		d ^= realkey;
931		return d;
932
933		}
934		return 0xff;
935		}
936
937		WRITE16_HANDLER( oldsplus_w )
938		{
939		pgm_state *state = space->machine().driver_data<pgm_state>();
940
941		if (offset == 0)
942		{
943		state->m_oldsplus_int[0] = data;
944		return;
945		}
946
947		if (offset == 1)
948		{
949		UINT16 realkey;
950		if ((data >> 8) == 0xff)
951		state->m_oldsplus_key = 0xff00;
952		realkey = state->m_oldsplus_key >> 8;
953		realkey \|= state->m_oldsplus_key;
954		{
955		state->m_oldsplus_key += 0x100;
956		state->m_oldsplus_key &= 0xff00;
957		if (state->m_oldsplus_key == 0xff00)
958		state->m_oldsplus_key = 0x100;
959		}
960		data ^= realkey;
961		state->m_oldsplus_int[1] = data;
962		state->m_oldsplus_int[0] ^= realkey;
963
964		switch (state->m_oldsplus_int[1] & 0xff)
965		{
966		case 0x88:
967		state->m_oldsplus_key = 0x100;
968		state->m_oldsplus_val = 0x990000;
969		break;
970
971		case 0xd0:
972		state->m_oldsplus_val = 0xa01000 + (state->m_oldsplus_int[0] << 5);
973		break;
974
975		case 0xc0:
976		state->m_oldsplus_val = 0xa00000 + (state->m_oldsplus_int[0] << 6);
977		break;
978
979		case 0xc3:
980		state->m_oldsplus_val = 0xa00800 + (state->m_oldsplus_int[0] << 6);
981		break;
982
983		case 0x36:
984		state->m_oldsplus_ram[0x36] = state->m_oldsplus_int[0];
985		state->m_oldsplus_val = 0x990000;
986		break;
987
988		case 0x33:
989		state->m_oldsplus_ram[0x33] = state->m_oldsplus_int[0];
990		state->m_oldsplus_val = 0x990000;
991		break;
992
993		case 0x35:
994		state->m_oldsplus_ram[0x36] += state->m_oldsplus_int[0];
995		state->m_oldsplus_val = 0x990000;
996		break;
997
998		case 0x37:
999		state->m_oldsplus_ram[0x33] += state->m_oldsplus_int[0];
1000		state->m_oldsplus_val = 0x990000;
1001		break;
1002
1003		case 0x34:
1004		state->m_oldsplus_val = state->m_oldsplus_ram[0x36];
1005		break;
1006
1007		case 0x38:
1008		state->m_oldsplus_val = state->m_oldsplus_ram[0x33];
1009		break;
1010
1011		case 0x80:
1012		state->m_oldsplus_val = oldsplus_80[state->m_oldsplus_int[0]];
1013		break;
1014
1015		case 0xe7:
1016		state->m_oldsplus_ram[0xe7] = state->m_oldsplus_int[0];
1017		state->m_oldsplus_val = 0x990000;
1018		break;
1019
1020		case 0xe5:
1021		switch (state->m_oldsplus_ram[0xe7])
1022		{
1023		case 0xb000:
1024		state->m_oldsplus_regs[0xb] = state->m_oldsplus_int[0];
1025		state->m_oldsplus_regs[0xc] = 0;
1026		break;
1027
1028		case 0xc000:
1029		state->m_oldsplus_regs[0xc] = state->m_oldsplus_int[0];
1030		break;
1031
1032		case 0xd000:
1033		state->m_oldsplus_regs[0xd] = state->m_oldsplus_int[0];
1034		break;
1035
1036		case 0xf000:
1037		state->m_oldsplus_regs[0xf] = state->m_oldsplus_int[0];
1038		break;
1039		}
1040		state->m_oldsplus_val = 0x990000;
1041		break;
1042
1043		case 0xf8:
1044		state->m_oldsplus_val = state->m_oldsplus_regs[state->m_oldsplus_int[0]];
1045		break;
1046
1047		case 0xfc:
1048		state->m_oldsplus_val = oldsplus_fc[state->m_oldsplus_int[0]];
1049		break;
1050
1051		case 0xc5:
1052		state->m_oldsplus_regs[0xd] --;
1053		state->m_oldsplus_val = 0x990000;
1054		break;
1055
1056		case 0xd6:
1057		state->m_oldsplus_regs[0xb] ++;
1058		state->m_oldsplus_val = 0x990000;
1059		break;
1060
1061		case 0x3a:
1062		state->m_oldsplus_regs[0xf] = 0;
1063		state->m_oldsplus_val = 0x990000;
1064		break;
1065
1066		case 0xf0:
1067		state->m_oldsplus_ram[0xf0] = state->m_oldsplus_int[0];
1068		state->m_oldsplus_val = 0x990000;
1069		break;
1070
1071		case 0xed:
1072		state->m_oldsplus_val = state->m_oldsplus_int[0] << 0x6;
1073		state->m_oldsplus_val += state->m_oldsplus_ram[0xf0];
1074		state->m_oldsplus_val = state->m_oldsplus_val << 0x2;
1075		state->m_oldsplus_val += 0x900000;
1076		break;
1077
1078		case 0xe0:
1079		state->m_oldsplus_ram[0xe0] = state->m_oldsplus_int[0];
1080		state->m_oldsplus_val = 0x990000;
1081		break;
1082
1083		case 0xdc:
1084		state->m_oldsplus_val = state->m_oldsplus_int[0] << 0x6;
1085		state->m_oldsplus_val += state->m_oldsplus_ram[0xe0];
1086		state->m_oldsplus_val = state->m_oldsplus_val << 0x2;
1087		state->m_oldsplus_val += 0x904000;
1088		break;
1089
1090		case 0xcb:
1091		state->m_oldsplus_val = 0xc000;
1092		break;
1093
1094		case 0xa0:
1095		state->m_oldsplus_val = oldsplus_a0[state->m_oldsplus_int[0]];
1096		break;
1097
1098		case 0xba:
1099		state->m_oldsplus_val = oldsplus_ba[state->m_oldsplus_int[0]];
1100		break;
1101
1102		case 0x5e:
1103		state->m_oldsplus_val = oldsplus_5e[state->m_oldsplus_int[0]];
1104		break;
1105
1106		case 0xb0:
1107		state->m_oldsplus_val = oldsplus_b0[state->m_oldsplus_int[0]];
1108		break;
1109
1110		case 0xae:
1111		state->m_oldsplus_val = oldsplus_ae[state->m_oldsplus_int[0]];
1112		break;
1113
1114		case 0x9d:
1115		state->m_oldsplus_val = oldsplus_9d[state->m_oldsplus_int[0]];
1116		break;
1117
1118		case 0x90:
1119		state->m_oldsplus_val = oldsplus_90[state->m_oldsplus_int[0]];
1120		break;
1121
1122		case 0x8c:
1123		state->m_oldsplus_val = oldsplus_8c[state->m_oldsplus_int[0]];
1124		break;
1125
1126		default:
1127		state->m_oldsplus_val = 0x990000;
1128		printf("%06X: oldsplus_UNKNOWN W CMD %X VAL %X\n",cpu_get_pc(&space->device()),state->m_oldsplus_int[1],state->m_oldsplus_int[0]);
1129		break;
1130		}
1131		}
1132		}
1133
1134		/* Old KOV and bootlegs sim ... really these should be read out... */
1135
1136		static const UINT8 kov_BATABLE[0x40] = {
1137		0x00,0x29,0x2c,0x35,0x3a,0x41,0x4a,0x4e,0x57,0x5e,0x77,0x79,0x7a,0x7b,0x7c,0x7d,
1138		0x7e,0x7f,0x80,0x81,0x82,0x85,0x86,0x87,0x88,0x89,0x8a,0x8b,0x8c,0x8d,0x8e,0x90,
1139		0x95,0x96,0x97,0x98,0x99,0x9a,0x9b,0x9c,0x9e,0xa3,0xd4,0xa9,0xaf,0xb5,0xbb,0xc1
1140		};
1141
1142		static const UINT8 kov_B0TABLE[16] = { 2, 0, 1, 4, 3 }; // Maps char portraits to tables
1143
1144		static UINT32 kov_slots[16];
1145		static UINT16 kov_internal_slot;
1146		static UINT16 kov_key;
1147		static UINT32 kov_response;
1148		static UINT16 kov_value;
1149
1150		static UINT16 kov_c0_value;
1151		static UINT16 kov_cb_value;
1152		static UINT16 kov_fe_value;
1153
1154		WRITE16_HANDLER( kov_asic_sim_w )
1155		{
1156		switch ((offset*2) & 0x06)
1157		{
1158		case 0: kov_value = data; return;
1159
1160		case 2:
1161		{
1162		if ((data >> 8) == 0xff) kov_key = 0xffff;
1163
1164		kov_value ^= kov_key;
1165
1166		// bprintf (PRINT_NORMAL, _T("ASIC27 command: %2.2x data: %4.4x\n"), (data ^ kov_key) & 0xff, kov_value);
1167
1168		switch ((data ^ kov_key) & 0xff)
1169		{
1170		case 0x67: // unknown or status check?
1171		case 0x8e:
1172		case 0xa3:
1173		case 0x33: // kovsgqyz (a3)
1174		case 0x3a: // kovplus
1175		case 0xc5: // kovplus
1176		kov_response = 0x880000;
1177		break;
1178
1179		case 0x99: // Reset
1180		kov_response = 0x880000;
1181		kov_key = 0;
1182		break;
1183
1184		case 0x9d: // Sprite palette offset
1185		kov_response = 0xa00000 + ((kov_value & 0x1f) * 0x40);
1186		break;
1187
1188		case 0xb0: // Read from data table
1189		kov_response = kov_B0TABLE[kov_value & 0x0f];
1190		break;
1191
1192		case 0xb4: // Copy slot 'a' to slot 'b'
1193		case 0xb7: // kovsgqyz (b4)
1194		{
1195		kov_response = 0x880000;
1196
1197		if (kov_value == 0x0102) kov_value = 0x0100; // why?
1198
1199		kov_slots[(kov_value >> 8) & 0x0f] = kov_slots[(kov_value >> 0) & 0x0f];
1200		}
1201		break;
1202
1203		case 0xba: // Read from data table
1204		kov_response = kov_BATABLE[kov_value & 0x3f];
1205		break;
1206
1207		case 0xc0: // Text layer 'x' select
1208		kov_response = 0x880000;
1209		kov_c0_value = kov_value;
1210		break;
1211
1212		case 0xc3: // Text layer offset
1213		kov_response = 0x904000 + ((kov_c0_value + (kov_value * 0x40)) * 4);
1214		break;
1215
1216		case 0xcb: // Background layer 'x' select
1217		kov_response = 0x880000;
1218		kov_cb_value = kov_value;
1219		break;
1220
1221		case 0xcc: // Background layer offset
1222		if (kov_value & 0x400) kov_value = -(0x400 - (kov_value & 0x3ff));
1223		kov_response = 0x900000 + ((kov_cb_value + (kov_value * 0x40)) * 4);
1224		break;
1225
1226		case 0xd0: // Text palette offset
1227		case 0xcd: // kovsgqyz (d0)
1228		kov_response = 0xa01000 + (kov_value * 0x20);
1229		break;
1230
1231		case 0xd6: // Copy slot to slot 0
1232		kov_response = 0x880000;
1233		kov_slots[0] = kov_slots[kov_value & 0x0f];
1234		break;
1235
1236		case 0xdc: // Background palette offset
1237		case 0x11: // kovsgqyz (dc)
1238		kov_response = 0xa00800 + (kov_value * 0x40);
1239		break;
1240
1241		case 0xe0: // Sprite palette offset
1242		case 0x9e: // kovsgqyz (e0)
1243		kov_response = 0xa00000 + ((kov_value & 0x1f) * 0x40);
1244		break;
1245
1246		case 0xe5: // Write slot (low)
1247		{
1248		kov_response = 0x880000;
1249
1250		INT32 sel = (kov_internal_slot >> 12) & 0x0f;
1251		kov_slots[sel] = (kov_slots[sel] & 0x00ff0000) \| ((kov_value & 0xffff) << 0);
1252		}
1253		break;
1254
1255		case 0xe7: // Write slot (and slot select) (high)
1256		{
1257		kov_response = 0x880000;
1258		kov_internal_slot = kov_value;
1259
1260		INT32 sel = (kov_internal_slot >> 12) & 0x0f;
1261		kov_slots[sel] = (kov_slots[sel] & 0x0000ffff) \| ((kov_value & 0x00ff) << 16);
1262		}
1263		break;
1264
1265		case 0xf0: // Some sort of status read?
1266		kov_response = 0x00c000;
1267		break;
1268
1269		case 0xf8: // Read slot
1270		case 0xab: // kovsgqyz (f8)
1271		kov_response = kov_slots[kov_value & 0x0f] & 0x00ffffff;
1272		break;
1273
1274		case 0xfc: // Adjust damage level to char experience level
1275		kov_response = (kov_value * kov_fe_value) >> 6;
1276		break;
1277
1278		case 0xfe: // Damage level adjust
1279		kov_response = 0x880000;
1280		kov_fe_value = kov_value;
1281		break;
1282
1283		default:
1284		kov_response = 0x880000;
1285		// bprintf (PRINT_NORMAL, _T("Unknown ASIC27 command: %2.2x data: %4.4x\n"), (data ^ kov_key) & 0xff, kov_value);
1286		break;
1287		}
1288
1289		kov_key = (kov_key + 0x0100) & 0xff00;
1290		if (kov_key == 0xff00) kov_key = 0x0100;
1291		kov_key \|= kov_key >> 8;
1292		}
1293		return;
1294
1295		case 4: return;
1296		}
1297		}
1298
1299		READ16_HANDLER( kov_asic_sim_r )
1300		{
1301		switch ((offset*2) & 0x02)
1302		{
1303		case 0: return (kov_response >> 0) ^ kov_key;
1304		case 2: return (kov_response >> 16) ^ kov_key;
1305		}
1306
1307		return 0;
1308		}
1309
1310		MACHINE_RESET( kov )
1311		{
1312		kov_internal_slot = 0;
1313		kov_key = 0;
1314		kov_response = 0;
1315		kov_value = 0;
1316
1317		kov_c0_value = 0;
1318		kov_cb_value = 0;
1319		kov_fe_value = 0;
1320
1321		cputag_set_input_line(machine, "soundcpu", INPUT_LINE_HALT, ASSERT_LINE);
1322		}
1323
1324		void install_protection_asic_sim_kov(running_machine &machine)
1325		{
1326		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500003, FUNC(kov_asic_sim_r), FUNC(kov_asic_sim_w));
1327		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4fffff, FUNC(sango_protram_r));
1328		}

src/mame/machine/pgmprot3.c
r0	r14799
	1	/***********************************************************************
	2	PGM IGA027A (55857G type) ARM protection emulation
	3
	4	these are emulation of the 'dmnfrnt' type ARM device
	5	used by
	6
	7	Demon Front (dmnfrnt) *1
	8	The Gladiator (theglad)
	9	Spectral vs. Generation (svg)
	10	Happy 6-in-1 (happy6)
	11	The Killing Blade Plus (killbldp) *2
	12
	13	None of these work at all, with the following exception.
	14
	15	*1 - We bypass the internal ROM entirely! Game doesn't jump back
	16	*2 - Partial dump of the internal ROM is used, but 'Execute Only' region is missing
	17
	18	----
	19
	20	These games use a large amount of shared RAM which is banked between CPUs
	21
	22	----
	23
	24	All of these games have an external ARM rom.
	25
	26	The internal ROMs contain an 'execute only' region at the start of the
	27	ROM which prevents reading out.
	28
	29	IGS027A type 55857G has also been seen on various IGS gambling boards
	30	as the main CPU (eg. Haunted House, see igs_m027a)
	31
	32	***********************************************************************/
	33
	34	#include "emu.h"
	35	#include "includes/pgm.h"
	36
	37	static WRITE32_HANDLER( svg_arm7_ram_sel_w )
	38	{
	39	// printf("svg_arm7_ram_sel_w %08x\n", data);
	40	space->machine().scheduler().synchronize(); // force resync
	41
	42	pgm_state *state = space->machine().driver_data<pgm_state>();
	43	state->m_svg_ram_sel = data & 1;
	44	}
	45
	46	static READ32_HANDLER( svg_arm7_shareram_r )
	47	{
	48	pgm_state *state = space->machine().driver_data<pgm_state>();
	49	return state->m_svg_shareram[state->m_svg_ram_sel & 1][offset];
	50	}
	51
	52	static WRITE32_HANDLER( svg_arm7_shareram_w )
	53	{
	54	pgm_state *state = space->machine().driver_data<pgm_state>();
	55	COMBINE_DATA(&state->m_svg_shareram[state->m_svg_ram_sel & 1][offset]);
	56	}
	57
	58	static READ16_HANDLER( svg_m68k_ram_r )
	59	{
	60	pgm_state *state = space->machine().driver_data<pgm_state>();
	61	int ram_sel = (state->m_svg_ram_sel & 1) ^ 1;
	62	UINT16 share16 = (UINT16 )(state->m_svg_shareram[ram_sel & 1]);
	63
	64	return share16[BYTE_XOR_LE(offset)];
	65	}
	66
	67	static WRITE16_HANDLER( svg_m68k_ram_w )
	68	{
	69	pgm_state *state = space->machine().driver_data<pgm_state>();
	70	int ram_sel = (state->m_svg_ram_sel & 1) ^ 1;
	71	UINT16 share16 = (UINT16 )(state->m_svg_shareram[ram_sel & 1]);
	72
	73	COMBINE_DATA(&share16[BYTE_XOR_LE(offset)]);
	74	}
	75
	76	static READ16_HANDLER( svg_68k_nmi_r )
	77	{
	78	return 0;
	79	}
	80
	81	static WRITE16_HANDLER( svg_68k_nmi_w )
	82	{
	83	pgm_state *state = space->machine().driver_data<pgm_state>();
	84	generic_pulse_irq_line(state->m_prot, ARM7_FIRQ_LINE, 1);
	85	}
	86
	87	static WRITE16_HANDLER( svg_latch_68k_w )
	88	{
	89	pgm_state *state = space->machine().driver_data<pgm_state>();
	90	if (PGMARM7LOGERROR)
	91	logerror("M68K: Latch write: %04x (%04x) (%06x)\n", data & 0x0000ffff, mem_mask, cpu_get_pc(&space->device()));
	92	COMBINE_DATA(&state->m_kov2_latchdata_68k_w);
	93	}
	94
	95
	96	static READ16_HANDLER( svg_latch_68k_r )
	97	{
	98	pgm_state *state = space->machine().driver_data<pgm_state>();
	99
	100	if (PGMARM7LOGERROR)
	101	logerror("M68K: Latch read: %04x (%04x) (%06x)\n", state->m_kov2_latchdata_arm_w & 0x0000ffff, mem_mask, cpu_get_pc(&space->device()));
	102	return state->m_kov2_latchdata_arm_w;
	103	}
	104
	105
	106
	107	static READ32_HANDLER( svg_latch_arm_r )
	108	{
	109	pgm_state *state = space->machine().driver_data<pgm_state>();
	110
	111	if (PGMARM7LOGERROR)
	112	logerror("ARM7: Latch read: %08x (%08x) (%06x)\n", state->m_kov2_latchdata_68k_w, mem_mask, cpu_get_pc(&space->device()));
	113	return state->m_kov2_latchdata_68k_w;
	114	}
	115
	116	static WRITE32_HANDLER( svg_latch_arm_w )
	117	{
	118	pgm_state *state = space->machine().driver_data<pgm_state>();
	119
	120	if (PGMARM7LOGERROR)
	121	logerror("ARM7: Latch write: %08x (%08x) (%06x)\n", data, mem_mask, cpu_get_pc(&space->device()));
	122
	123	COMBINE_DATA(&state->m_kov2_latchdata_arm_w);
	124	}
	125
	126	/* 55857G? */
	127	/* Demon Front, The Gladiator, Happy 6-in-1, Spectral Vs. Generation, Killing Blade EX */
	128	/* the ones with an EXECUTE ONLY region of ARM space? */
	129	static ADDRESS_MAP_START( svg_68k_mem, AS_PROGRAM, 16)
	130	AM_IMPORT_FROM(pgm_mem)
	131	AM_RANGE(0x100000, 0x1fffff) AM_ROMBANK("bank1") /* Game ROM */
	132
	133	AM_RANGE(0x500000, 0x51ffff) AM_READWRITE(svg_m68k_ram_r, svg_m68k_ram_w) /* ARM7 Shared RAM */
	134	AM_RANGE(0x5c0000, 0x5c0001) AM_READWRITE(svg_68k_nmi_r, svg_68k_nmi_w) /* ARM7 FIQ */
	135	AM_RANGE(0x5c0300, 0x5c0301) AM_READWRITE(svg_latch_68k_r, svg_latch_68k_w) /* ARM7 Latch */
	136	ADDRESS_MAP_END
	137
	138
	139	static ADDRESS_MAP_START( 55857G_arm7_map, AS_PROGRAM, 32 )
	140	AM_RANGE(0x00000000, 0x00003fff) AM_ROM
	141	AM_RANGE(0x08000000, 0x087fffff) AM_ROM AM_REGION("user1", 0)
	142	AM_RANGE(0x10000000, 0x100003ff) AM_RAM
	143	AM_RANGE(0x18000000, 0x1803ffff) AM_RAM AM_BASE_MEMBER(pgm_state, m_arm_ram)
	144	AM_RANGE(0x38000000, 0x3801ffff) AM_READWRITE(svg_arm7_shareram_r, svg_arm7_shareram_w)
	145	AM_RANGE(0x48000000, 0x48000003) AM_READWRITE(svg_latch_arm_r, svg_latch_arm_w) /* 68k Latch */
	146	AM_RANGE(0x40000018, 0x4000001b) AM_WRITE(svg_arm7_ram_sel_w) /* RAM SEL */
	147	AM_RANGE(0x50000000, 0x500003ff) AM_RAM
	148	ADDRESS_MAP_END
	149
	150
	151	/***** ARM 55857G *****/
	152
	153	MACHINE_CONFIG_DERIVED( svg, pgm )
	154	MCFG_CPU_MODIFY("maincpu")
	155	MCFG_CPU_PROGRAM_MAP(svg_68k_mem)
	156
	157	/* protection CPU */
	158	MCFG_CPU_ADD("prot", ARM7, 33333333) // 55857G
	159	MCFG_CPU_PROGRAM_MAP(55857G_arm7_map)
	160
	161	MACHINE_CONFIG_END
	162
	163
	164
	165	static void svg_basic_init(running_machine &machine)
	166	{
	167	pgm_state *state = machine.driver_data<pgm_state>();
	168
	169	pgm_basic_init(machine);
	170	state->m_svg_shareram[0] = auto_alloc_array(machine, UINT32, 0x10000 / 4);
	171	state->m_svg_shareram[1] = auto_alloc_array(machine, UINT32, 0x10000 / 4);
	172	state->m_svg_ram_sel = 0;
	173
	174	state->save_pointer(NAME(state->m_svg_shareram[0]), 0x10000 / 4);
	175	state->save_pointer(NAME(state->m_svg_shareram[1]), 0x10000 / 4);
	176	state->save_item(NAME(state->m_svg_ram_sel));
	177	}
	178
	179	static void pgm_create_dummy_internal_arm_region(running_machine &machine)
	180	{
	181	UINT16 temp16 = (UINT16 )machine.region("prot")->base();
	182
	183	// fill with RX 14
	184	int i;
	185	for (i=0;i<0x4000/2;i+=2)
	186	{
	187	temp16[i] = 0xff1e;
	188	temp16[i+1] = 0xe12f;
	189
	190	}
	191
	192	// jump straight to external area
	193	temp16[(0x0000)/2] = 0xd088;
	194	temp16[(0x0002)/2] = 0xe59f;
	195	temp16[(0x0004)/2] = 0x0680;
	196	temp16[(0x0006)/2] = 0xe3a0;
	197	temp16[(0x0008)/2] = 0xff10;
	198	temp16[(0x000a)/2] = 0xe12f;
	199	temp16[(0x0090)/2] = 0x0400;
	200	temp16[(0x0092)/2] = 0x1000;
	201	}
	202
	203
	204
	205	static void kov2_latch_init( running_machine &machine )
	206	{
	207	pgm_state *state = machine.driver_data<pgm_state>();
	208
	209	state->m_kov2_latchdata_68k_w = 0;
	210	state->m_kov2_latchdata_arm_w = 0;
	211
	212	state->save_item(NAME(state->m_kov2_latchdata_68k_w));
	213	state->save_item(NAME(state->m_kov2_latchdata_arm_w));
	214	}
	215
	216
	217	DRIVER_INIT( theglad )
	218	{
	219	svg_basic_init(machine);
	220	pgm_theglad_decrypt(machine);
	221	kov2_latch_init(machine);
	222	pgm_create_dummy_internal_arm_region(machine);
	223	}
	224
	225	DRIVER_INIT( svg )
	226	{
	227	svg_basic_init(machine);
	228	pgm_svg_decrypt(machine);
	229	kov2_latch_init(machine);
	230	pgm_create_dummy_internal_arm_region(machine);
	231	}
	232
	233	DRIVER_INIT( svgpcb )
	234	{
	235	svg_basic_init(machine);
	236	pgm_svgpcb_decrypt(machine);
	237	kov2_latch_init(machine);
	238	pgm_create_dummy_internal_arm_region(machine);
	239	}
	240
	241	DRIVER_INIT( killbldp )
	242	{
	243	svg_basic_init(machine);
	244	pgm_killbldp_decrypt(machine);
	245	kov2_latch_init(machine);
	246	}
	247
	248	static READ32_HANDLER( dmnfrnt_speedup_r )
	249	{
	250	pgm_state *state = space->machine().driver_data<pgm_state>();
	251	int pc = cpu_get_pc(&space->device());
	252	if (pc == 0x8000fea) device_eat_cycles(&space->device(), 500);
	253	// else printf("dmn_speedup_r %08x\n", pc);
	254	return state->m_arm_ram[0x000444/4];
	255	}
	256
	257	static READ16_HANDLER( dmnfrnt_main_speedup_r )
	258	{
	259	UINT16 data = pgm_mainram[0xa03c/2];
	260	int pc = cpu_get_pc(&space->device());
	261	if (pc == 0x10193a) device_spin_until_interrupt(&space->device());
	262	else if (pc == 0x1019a4) device_spin_until_interrupt(&space->device());
	263	return data;
	264	}
	265
	266	DRIVER_INIT( dmnfrnt )
	267	{
	268	pgm_state *state = machine.driver_data<pgm_state>();
	269
	270	svg_basic_init(machine);
	271	pgm_dfront_decrypt(machine);
	272	kov2_latch_init(machine);
	273
	274	/* put some fake code for the ARM here ... */
	275	pgm_create_dummy_internal_arm_region(machine);
	276
	277	machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x18000444, 0x18000447, FUNC(dmnfrnt_speedup_r));
	278	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x80a03c, 0x80a03d, FUNC(dmnfrnt_main_speedup_r));
	279
	280	state->m_svg_ram_sel = 1;
	281
	282	// the internal rom probably also supplies the region here
	283	// we have to copy it to both shared ram regions because it reads from a different one before the attract story?
	284	// could be a timing error? or shared ram behavior isn't how we think it is?
	285	UINT16 *share16;
	286	share16 = (UINT16 *)(state->m_svg_shareram[1]);
	287	share16[0x158/2] = 0x0005;
	288	share16 = (UINT16 *)(state->m_svg_shareram[0]);
	289	share16[0x158/2] = 0x0005;
	290	}
	291
	292	DRIVER_INIT( happy6 )
	293	{
	294	svg_basic_init(machine);
	295	pgm_happy6_decrypt(machine);
	296	kov2_latch_init(machine);
	297	pgm_create_dummy_internal_arm_region(machine);
	298	}

src/mame/machine/pgmprot4.c
r0	r14799
	1	/***********************************************************************
	2	PGM 022 + 025 PGM protection emulation
	3
	4	these are simulations of the IGS 022 and 025 protection combination
	5	used on the following PGM games
	6
	7	The Killing Blade
	8	Dragon World 3*
	9	Dragon World 3 EX*
	10
	11	* preliminary, not working
	12
	13	----
	14
	15	IGS022 is an encrypted DMA device, most likely an MCU of some sort
	16
	17	IGS025 is some kind of state machine / logic device which the game
	18	uses for various securit checks, and to determine the region of the
	19	game based on string sequences.
	20
	21	***********************************************************************/
	22
	23	#include "emu.h"
	24	#include "includes/pgm.h"
	25
	26	/* The IGS022 is an MCU which performs encrypted DMA used by
	27	- The Killing Blade
	28	- Dragon World 3
	29
	30	There is also an automatic transfer which happens on startup using params stored in the data ROM.
	31	This has been verified on real hardware running without any 68k game program.
	32
	33	*/
	34
	35
	36	static void IGS022_do_dma(running_machine& machine, UINT16 src, UINT16 dst, UINT16 size, UINT16 mode)
	37	{
	38	pgm_state *state = machine.driver_data<pgm_state>();
	39	UINT16 param;
	40	/*
	41	P_SRC =0x300290 (offset from prot rom base)
	42	P_DST =0x300292 (words from 0x300000)
	43	P_SIZE=0x300294 (words)
	44	P_MODE=0x300296
	45
	46	Mode 5 direct
	47	Mode 6 swap nibbles and bytes
	48
	49	1,2,3 table based ops
	50	*/
	51
	52	//mame_printf_debug("src %04x dst %04x size %04x mode %04x\n", src, dst, size, mode);
	53
	54	//if (src&1) mame_printf_debug("odd offset\n");
	55
	56	param = mode >> 8;
	57	mode &=0xf; // what are the other bits?
	58
	59
	60	if ((mode == 0) \|\| (mode == 1) \|\| (mode == 2) \|\| (mode == 3))
	61	{
	62	/* mode3 applies a xor from a 0x100 byte table to the data being
	63	transferred
	64
	65	the table is stored at the start of the protection rom.
	66
	67	the param used with the mode gives a start offset into the table
	68
	69	odd offsets seem to change the table slightly (see rawDataOdd)
	70
	71	*/
	72
	73	/*
	74	unsigned char rawDataOdd[256] = {
	75	0xB6, 0xA8, 0xB1, 0x5D, 0x2C, 0x5D, 0x4F, 0xC1,
	76	0xCF, 0x39, 0x3A, 0xB7, 0x65, 0x85, 0xD9, 0xEE,
	77	0xDB, 0x7B, 0x5F, 0x81, 0x03, 0x6D, 0xEB, 0x07,
	78	0x0F, 0xB5, 0x61, 0x59, 0xCD, 0x60, 0x06, 0x21,
	79	0xA0, 0x99, 0xDD, 0x27, 0x42, 0xD7, 0xC5, 0x5B,
	80	0x3B, 0xC6, 0x4F, 0xA2, 0x20, 0xF6, 0x61, 0x61,
	81	0x8C, 0x46, 0x8C, 0xCA, 0xE0, 0x0E, 0x2C, 0xE9,
	82	0xBA, 0x0F, 0x45, 0x6D, 0x36, 0x1C, 0x18, 0x37,
	83	0xE7, 0x85, 0x89, 0xA4, 0x94, 0x46, 0x30, 0x9B,
	84	0xB2, 0xF4, 0x41, 0x55, 0xA5, 0x63, 0x1C, 0xEF,
	85	0xB7, 0x18, 0xB3, 0xB1, 0xD4, 0x72, 0xA0, 0x1C,
	86	0x0B, 0x97, 0x02, 0xB6, 0xC5, 0x1F, 0x1B, 0x94,
	87	0xC3, 0x83, 0xAA, 0xAC, 0xD9, 0x44, 0x09, 0xD7,
	88	0x6C, 0xDB, 0x07, 0xA9, 0xAD, 0x64, 0x83, 0xF1,
	89	0x92, 0x09, 0xCD, 0x0E, 0x99, 0x2F, 0xBC, 0xF8,
	90	0x3C, 0x63, 0x8F, 0x0A, 0x33, 0x03, 0x84, 0x91,
	91	0x6C, 0xAC, 0x3A, 0x15, 0xCB, 0x67, 0xC7, 0x69,
	92	0xA1, 0x92, 0x99, 0x74, 0xEE, 0x90, 0x0D, 0xBE,
	93	0x57, 0x30, 0xD1, 0xBA, 0xE5, 0xDE, 0xFA, 0xD6,
	94	0x83, 0x8C, 0xE4, 0x43, 0x36, 0x5E, 0xCD, 0x84,
	95	0x1A, 0x18, 0x31, 0xB9, 0x20, 0x48, 0xE3, 0xA8,
	96	0x89, 0x32, 0xF0, 0x90, 0x21, 0x80, 0x33, 0xAE,
	97	0x3C, 0xA6, 0xB8, 0x8C, 0x72, 0x17, 0xD1, 0x0C,
	98	0x1A, 0x29, 0xFA, 0x38, 0x87, 0xC9, 0x6E, 0xC7,
	99	0x05, 0xDE, 0x85, 0x6E, 0x92, 0x7E, 0xD4, 0xED,
	100	0x5C, 0xD3, 0x03, 0xD4, 0xFE, 0xCB, 0x6C, 0x19,
	101	0x7A, 0x83, 0x79, 0x5B, 0xF6, 0x71, 0xBA, 0xF4,
	102	0x37, 0x53, 0xC9, 0xC1, 0xDE, 0xDB, 0xDE, 0xB1,
	103	0x64, 0x17, 0x31, 0x0E, 0xD7, 0xA2, 0x13, 0x8E,
	104	0x52, 0x8D, 0xCB, 0x19, 0x3D, 0x0B, 0x31, 0x58,
	105	0x4A, 0xDE, 0x0C, 0x01, 0x2B, 0x85, 0x2D, 0xE5,
	106	0x13, 0x22, 0x48, 0xB6, 0xF3, 0x2D, 0x00, 0x9A
	107	};
	108	*/
	109	int x;
	110	UINT16 PROTROM = (UINT16)machine.region("igs022data")->base();
	111
	112	for (x = 0; x < size; x++)
	113	{
	114	//UINT16 RAMDUMP = (UINT16)space->machine().region("user2")->base();
	115	//UINT16 dat = RAMDUMP[dst + x];
	116
	117	UINT16 dat2 = PROTROM[src + x];
	118
	119	UINT8 extraoffset = param&0xfe; // the lowest bit changed the table addressing in tests, see 'rawDataOdd' table instead.. it's still related to the main one, not identical
	120	UINT8* dectable = (UINT8*)machine.region("igs022data")->base();//rawDataEven; // the basic decryption table is at the start of the mcu data rom! at least in killbld
	121	UINT16 extraxor = ((dectable[((x2)+0+extraoffset)&0xff]) << 8) \| (dectable[((x2)+1+extraoffset)&0xff] << 0);
	122
	123	dat2 = ((dat2 & 0x00ff)<<8) \| ((dat2 & 0xff00)>>8);
	124
	125	// mode==0 plain
	126	if (mode==3) dat2 ^= extraxor;
	127	if (mode==2) dat2 += extraxor;
	128	if (mode==1) dat2 -= extraxor;
	129
	130	//if (dat!=dat2)
	131	// printf("Mode %04x Param %04x Mismatch %04x %04x\n", mode, param, dat, dat2);
	132
	133	state->m_sharedprotram[dst + x] = dat2;
	134	}
	135
	136	/* Killing Blade: hack, patches out some additional security checks... we need to emulate them instead! */
	137	// different region IGS025 devices supply different sequences - we currently only have the china sequence for Killing Blade
	138	//if ((mode==3) && (param==0x54) && (src2==0x2120) && (dst2==0x2600)) state->m_sharedprotram[0x2600 / 2] = 0x4e75;
	139
	140	}
	141	if (mode == 4)
	142	{
	143	mame_printf_debug("unhandled copy mode %04x!\n", mode);
	144	// not used by killing blade
	145	/* looks almost like a fixed value xor, but isn't */
	146	}
	147	else if (mode == 5)
	148	{
	149	/* mode 5 seems to be a straight copy */
	150	int x;
	151	UINT16 PROTROM = (UINT16)machine.region("igs022data")->base();
	152	for (x = 0; x < size; x++)
	153	{
	154	UINT16 dat = PROTROM[src + x];
	155
	156
	157	state->m_sharedprotram[dst + x] = dat;
	158	}
	159	}
	160	else if (mode == 6)
	161	{
	162	/* mode 6 seems to swap bytes and nibbles */
	163	int x;
	164	UINT16 PROTROM = (UINT16)machine.region("igs022data")->base();
	165	for (x = 0; x < size; x++)
	166	{
	167	UINT16 dat = PROTROM[src + x];
	168
	169	dat = ((dat & 0xf000) >> 12)\|
	170	((dat & 0x0f00) >> 4)\|
	171	((dat & 0x00f0) << 4)\|
	172	((dat & 0x000f) << 12);
	173
	174	state->m_sharedprotram[dst + x] = dat;
	175	}
	176	}
	177	else if (mode == 7)
	178	{
	179	mame_printf_debug("unhandled copy mode %04x!\n", mode);
	180	// not used by killing blade
	181	/* weird mode, the params get left in memory? - maybe it's a NOP? */
	182	}
	183	else
	184	{
	185	mame_printf_debug("unhandled copy mode %04x!\n", mode);
	186	// not used by killing blade
	187	/* invalid? */
	188
	189	}
	190	}
	191
	192	// the internal MCU boot code automatically does this DMA
	193	// and puts the version # of the data rom in ram
	194	static void IGS022_reset(running_machine& machine)
	195	{
	196	int i;
	197	UINT16 PROTROM = (UINT16)machine.region("igs022data")->base();
	198	pgm_state *state = machine.driver_data<pgm_state>();
	199	UINT16 tmp;
	200
	201	// fill ram with A5 patern
	202	for (i = 0; i < 0x4000/2; i++)
	203	state->m_sharedprotram[i] = 0xa55a;
	204
	205	// the auto-dma
	206	UINT16 src = PROTROM[0x100 / 2];
	207	UINT32 dst = PROTROM[0x102 / 2];
	208	UINT16 size = PROTROM[0x104/ 2];
	209	UINT16 mode = PROTROM[0x106 / 2];
	210
	211	src = ((src & 0xff00) >> 8) \| ((src & 0x00ff) << 8);
	212	dst = ((dst & 0xff00) >> 8) \| ((dst & 0x00ff) << 8);
	213	size = ((size & 0xff00) >> 8) \| ((size & 0x00ff) << 8);
	214	mode &= 0xff;
	215
	216	src >>= 1;
	217
	218	printf("Auto-DMA %04x %04x %04x %04x\n",src,dst,size,mode);
	219
	220	IGS022_do_dma(machine,src,dst,size,mode);
	221
	222	// there is also a version ID? (or is it some kind of checksum) that is stored in the data rom, and gets copied..
	223	// Dragon World 3 checks it
	224	tmp = PROTROM[0x114/2];
	225	tmp = ((tmp & 0xff00) >> 8) \| ((tmp & 0x00ff) << 8);
	226	state->m_sharedprotram[0x2a2/2] = tmp;
	227	}
	228
	229	static void IGS022_handle_command(running_machine& machine)
	230	{
	231	pgm_state *state = machine.driver_data<pgm_state>();
	232	UINT16 cmd = state->m_sharedprotram[0x200/2];
	233	//mame_printf_debug("command %04x\n", cmd);
	234	if (cmd == 0x6d) //Store values to asic ram
	235	{
	236	UINT32 p1 = (state->m_sharedprotram[0x298/2] << 16) \| state->m_sharedprotram[0x29a/2];
	237	UINT32 p2 = (state->m_sharedprotram[0x29c/2] << 16) \| state->m_sharedprotram[0x29e/2];
	238
	239	if ((p2 & 0xffff) == 0x9) //Set value
	240	{
	241	int reg = (p2 >> 16) & 0xffff;
	242	if (reg & 0x200)
	243	state->m_kb_regs[reg & 0xff] = p1;
	244	}
	245	if ((p2 & 0xffff) == 0x6) //Add value
	246	{
	247	int src1 = (p1 >> 16) & 0xff;
	248	int src2 = (p1 >> 0) & 0xff;
	249	int dst = (p2 >> 16) & 0xff;
	250	state->m_kb_regs[dst] = state->m_kb_regs[src2] - state->m_kb_regs[src1];
	251	}
	252	if ((p2 & 0xffff) == 0x1) //Add Imm?
	253	{
	254	int reg = (p2 >> 16) & 0xff;
	255	int imm = (p1 >> 0) & 0xffff;
	256	state->m_kb_regs[reg] += imm;
	257	}
	258	if ((p2 & 0xffff) == 0xa) //Get value
	259	{
	260	int reg = (p1 >> 16) & 0xFF;
	261	state->m_sharedprotram[0x29c/2] = (state->m_kb_regs[reg] >> 16) & 0xffff;
	262	state->m_sharedprotram[0x29e/2] = state->m_kb_regs[reg] & 0xffff;
	263	}
	264	}
	265	if(cmd == 0x4f) //memcpy with encryption / scrambling
	266	{
	267	UINT16 src = state->m_sharedprotram[0x290 / 2] >> 1; // ?
	268	UINT32 dst = state->m_sharedprotram[0x292 / 2];
	269	UINT16 size = state->m_sharedprotram[0x294 / 2];
	270	UINT16 mode = state->m_sharedprotram[0x296 / 2];
	271
	272	IGS022_do_dma(machine, src,dst,size,mode);
	273	}
	274
	275	}
	276
	277
	278	static WRITE16_HANDLER( killbld_igs025_prot_w )
	279	{
	280	// mame_printf_debug("killbrd prot r\n");
	281	// return 0;
	282	pgm_state *state = space->machine().driver_data<pgm_state>();
	283	offset &= 0xf;
	284
	285	if (offset == 0)
	286	state->m_kb_cmd = data;
	287	else //offset==2
	288	{
	289	logerror("%06X: ASIC25 W CMD %X VAL %X\n", cpu_get_pc(&space->device()), state->m_kb_cmd, data);
	290	if (state->m_kb_cmd == 0)
	291	state->m_kb_reg = data;
	292	else if (state->m_kb_cmd == 2)
	293	{
	294	if (data == 1) //Execute cmd
	295	{
	296	IGS022_handle_command(space->machine());
	297	state->m_kb_reg++;
	298	}
	299	}
	300	else if (state->m_kb_cmd == 4)
	301	state->m_kb_ptr = data;
	302	else if (state->m_kb_cmd == 0x20)
	303	state->m_kb_ptr++;
	304	}
	305	}
	306
	307	static READ16_HANDLER( killbld_igs025_prot_r )
	308	{
	309	// mame_printf_debug("killbld prot w\n");
	310	pgm_state *state = space->machine().driver_data<pgm_state>();
	311	UINT16 res ;
	312
	313	offset &= 0xf;
	314	res = 0;
	315
	316	if (offset == 1)
	317	{
	318	if (state->m_kb_cmd == 1)
	319	{
	320	res = state->m_kb_reg & 0x7f;
	321	}
	322	else if (state->m_kb_cmd == 5)
	323	{
	324
	325	UINT8 kb_region_sequence[11] = {0x17, 0x14, 0x91, 0x89, 0x21, 0xD5, 0x7C, 0x65, 0x8F, 0x8E, 0xE1};
	326	UINT8 ret;
	327
	328	// this isn't properly understood.. should be some kind of bitswap / xor / shift..based on values written to 0x22/0x23 etc.?
	329	// return hardcoded china sequence results for now, avoids rom patch
	330	if (state->m_kb_region_sequence_position < 11)
	331	{
	332	ret = kb_region_sequence[state->m_kb_region_sequence_position];
	333	state->m_kb_region_sequence_position++;
	334	}
	335	else
	336	{
	337	UINT32 protvalue = 0x89911400 \| input_port_read(space->machine(), "Region");
	338	ret = (protvalue >> (8 * (state->m_kb_ptr - 1))) & 0xff;
	339	}
	340
	341	res = 0x3f00 \| ret; // always 0x3fxx in logged behavior...
	342
	343	}
	344	}
	345	logerror("%06X: ASIC25 R CMD %X VAL %X\n", cpu_get_pc(&space->device()), state->m_kb_cmd, res);
	346	return res;
	347	}
	348
	349
	350
	351
	352	static MACHINE_RESET( killbld )
	353	{
	354	pgm_state *state = machine.driver_data<pgm_state>();
	355
	356	MACHINE_RESET_CALL(pgm);
	357	/* fill the protection ram with a5 + auto dma */
	358	IGS022_reset(machine);
	359
	360	// Reset IGS025 stuff
	361	state->m_kb_cmd = 0;
	362	state->m_kb_reg = 0;
	363	state->m_kb_ptr = 0;
	364	state->m_kb_region_sequence_position = 0;
	365	memset(state->m_kb_regs, 0, 0x10);
	366
	367	}
	368
	369
	370
	371
	372	DRIVER_INIT( killbld )
	373	{
	374	pgm_state *state = machine.driver_data<pgm_state>();
	375
	376	pgm_basic_init(machine);
	377	pgm_killbld_decrypt(machine);
	378
	379	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0xd40000, 0xd40003, FUNC(killbld_igs025_prot_r), FUNC(killbld_igs025_prot_w));
	380
	381	state->m_kb_cmd = 0;
	382	state->m_kb_reg = 0;
	383	state->m_kb_ptr = 0;
	384	state->m_kb_region_sequence_position = 0;
	385	memset(state->m_kb_regs, 0, 0x10);
	386
	387	state->save_item(NAME(state->m_kb_region_sequence_position));
	388	state->save_item(NAME(state->m_kb_cmd));
	389	state->save_item(NAME(state->m_kb_reg));
	390	state->save_item(NAME(state->m_kb_ptr));
	391	state->save_item(NAME(state->m_kb_regs));
	392	}
	393
	394	static MACHINE_RESET( dw3 )
	395	{
	396	pgm_state *state = machine.driver_data<pgm_state>();
	397
	398
	399	MACHINE_RESET_CALL(pgm);
	400	/* fill the protection ram with a5 + auto dma */
	401	IGS022_reset(machine);
	402
	403	/* game won't boot unless various values are in protection RAM
	404	- these should almost certainly end up there as the result of executing the protection
	405	commands are startup, but which, and how? */
	406
	407	// state->m_sharedprotram[0x200/2] = 0x006d;
	408	state->m_sharedprotram[0x202/2] = 0x007c; // it cares about this, operation status flag?
	409
	410	// state->m_sharedprotram[0x20c/2] = 0x0000;
	411	// state->m_sharedprotram[0x20e/2] = 0x0007;
	412	// state->m_sharedprotram[0x210/2] = 0x0000;
	413	// state->m_sharedprotram[0x212/2] = 0x0004;
	414	// state->m_sharedprotram[0x214/2] = 0x0000;
	415	// state->m_sharedprotram[0x216/2] = 0x0007;
	416	// state->m_sharedprotram[0x218/2] = 0x0000;
	417	// state->m_sharedprotram[0x21a/2] = 0x0004;
	418
	419	// state->m_sharedprotram[0x288/2] = 0x0000;
	420	// state->m_sharedprotram[0x28a/2] = 0x00c2;
	421	// state->m_sharedprotram[0x28c/2] = 0x0000;
	422	// state->m_sharedprotram[0x28e/2] = 0x00c2;
	423	// state->m_sharedprotram[0x290/2] = 0x0500;
	424	// state->m_sharedprotram[0x292/2] = 0x1000;
	425	// state->m_sharedprotram[0x294/2] = 0x00c3;
	426	// state->m_sharedprotram[0x296/2] = 0x7104;
	427	// state->m_sharedprotram[0x298/2] = 0x0000;
	428	// state->m_sharedprotram[0x29a/2] = 0x0003;
	429	// state->m_sharedprotram[0x29c/2] = 0x0108;
	430	// state->m_sharedprotram[0x29e/2] = 0x0009;
	431
	432	// state->m_sharedprotram[0x2a2/2] = 0x84f6; // it cares about this, it's the version number of the data rom, copied automatically!
	433
	434	// state->m_sharedprotram[0x2ac/2] = 0x006d;
	435	// state->m_sharedprotram[0x2ae/2] = 0x0000;
	436
	437	// state->m_sharedprotram[0x2b0/2] = 0xaf56;
	438
	439
	440	// Reset IGS025 stuff
	441	state->m_kb_cmd = 0;
	442	state->m_kb_reg = 0;
	443	state->m_kb_ptr = 0;
	444	state->m_kb_region_sequence_position = 0;
	445	memset(state->m_kb_regs, 0, 0x10);
	446
	447	}
	448
	449
	450
	451	static int reg;
	452	static int ptr=0;
	453
	454	#define DW3BITSWAP(s,d,bs,bd) d=((d&(~(1<<bd)))\|(((s>>bs)&1)<<bd))
	455	static UINT8 dw3_swap;
	456	static WRITE16_HANDLER( drgw3_igs025_prot_w )
	457	{
	458	pgm_state *state = space->machine().driver_data<pgm_state>();
	459
	460	offset&=0xf;
	461
	462	if(offset==0)
	463	state->m_kb_cmd=data;
	464	else //offset==2
	465	{
	466	printf("%06X: ASIC25 W CMD %X VAL %X\n",cpu_get_pc(&space->device()),state->m_kb_cmd,data);
	467	if(state->m_kb_cmd==0)
	468	reg=data;
	469	else if(state->m_kb_cmd==3) //??????????
	470	{
	471	dw3_swap = data;
	472
	473	printf("SWAP %02x\n",dw3_swap);
	474	}
	475	//else if(kb_cmd==4)
	476	// ptr=data;
	477	else if(state->m_kb_cmd==0x20)
	478	ptr++;
	479	}
	480	}
	481
	482	static READ16_HANDLER( drgw3_igs025_prot_r )
	483	{
	484	// mame_printf_debug("killbld prot w\n");
	485	pgm_state *state = space->machine().driver_data<pgm_state>();
	486
	487	UINT16 res ;
	488
	489	offset&=0xf;
	490	res=0;
	491
	492	if(offset==1)
	493	{
	494	if(state->m_kb_cmd==0) //swap
	495	{
	496	UINT8 v1=(dw3_swap+1)&0x7F;
	497	UINT8 v2=0;
	498	DW3BITSWAP(v1,v2,7,0);
	499	DW3BITSWAP(v1,v2,6,1);
	500	DW3BITSWAP(v1,v2,5,2);
	501	DW3BITSWAP(v1,v2,4,3);
	502	DW3BITSWAP(v1,v2,3,4);
	503	DW3BITSWAP(v1,v2,2,5);
	504	DW3BITSWAP(v1,v2,1,6);
	505	DW3BITSWAP(v1,v2,0,7);
	506
	507	res=v2;
	508
	509	}
	510	else if(state->m_kb_cmd==1)
	511	{
	512	res=reg&0x7f;
	513	}
	514	else if(state->m_kb_cmd==5)
	515	{
	516	UINT32 protvalue;
	517	protvalue = 0x60000\|input_port_read(space->machine(), "Region");
	518	res=(protvalue>>(8*(ptr-1)))&0xff;
	519
	520
	521	}
	522	}
	523	logerror("%06X: ASIC25 R CMD %X VAL %X\n",cpu_get_pc(&space->device()),state->m_kb_cmd,res);
	524	return res;
	525	}
	526
	527
	528	DRIVER_INIT( drgw3 )
	529	{
	530	pgm_basic_init(machine);
	531
	532	/*
	533	pgm_state *state = machine.driver_data<pgm_state>();
	534
	535	{
	536	int x;
	537	UINT16 RAMDUMP = (UINT16)machine.region("user2")->base();
	538	for (x=0;x<(0x4000/2);x++)
	539	{
	540	state->m_sharedprotram[x] = RAMDUMP[x];
	541	if((x>=0x100)&&(x<0x110)) printf("data 0x%4x, offset:%x\n",state->m_sharedprotram[x],x);
	542	}
	543	}
	544	*/
	545	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0xDA5610, 0xDA5613, FUNC(drgw3_igs025_prot_r), FUNC(drgw3_igs025_prot_w));
	546
	547	pgm_dw3_decrypt(machine);
	548	}
	549
	550
	551	static ADDRESS_MAP_START( killbld_mem, AS_PROGRAM, 16)
	552	AM_IMPORT_FROM(pgm_mem)
	553	AM_RANGE(0x100000, 0x2fffff) AM_ROMBANK("bank1") /* Game ROM */
	554	AM_RANGE(0x300000, 0x303fff) AM_RAM AM_BASE_MEMBER(pgm_state, m_sharedprotram) // Shared with protection device
	555	ADDRESS_MAP_END
	556
	557
	558
	559	MACHINE_CONFIG_DERIVED( killbld, pgm )
	560	MCFG_CPU_MODIFY("maincpu")
	561	MCFG_CPU_PROGRAM_MAP(killbld_mem)
	562
	563	MCFG_MACHINE_RESET(killbld)
	564	MACHINE_CONFIG_END
	565
	566
	567	MACHINE_CONFIG_DERIVED( dw3, pgm )
	568	MCFG_CPU_MODIFY("maincpu")
	569	MCFG_CPU_PROGRAM_MAP(killbld_mem)
	570
	571	MCFG_MACHINE_RESET(dw3)
	572	MACHINE_CONFIG_END
	573
	574
	575	INPUT_PORTS_START( killbld )
	576	PORT_INCLUDE ( pgm )
	577
	578	PORT_MODIFY("Region") /* Region - supplied by protection device */
	579	PORT_DIPNAME( 0x00ff, 0x0021, "Region (not currently working)" ) // different regions supply different protection code sequences, we only have the China one ATM
	580	PORT_DIPSETTING( 0x0016, DEF_STR( Taiwan ) )
	581	PORT_DIPSETTING( 0x0017, DEF_STR( China ) )
	582	PORT_DIPSETTING( 0x0018, DEF_STR( Hong_Kong ) )
	583	PORT_DIPSETTING( 0x0019, DEF_STR( Japan ) )
	584	// PORT_DIPSETTING( 0x001a, "1a" ) // invalid
	585	// PORT_DIPSETTING( 0x001b, "1b" ) // invalid
	586	// PORT_DIPSETTING( 0x001c, "1c" ) // invalid
	587	// PORT_DIPSETTING( 0x001d, "1d" ) // invalid
	588	// PORT_DIPSETTING( 0x001e, "1e" ) // invalid
	589	// PORT_DIPSETTING( 0x001f, "1f" ) // invalid
	590	PORT_DIPSETTING( 0x0020, DEF_STR( Korea ) )
	591	PORT_DIPSETTING( 0x0021, DEF_STR( World ) )
	592	INPUT_PORTS_END
	593
	594	INPUT_PORTS_START( dw3 )
	595	PORT_INCLUDE ( pgm )
	596
	597	PORT_MODIFY("Region") /* Region - supplied by protection device */
	598	PORT_CONFNAME( 0x000f, 0x0006, DEF_STR( Region ) )
	599	PORT_CONFSETTING( 0x0000, "0" )
	600	PORT_CONFSETTING( 0x0001, "1" )
	601	PORT_CONFSETTING( 0x0002, "2" )
	602	PORT_CONFSETTING( 0x0003, "3" )
	603	PORT_CONFSETTING( 0x0004, "4" )
	604	PORT_CONFSETTING( 0x0005, "5" )
	605	PORT_CONFSETTING( 0x0006, DEF_STR( World ) )
	606	PORT_CONFSETTING( 0x0007, "7" )
	607
	608	INPUT_PORTS_END

src/mame/machine/pgmprot5.c
r0	r14799
	1	/***********************************************************************
	2	PGM 012 + 025 PGM protection emulation
	3
	4	these are simulations of the IGS 012 and 025 protection combination
	5	used on the following PGM games
	6
	7	Dragon World 2
	8
	9	----
	10
	11	IGS012 provides ROM overlay???
	12
	13	IGS025 is some kind of state machine / logic device which the game
	14	uses for various security checks bitswap checks.
	15
	16	Simulation is incomplete for some regions
	17
	18	***********************************************************************/
	19
	20
	21	#include "emu.h"
	22	#include "includes/pgm.h"
	23
	24
	25	/* Dragon World 2 */
	26
	27	#define DW2BITSWAP(s,d,bs,bd) d=((d&(~(1<<bd)))\|(((s>>bs)&1)<<bd))
	28	//Use this handler for reading from 0xd80000-0xd80002
	29	READ16_HANDLER( dw2_d80000_r )
	30	{
	31	// addr&=0xff;
	32	// if(dw2reg<0x20) //NOT SURE!!
	33	{
	34	//The value at 0x80EECE is computed in the routine at 0x107c18
	35	UINT16 d = pgm_mainram[0xEECE/2];
	36	UINT16 d2 = 0;
	37	d = (d >> 8) \| (d << 8);
	38	DW2BITSWAP(d, d2, 7, 0);
	39	DW2BITSWAP(d, d2, 4, 1);
	40	DW2BITSWAP(d, d2, 5, 2);
	41	DW2BITSWAP(d, d2, 2, 3);
	42	DW2BITSWAP(d, d2, 15, 4);
	43	DW2BITSWAP(d, d2, 1, 5);
	44	DW2BITSWAP(d, d2, 10, 6);
	45	DW2BITSWAP(d, d2, 13, 7);
	46	// ... missing bitswaps here (8-15) there is not enough data to know them
	47	// the code only checks the lowest 8 bytes
	48	return d2;
	49	}
	50	}
	51
	52
	53
	54	static void drgwld2_common_init(running_machine &machine)
	55	{
	56	pgm_basic_init(machine);
	57	pgm_dw2_decrypt(machine);
	58	/*
	59	Info from Elsemi
	60	Here is how to "bypass" the dw2 hang protection, it fixes the mode
	61	select and after failing in the 2nd stage (probably there are other checks
	62	out there).
	63	*/
	64	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0xd80000, 0xd80003, FUNC(dw2_d80000_r));
	65	}
	66
	67	DRIVER_INIT( drgw2 )
	68	{ /* incomplete? */
	69	UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
	70	drgwld2_common_init(machine);
	71	/* These ROM patches are not hacks, the protection device
	72	overlays the normal ROM code, this has been confirmed on a real PCB
	73	although some addresses may be missing */
	74	mem16[0x131098 / 2] = 0x4e93;
	75	mem16[0x13113e / 2] = 0x4e93;
	76	mem16[0x1311ce / 2] = 0x4e93;
	77	}
	78
	79	DRIVER_INIT( dw2v100x )
	80	{
	81	UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
	82	drgwld2_common_init(machine);
	83
	84	mem16[0x131084 / 2] = 0x4e93;
	85	mem16[(0x131084+0xa6) / 2] = 0x4e93;
	86	mem16[(0x131084+0x136) / 2] = 0x4e93;
	87	}
	88
	89	DRIVER_INIT( drgw2c )
	90	{
	91	UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
	92	drgwld2_common_init(machine);
	93	/* These ROM patches are not hacks, the protection device
	94	overlays the normal ROM code, this has been confirmed on a real PCB
	95	although some addresses may be missing */
	96	mem16[0x1303bc / 2] = 0x4e93;
	97	mem16[0x130462 / 2] = 0x4e93;
	98	mem16[0x1304f2 / 2] = 0x4e93;
	99	}
	100
	101	DRIVER_INIT( drgw2j )
	102	{
	103	UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
	104	drgwld2_common_init(machine);
	105	/* These ROM patches are not hacks, the protection device
	106	overlays the normal ROM code, this has been confirmed on a real PCB
	107	although some addresses may be missing */
	108	mem16[0x1302c0 / 2] = 0x4e93;
	109	mem16[0x130366 / 2] = 0x4e93;
	110	mem16[0x1303f6 / 2] = 0x4e93;
	111	}
	112

src/mame/machine/pgmprot6.c
r0	r14799
	1	/***********************************************************************
	2	PGM 012 + 28 PGM protection emulation
	3
	4	these are simulations of the IGS 012 and 025 protection combination
	5	used on the following PGM games
	6
	7	Oriental Legend Super
	8
	9	----
	10
	11	IGS28 is some kind of encrypted DMA device, works with data in an
	12	external ROM, more advaned version of IGS022?
	13
	14	IGS025 is some kind of state machine, bitswaps etc.
	15
	16	Simulation is incomplete
	17
	18	***********************************************************************/
	19
	20	#include "emu.h"
	21	#include "includes/pgm.h"
	22
	23	static UINT32 olds_prot_addr( UINT16 addr )
	24	{
	25	UINT32 mode = addr & 0xff;
	26	UINT32 offset = addr >> 8;
	27	UINT32 realaddr;
	28
	29	switch(mode)
	30	{
	31	case 0x0:
	32	case 0x5:
	33	case 0xa:
	34	realaddr = 0x402a00 + (offset << 2);
	35	break;
	36
	37	case 0x2:
	38	case 0x8:
	39	realaddr = 0x402e00 + (offset << 2);
	40	break;
	41
	42	case 0x1:
	43	realaddr = 0x40307e;
	44	break;
	45
	46	case 0x3:
	47	realaddr = 0x403090;
	48	break;
	49
	50	case 0x4:
	51	realaddr = 0x40309a;
	52	break;
	53
	54	case 0x6:
	55	realaddr = 0x4030a4;
	56	break;
	57
	58	case 0x7:
	59	realaddr = 0x403000;
	60	break;
	61
	62	case 0x9:
	63	realaddr = 0x40306e;
	64	break;
	65
	66	default:
	67	realaddr = 0;
	68	}
	69	return realaddr;
	70	}
	71
	72	static UINT32 olds_read_reg( running_machine &machine, UINT16 addr )
	73	{
	74	pgm_state *state = machine.driver_data<pgm_state>();
	75	UINT32 protaddr = (olds_prot_addr(addr) - 0x400000) / 2;
	76	return state->m_sharedprotram[protaddr] << 16 \| state->m_sharedprotram[protaddr + 1];
	77	}
	78
	79	static void olds_write_reg( running_machine &machine, UINT16 addr, UINT32 val )
	80	{
	81	pgm_state *state = machine.driver_data<pgm_state>();
	82	state->m_sharedprotram[(olds_prot_addr(addr) - 0x400000) / 2] = val >> 16;
	83	state->m_sharedprotram[(olds_prot_addr(addr) - 0x400000) / 2 + 1] = val & 0xffff;
	84	}
	85
	86	static MACHINE_RESET( olds )
	87	{
	88	pgm_state *state = machine.driver_data<pgm_state>();
	89	UINT16 mem16 = (UINT16 )machine.region("user2")->base();
	90	int i;
	91
	92	MACHINE_RESET_CALL(pgm);
	93
	94	/* populate shared protection ram with data read from pcb .. */
	95	for (i = 0; i < 0x4000 / 2; i++)
	96	{
	97	state->m_sharedprotram[i] = mem16[i];
	98	}
	99
	100	//ROM:004008B4 .word 0xFBA5
	101	for(i = 0; i < 0x4000 / 2; i++)
	102	{
	103	if (state->m_sharedprotram[i] == (0xffff - i))
	104	state->m_sharedprotram[i] = 0x4e75;
	105	}
	106	}
	107
	108	static READ16_HANDLER( olds_r )
	109	{
	110	pgm_state *state = space->machine().driver_data<pgm_state>();
	111	UINT16 res = 0;
	112
	113	if (offset == 1)
	114	{
	115	if (state->m_kb_cmd == 1)
	116	res = state->m_kb_reg & 0x7f;
	117	if (state->m_kb_cmd == 2)
	118	res = state->m_olds_bs \| 0x80;
	119	if (state->m_kb_cmd == 3)
	120	res = state->m_olds_cmd3;
	121	else if (state->m_kb_cmd == 5)
	122	{
	123	UINT32 protvalue = 0x900000 \| input_port_read(space->machine(), "Region"); // region from protection device.
	124	res = (protvalue >> (8 * (state->m_kb_ptr - 1))) & 0xff; // includes region 1 = taiwan , 2 = china, 3 = japan (title = orlegend special), 4 = korea, 5 = hongkong, 6 = world
	125
	126	}
	127	}
	128	logerror("%06X: ASIC25 R CMD %X VAL %X\n", cpu_get_pc(&space->device()), state->m_kb_cmd, res);
	129	return res;
	130	}
	131
	132	static WRITE16_HANDLER( olds_w )
	133	{
	134	pgm_state *state = space->machine().driver_data<pgm_state>();
	135	if (offset == 0)
	136	state->m_kb_cmd = data;
	137	else //offset==2
	138	{
	139	logerror("%06X: ASIC25 W CMD %X VAL %X\n",cpu_get_pc(&space->device()), state->m_kb_cmd, data);
	140	if (state->m_kb_cmd == 0)
	141	state->m_kb_reg = data;
	142	else if(state->m_kb_cmd == 2) //a bitswap=
	143	{
	144	int reg = 0;
	145	if (data & 0x01)
	146	reg \|= 0x40;
	147	if (data & 0x02)
	148	reg \|= 0x80;
	149	if (data & 0x04)
	150	reg \|= 0x20;
	151	if (data & 0x08)
	152	reg \|= 0x10;
	153	state->m_olds_bs = reg;
	154	}
	155	else if (state->m_kb_cmd == 3)
	156	{
	157	UINT16 cmd = state->m_sharedprotram[0x3026 / 2];
	158	switch (cmd)
	159	{
	160	case 0x11:
	161	case 0x12:
	162	break;
	163	case 0x64:
	164	{
	165	UINT16 cmd0 = state->m_sharedprotram[0x3082 / 2];
	166	UINT16 val0 = state->m_sharedprotram[0x3050 / 2]; //CMD_FORMAT
	167	{
	168	if ((cmd0 & 0xff) == 0x2)
	169	olds_write_reg(space->machine(), val0, olds_read_reg(space->machine(), val0) + 0x10000);
	170	}
	171	break;
	172	}
	173
	174	default:
	175	break;
	176	}
	177	state->m_olds_cmd3 = ((data >> 4) + 1) & 0x3;
	178	}
	179	else if (state->m_kb_cmd == 4)
	180	state->m_kb_ptr = data;
	181	else if(state->m_kb_cmd == 0x20)
	182	state->m_kb_ptr++;
	183	}
	184	}
	185
	186	static READ16_HANDLER( olds_prot_swap_r )
	187	{
	188	if (cpu_get_pc(&space->device()) < 0x100000) //bios
	189	return pgm_mainram[0x178f4 / 2];
	190	else //game
	191	return pgm_mainram[0x178d8 / 2];
	192
	193	}
	194
	195	DRIVER_INIT( olds )
	196	{
	197	pgm_state *state = machine.driver_data<pgm_state>();
	198	pgm_basic_init(machine);
	199
	200	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0xdcb400, 0xdcb403, FUNC(olds_r), FUNC(olds_w));
	201	machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x8178f4, 0x8178f5, FUNC(olds_prot_swap_r));
	202
	203	state->m_kb_cmd = 0;
	204	state->m_kb_reg = 0;
	205	state->m_kb_ptr = 0;
	206	state->m_olds_bs = 0;
	207	state->m_olds_cmd3 = 0;
	208
	209	state->save_item(NAME(state->m_kb_cmd));
	210	state->save_item(NAME(state->m_kb_reg));
	211	state->save_item(NAME(state->m_kb_ptr));
	212	state->save_item(NAME(state->m_olds_bs));
	213	state->save_item(NAME(state->m_olds_cmd3));
	214	}
	215
	216	static ADDRESS_MAP_START( olds_mem, AS_PROGRAM, 16)
	217	AM_IMPORT_FROM(pgm_mem)
	218	AM_RANGE(0x100000, 0x3fffff) AM_ROMBANK("bank1") /* Game ROM */
	219	AM_RANGE(0x400000, 0x403fff) AM_RAM AM_BASE_MEMBER(pgm_state, m_sharedprotram) // Shared with protection device
	220	ADDRESS_MAP_END
	221
	222
	223	MACHINE_CONFIG_DERIVED( olds, pgm )
	224	MCFG_CPU_MODIFY("maincpu")
	225	MCFG_CPU_PROGRAM_MAP(olds_mem)
	226
	227	MCFG_MACHINE_RESET(olds)
	228	MACHINE_CONFIG_END
	229
	230
	231	INPUT_PORTS_START( olds )
	232	PORT_INCLUDE ( pgm )
	233
	234	PORT_MODIFY("Region") /* Region - supplied by protection device */
	235	PORT_CONFNAME( 0x000f, 0x0006, DEF_STR( Region ) )
	236	/* includes the following regions:
	237	1 = taiwan, 2 = china, 3 = japan (title = orlegend special),
	238	4 = korea, 5 = hong kong, 6 = world */
	239	PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
	240	PORT_CONFSETTING( 0x0002, DEF_STR( China ) )
	241	PORT_CONFSETTING( 0x0003, DEF_STR( Japan ) )
	242	PORT_CONFSETTING( 0x0004, DEF_STR( Korea ) )
	243	PORT_CONFSETTING( 0x0005, DEF_STR( Hong_Kong ) )
	244	PORT_CONFSETTING( 0x0006, DEF_STR( World ) )
	245	INPUT_PORTS_END

src/mame/machine/r2crypt.c
r14798	r14799
110	110	unsigned int x;
111	111	int idx = i & 0xff;
112	112	int i1, i2;
113
	113
114	114	if(i & 0x008000)
115	115	idx ^= 1;
116	116	if(i & 0x100000)
r14798	r14799
153	153	x ^= 0x00020080;
154	154	if(bt(xmap_high_15, i2))
155	155	x ^= 0x20000002;
156
	156
157	157	if(i & 0x010000)
158	158	x ^= 0xaa00000f;
159	159	if(i & 0x020000)
r14798	r14799
169	169	static UINT32 trans(UINT32 v, UINT32 x)
170	170	{
171	171	unsigned y,r2,v2;
172
	172
173	173	v2 = (BIT(v,30)<<8)\|(BIT(v,22)<<12)\|(BIT(v,18)<<18)\|(BIT(v,19)<<19)\|(BIT(v,22)<<22)\|(BIT(v,24)<<24)\|(BIT(v,3)<<25)\|(BIT(v,26)<<26)\|(BIT(v,28)<<28);
174	174	v2 ^= 0x01000000;
175
	175
176	176	r2 = 0;
177	177	y = 0;
178	178
r14798	r14799
208	208	y \|= (( 0 ^ BIT(x,29) ^ BIT(v,29))<<29);
209	209	y \|= (( 0 ^ BIT(x,30) ^ BIT(v,30))<<30);
210	210	y \|= (( 0 ^ BIT(x,31) ^ BIT(v,31))<<31);
211
212
	211
	212
213	213	r2 \|= ( 0<< 0);
214	214	r2 \|= ( 0<< 1);
215	215	r2 \|= ( 0<< 2);
r14798	r14799
242	242	r2 \|= ((BIT(v2,28)&BIT(y,28))<<29);
243	243	r2 \|= ( 0<<30);
244	244	r2 \|= ( 0<<31);
245
	245
246	246	r2 ^= y;
247	247	r2 ^= 0x0c500000;
248	248

src/mame/machine/seicop.c
r14798	r14799
1744	1744	{
1745	1745	int low = v & 0x001f;
1746	1746	int high = v & 0x03e0;
1747
1748		return (low * (high \| (high >> 5)) + 0x210) >> 10;
	1747
	1748	return (low * (high \| (high >> 5)) + 0x210) >> 10;
1749	1749	}
1750	1750
1751	1751	static UINT16 u1,u2;

src/mame/includes/pgm.h
r14798	r14799
1	1
	2	#include "machine/v3021.h"
	3	#include "cpu/z80/z80.h"
	4	#include "cpu/m68000/m68000.h"
	5	#include "cpu/arm7/arm7.h"
	6	#include "sound/ics2115.h"
	7	#include "cpu/arm7/arm7core.h"
	8	#include "machine/nvram.h"
	9
	10	#define PGMARM7LOGERROR 0
	11
2	12	class pgm_state : public driver_device
3	13	{
4	14	public:
r14798	r14799
72	82	UINT32 m_kb_regs[0x10];
73	83	UINT16 m_olds_bs;
74	84	UINT16 m_olds_cmd3;
75		// pstars
76		UINT16 m_pstars_key;
77		UINT16 m_pstars_int[2];
78		UINT32 m_pstars_regs[16];
79		UINT32 m_pstars_val;
80		UINT16 m_pstar_e7;
81		UINT16 m_pstar_b1;
82		UINT16 m_pstar_ce;
83		UINT16 m_pstar_ram[3];
84	85	// ASIC 3 (oriental legends protection)
85	86	UINT8 m_asic3_reg;
86	87	UINT8 m_asic3_latch[3];
r14798	r14799
90	91	UINT8 m_asic3_h1;
91	92	UINT8 m_asic3_h2;
92	93	UINT16 m_asic3_hold;
93		// ASIC28
94		UINT16 m_asic28_key;
95		UINT16 m_asic28_regs[10];
96		UINT16 m_asic_params[256];
97		UINT16 m_asic28_rcnt;
98		UINT32 m_eoregs[16];
99		// Oldsplus simulation
100		UINT16 m_oldsplus_key;
101		UINT16 m_oldsplus_int[2];
102		UINT32 m_oldsplus_val;
103		UINT16 m_oldsplus_ram[0x100];
104		UINT32 m_oldsplus_regs[0x100];
105	94
106	95	UINT32* m_arm_ram;
107	96
108	97	};
109	98
	99	/* for machine/pgmprot1.c type games */
	100	class pgm_kovarmsim_state : public pgm_state
	101	{
	102	public:
	103	pgm_kovarmsim_state(const machine_config &mconfig, device_type type, const char *tag)
	104	: pgm_state(mconfig, type, tag) {
110	105
	106	m_ddp3internal_slot = 0;
	107	}
111	108
	109	UINT16 m_value0;
	110	UINT16 m_value1;
	111	UINT16 m_valuekey;
	112	UINT16 m_ddp3lastcommand;
	113	UINT32 m_valueresponse;
	114	int m_ddp3internal_slot;
	115	UINT32 m_ddp3slots[0x100];
112	116
	117	// pstars / oldsplus
	118	UINT16 m_pstar_e7;
	119	UINT16 m_pstar_b1;
	120	UINT16 m_pstar_ce;
	121	UINT16 m_extra_ram[0x100];
113	122
	123	typedef void (pgm_arm_sim_command_handler)(pgm_kovarmsim_state state, int pc);
	124
	125	pgm_arm_sim_command_handler arm_sim_handler;
	126	};
	127
	128
	129
114	130	extern UINT16 *pgm_mainram; // used by nvram handler, we cannot move it to driver data struct
115	131
	132	/----------- defined in drivers/pgm.c -----------/
	133
	134	void pgm_basic_init( running_machine &machine, bool set_bank = true );
	135
	136	INPUT_PORTS_EXTERN( pgm );
	137
	138	/* we only need half of these because CavePGM has it's own MACHINE DRIVER in pgmprot1.c - refactor */
	139	TIMER_DEVICE_CALLBACK( pgm_interrupt );
	140
	141	GFXDECODE_EXTERN( pgm );
	142
	143	MACHINE_CONFIG_EXTERN( pgm );
	144
	145	ADDRESS_MAP_EXTERN( pgm_z80_mem, 8 );
	146	ADDRESS_MAP_EXTERN( pgm_z80_io, 8 );
	147	void pgm_sound_irq( device_t *device, int level );
	148
	149	ADDRESS_MAP_EXTERN( pgm_mem, 16 );
	150	ADDRESS_MAP_EXTERN( pgm_basic_mem, 16 );
	151	ADDRESS_MAP_EXTERN( pgm_base_mem, 16 );
	152
	153	MACHINE_START( pgm );
	154	MACHINE_RESET( pgm );
	155
116	156	/----------- defined in machine/pgmcrypt.c -----------/
117	157
118	158	void pgm_kov_decrypt(running_machine &machine);
r14798	r14799
141	181
142	182	/----------- defined in machine/pgmprot.c -----------/
143	183
144		READ16_HANDLER( pstars_protram_r );
145		READ16_HANDLER( pstars_r );
146		WRITE16_HANDLER( pstars_w );
	184	DRIVER_INIT( orlegend );
147	185
148		READ16_HANDLER( pgm_asic3_r );
149		WRITE16_HANDLER( pgm_asic3_w );
150		WRITE16_HANDLER( pgm_asic3_reg_w );
	186	INPUT_PORTS_EXTERN( orlegend );
	187	INPUT_PORTS_EXTERN( orld105k );
151	188
152		READ16_HANDLER( sango_protram_r );
153		READ16_HANDLER( asic28_r );
154		WRITE16_HANDLER( asic28_w );
	189	/----------- defined in machine/pgmprot1.c -----------/
155	190
156		READ16_HANDLER( dw2_d80000_r );
	191	/* emulations */
	192	DRIVER_INIT( photoy2k );
	193	DRIVER_INIT( kovsh );
	194	DRIVER_INIT( kovshp );
	195	DRIVER_INIT( kovlsqh2 );
	196	DRIVER_INIT( kovqhsgs );
157	197
	198	MACHINE_CONFIG_EXTERN( kov );
158	199
159		READ16_HANDLER( oldsplus_protram_r );
160		READ16_HANDLER( oldsplus_r );
161		WRITE16_HANDLER( oldsplus_w );
	200	/* simulations */
	201	DRIVER_INIT( ddp3 );
	202	DRIVER_INIT( ket );
	203	DRIVER_INIT( espgal );
	204	DRIVER_INIT( puzzli2 );
	205	DRIVER_INIT( py2k2 );
	206	DRIVER_INIT( pstar );
	207	DRIVER_INIT( kov );
	208	DRIVER_INIT( kovboot );
	209	DRIVER_INIT( oldsplus );
162	210
163		MACHINE_RESET( kov );
164		void install_protection_asic_sim_kov(running_machine &machine);
	211	MACHINE_CONFIG_EXTERN( kov_simulated_arm );
	212	MACHINE_CONFIG_EXTERN( cavepgm );
165	213
	214	INPUT_PORTS_EXTERN( sango );
	215	INPUT_PORTS_EXTERN( sango_ch );
	216	INPUT_PORTS_EXTERN( photoy2k );
	217	INPUT_PORTS_EXTERN( oldsplus );
	218	INPUT_PORTS_EXTERN( pstar );
	219	INPUT_PORTS_EXTERN( py2k2 );
	220	INPUT_PORTS_EXTERN( puzzli2 );
	221	INPUT_PORTS_EXTERN( kovsh );
	222
	223	/----------- defined in machine/pgmprot2.c -----------/
	224
	225	/* emulations */
	226	MACHINE_CONFIG_EXTERN( kov2 );
	227
	228	DRIVER_INIT( kov2 );
	229	DRIVER_INIT( kov2p );
	230	DRIVER_INIT( martmast );
	231	DRIVER_INIT( ddp2 );
	232
	233	/* simulations (or missing) */
	234
	235	DRIVER_INIT( dw2001 );
	236
	237	INPUT_PORTS_EXTERN( ddp2 );
	238	INPUT_PORTS_EXTERN( kov2 );
	239	INPUT_PORTS_EXTERN( martmast );
	240	INPUT_PORTS_EXTERN( dw2001 );
	241
	242	/----------- defined in machine/pgmprot3.c -----------/
	243
	244	MACHINE_CONFIG_EXTERN( svg );
	245
	246	DRIVER_INIT( theglad );
	247	DRIVER_INIT( svg );
	248	DRIVER_INIT( svgpcb );
	249	DRIVER_INIT( killbldp );
	250	DRIVER_INIT( dmnfrnt );
	251	DRIVER_INIT( happy6 );
	252
	253	/----------- defined in machine/pgmprot4.c -----------/
	254
	255	MACHINE_CONFIG_EXTERN( killbld );
	256	MACHINE_CONFIG_EXTERN( dw3 );
	257
	258	DRIVER_INIT( killbld );
	259	DRIVER_INIT( drgw3 );
	260
	261	INPUT_PORTS_EXTERN( killbld );
	262	INPUT_PORTS_EXTERN( dw3 );
	263
	264	/----------- defined in machine/pgmprot5.c -----------/
	265
	266	DRIVER_INIT( drgw2 );
	267	DRIVER_INIT( dw2v100x );
	268	DRIVER_INIT( drgw2c );
	269	DRIVER_INIT( drgw2j );
	270
	271	/----------- defined in machine/pgmprot6.c -----------/
	272
	273	MACHINE_CONFIG_EXTERN( olds );
	274
	275	DRIVER_INIT( olds );
	276
	277	INPUT_PORTS_EXTERN( olds );
	278
	279
166	280	/----------- defined in video/pgm.c -----------/
167	281
168	282	WRITE16_HANDLER( pgm_tx_videoram_w );

src/mame/mame.mak
r14798	r14799
757	757	$(DRIVERS)/spoker.o \
758	758	$(MACHINE)/pgmcrypt.o \
759	759	$(MACHINE)/pgmprot.o \
	760	$(MACHINE)/pgmprot1.o \
	761	$(MACHINE)/pgmprot2.o \
	762	$(MACHINE)/pgmprot3.o \
	763	$(MACHINE)/pgmprot4.o \
	764	$(MACHINE)/pgmprot5.o \
	765	$(MACHINE)/pgmprot6.o \
760	766
761	767	$(MAMEOBJ)/irem.a: \
762	768	$(DRIVERS)/m10.o $(VIDEO)/m10.o \

src/mame/drivers/bublbobl.c
r14798	r14799
1379	1379
1380	1380	ROM_START( boblbobl2 )
1381	1381	ROM_REGION( 0x30000, "maincpu", 0 )
1382		ROM_LOAD( "cpu2-3.bin", 0x00000, 0x08000, CRC(2d9107b6) SHA1(ab1a4a20f4b533cd06cc458668f407a8a14c9d70) )
	1382	ROM_LOAD( "cpu2-3.bin", 0x00000, 0x08000, CRC(2d9107b6) SHA1(ab1a4a20f4b533cd06cc458668f407a8a14c9d70) )
1383	1383	/* ROMs banked at 8000-bfff */
1384	1384	ROM_LOAD( "bb5", 0x10000, 0x08000, CRC(13118eb1) SHA1(5a5da40c2cc82420f70bc58ffa32de1088c6c82f) )
1385		ROM_LOAD( "cpu2-4.bin", 0x18000, 0x08000, CRC(3f9fed10) SHA1(1cc18a58d9a27495048825836accfa81ebbc0c56) )
	1385	ROM_LOAD( "cpu2-4.bin", 0x18000, 0x08000, CRC(3f9fed10) SHA1(1cc18a58d9a27495048825836accfa81ebbc0c56) )
1386	1386	/* 20000-2ffff empty */
1387	1387
1388	1388	ROM_REGION( 0x10000, "slave", 0 ) /* 64k for the second CPU */
r14798	r14799
1392	1392	ROM_LOAD( "a78-07.46", 0x0000, 0x08000, CRC(4f9a26e8) SHA1(3105b34b88a7134493c2b3f584729f8b0407a011) )
1393	1393
1394	1394	ROM_REGION( 0x80000, "gfx1", ROMREGION_INVERT )
1395		ROM_LOAD( "gfx7.bin", 0x00000, 0x10000, CRC(702f61c0) SHA1(2f294ab2b0286736a64ea2bfc95d855aa5b41ada) )
1396		ROM_LOAD( "gfx8.bin", 0x01000, 0x10000, CRC(677840e8) SHA1(995b2125ca18910d7d4b96078f4ecb17465c4151) )
	1395	ROM_LOAD( "gfx7.bin", 0x00000, 0x10000, CRC(702f61c0) SHA1(2f294ab2b0286736a64ea2bfc95d855aa5b41ada) )
	1396	ROM_LOAD( "gfx8.bin", 0x01000, 0x10000, CRC(677840e8) SHA1(995b2125ca18910d7d4b96078f4ecb17465c4151) )
1397	1397	ROM_LOAD( "a78-13.16", 0x20000, 0x08000, CRC(d0af35c5) SHA1(c5a89f4d73acc0db86654540b3abfd77b3757db5) )
1398	1398	ROM_LOAD( "a78-14.17", 0x28000, 0x08000, CRC(7b5369a8) SHA1(1307b26d80e6f36ebe6c442bebec41d20066eaf9) ) // match
1399	1399	/* 0x30000-0x3ffff empty */
1400		ROM_LOAD( "gfx10.bin", 0x50000, 0x10000, CRC(d370f499) SHA1(94ce157ff1a53fabf08abe5467531b94a56666a5) )
1401		ROM_LOAD( "gfx11.bin", 0x60000, 0x10000, CRC(76f2b367) SHA1(3e357a5642c8747df77a995057cecdf96f3130ab) )
	1400	ROM_LOAD( "gfx10.bin", 0x50000, 0x10000, CRC(d370f499) SHA1(94ce157ff1a53fabf08abe5467531b94a56666a5) )
	1401	ROM_LOAD( "gfx11.bin", 0x60000, 0x10000, CRC(76f2b367) SHA1(3e357a5642c8747df77a995057cecdf96f3130ab) )
1402	1402	ROM_LOAD( "a78-20.35", 0x68000, 0x08000, CRC(9ef863ad) SHA1(29f91b5a3765e4d6e6c3382db1d8d8297b6e56c8) ) // match
1403	1403	/* 0x70000-0x7ffff empty */
1404	1404

src/mame/drivers/sfcbox.c
r14798	r14799
307	307	ROM_REGION( 0x1000000, "maincpu", ROMREGION_ERASE00 )
308	308
309	309	// ROM_REGION( 0x80000, "atrom", 0 )
310		// ROM_REGION( 0x10000, "user3", 0 )
	310	// ROM_REGION( 0x10000, "user3", 0 )
311	311
312	312	ROM_REGION( 0x100, "user5", 0 ) /* IPL ROM */
313	313	ROM_LOAD( "spc700.rom", 0x00, 0x40, CRC(44bb3a40) SHA1(97e352553e94242ae823547cd853eecda55c20f0) ) /* boot rom */

src/mame/drivers/snk.c
r14798	r14799
6119	6119
6120	6120	ROM_START( fsoccerba )
6121	6121	ROM_REGION( 0x10000, "maincpu", 0 )
6122		ROM_LOAD( "fs3.c6", 0x00000, 0x10000, CRC(e644d207) SHA1(efd5a6cf99461a0dc6cec6c8e2c16d82c6630132) )
	6122	ROM_LOAD( "fs3.c6", 0x00000, 0x10000, CRC(e644d207) SHA1(efd5a6cf99461a0dc6cec6c8e2c16d82c6630132) )
6123	6123
6124	6124	ROM_REGION( 0x10000, "sub", 0 )
6125	6125	ROM_LOAD( "fs1_ver4.bin", 0x00000, 0x10000, CRC(97830108) SHA1(dab241baf8d889c768e1fbe25f1e5059b3cbbab6) )

src/mame/drivers/pgm.c
r14798	r14799
63	63	game region code..
64	64
65	65	ASIC 3:
66		used by:
67		different per region, supplies region code
68		used by:
69		Oriental Legend
70		function:
	66	state based device?
	67	see
	68	machine/pgmprot.c
71	69
72	70	ASIC 25 + ASIC 12
73		ASIC25 is a logic device (not MCU) which performs bitswap operations
74		ASIC12 is ... ? (rom overlays?)
	71	state based device + rom overlays
	72	see
	73	machine/pgmprot5.c
75	74
76		used by:
77		Dragon World 2
78
79	75	ASIC 25 + ASIC 22
80		ASIC25 is a logic device (not MCU) which performs bitswap operations, and connects to the ASIC22. It differs per region.
81		ASIC22 is an MCU and acts as an encrypted DMA device
	76	state based device + encrypted DMA device
	77	see
	78	machine/pgmprot4.c
82	79
83		(ASIC22 can be swapped between games with no side-effects, ASIC25 can't)
84
85		used by:
86		Dragon World 3
87		The Killing Blade
88
89	80	ASIC 25 + ASIC 28
90		ASIC25 (see above)
91		ASIC28 acts as an encrypted DMA device (updated version of ASIC22 with different encryption etc.)
	81	state based device + encrypted DMA device?
	82	see
	83	machine/pgmprot6.c
92	84
93		used by:
94		Oriental Legend Super
	85	ASIC 027A(55857F/55857G):
	86	ARM based CPUs with internal ROM
	87	see
	88	machine/pgmprot1.c
	89	machine/pgmprot2.c
	90	machine/pgmprot3.c
95	91
96		ASIC 27 (55857E):
97		performs a variety of calculations, quite complex, different per region, supplies region code
98	92
99		used by:
100		Knights of Valour 1 / (Plus?)
101		Photo Y2k / Real and Fake
102
103		ASIC 27A(55857F/55857G):
104		arm7 cpu with 16kb internal rom (different per game / region) + optional external data rom
105		probably used to give extra power to the system, lots of calculations are offloaded to it
106		used by:
107		Knights of Valour Super Heroes / Plus
108		Puzzli II
109		Oriental Legend Special Plus
110		Knights of Valor 2 / 2 Plus
111		DoDonPachi II
112		Martial Masters
113		The Gladiator
114		Demon Front
115		The Killing Blade Plus
116		Spectral VS Generation
117
118		The 55857G variant appears to be protected against reading even from native code.
119
120	93	there are probably more...
121	94
122	95	PCB Layout
r14798	r14799
213	186	*/
214	187
215	188	#define PGMLOGERROR 0
216		#define PGMARM7LOGERROR 0
217	189
218	190	#include "emu.h"
219		#include "cpu/z80/z80.h"
220		#include "cpu/m68000/m68000.h"
221		#include "cpu/arm7/arm7.h"
222		#include "sound/ics2115.h"
223		#include "cpu/arm7/arm7core.h"
224		#include "machine/nvram.h"
225	191	#include "includes/pgm.h"
226		#include "machine/v3021.h"
227	192
	193
228	194	UINT16 *pgm_mainram;
229		static void IGS022_reset(running_machine& machine);
230	195
	196
231	197	static READ16_HANDLER( pgm_videoram_r )
232	198	{
233	199	pgm_state *state = space->machine().driver_data<pgm_state>();
r14798	r14799
259	225	return (state->m_z80_mainram[offset * 2] << 8) \| state->m_z80_mainram[offset * 2 + 1];
260	226	}
261	227
262		static READ32_HANDLER( arm7_latch_arm_r )
263		{
264		pgm_state *state = space->machine().driver_data<pgm_state>();
265
266		device_set_input_line(state->m_prot, ARM7_FIRQ_LINE, CLEAR_LINE ); // guess
267
268		if (PGMARM7LOGERROR)
269		logerror("ARM7: Latch read: %08x (%08x) (%06x)\n", state->m_kov2_latchdata_68k_w, mem_mask, cpu_get_pc(&space->device()));
270		return state->m_kov2_latchdata_68k_w;
271		}
272
273		static WRITE32_HANDLER( arm7_latch_arm_w )
274		{
275		pgm_state *state = space->machine().driver_data<pgm_state>();
276
277		if (PGMARM7LOGERROR)
278		logerror("ARM7: Latch write: %08x (%08x) (%06x)\n", data, mem_mask, cpu_get_pc(&space->device()));
279
280		COMBINE_DATA(&state->m_kov2_latchdata_arm_w);
281		}
282
283		static READ32_HANDLER( arm7_shareram_r )
284		{
285		pgm_state *state = space->machine().driver_data<pgm_state>();
286
287		if (PGMARM7LOGERROR)
288		logerror("ARM7: ARM7 Shared RAM Read: %04x = %08x (%08x) (%06x)\n", offset << 2, state->m_arm7_shareram[offset], mem_mask, cpu_get_pc(&space->device()));
289		return state->m_arm7_shareram[offset];
290		}
291
292		static WRITE32_HANDLER( arm7_shareram_w )
293		{
294		pgm_state *state = space->machine().driver_data<pgm_state>();
295
296		if (PGMARM7LOGERROR)
297		logerror("ARM7: ARM7 Shared RAM Write: %04x = %08x (%08x) (%06x)\n", offset << 2, data, mem_mask, cpu_get_pc(&space->device()));
298		COMBINE_DATA(&state->m_arm7_shareram[offset]);
299		}
300
301		static READ16_HANDLER( arm7_latch_68k_r )
302		{
303		pgm_state *state = space->machine().driver_data<pgm_state>();
304
305		if (PGMARM7LOGERROR)
306		logerror("M68K: Latch read: %04x (%04x) (%06x)\n", state->m_kov2_latchdata_arm_w & 0x0000ffff, mem_mask, cpu_get_pc(&space->device()));
307		return state->m_kov2_latchdata_arm_w;
308		}
309
310		static WRITE16_HANDLER( arm7_latch_68k_w )
311		{
312		pgm_state *state = space->machine().driver_data<pgm_state>();
313
314		if (PGMARM7LOGERROR)
315		logerror("M68K: Latch write: %04x (%04x) (%06x)\n", data & 0x0000ffff, mem_mask, cpu_get_pc(&space->device()));
316		COMBINE_DATA(&state->m_kov2_latchdata_68k_w);
317
318		device_set_input_line(state->m_prot, ARM7_FIRQ_LINE, ASSERT_LINE ); // guess
319		}
320
321		static READ16_HANDLER( arm7_ram_r )
322		{
323		pgm_state *state = space->machine().driver_data<pgm_state>();
324		UINT16 share16 = (UINT16 )state->m_arm7_shareram;
325
326		if (PGMARM7LOGERROR)
327		logerror("M68K: ARM7 Shared RAM Read: %04x = %04x (%08x) (%06x)\n", BYTE_XOR_LE(offset), share16[BYTE_XOR_LE(offset)], mem_mask, cpu_get_pc(&space->device()));
328		return share16[BYTE_XOR_LE(offset)];
329		}
330
331		static WRITE16_HANDLER( arm7_ram_w )
332		{
333		pgm_state *state = space->machine().driver_data<pgm_state>();
334		UINT16 share16 = (UINT16 )state->m_arm7_shareram;
335
336		if (PGMARM7LOGERROR)
337		logerror("M68K: ARM7 Shared RAM Write: %04x = %04x (%04x) (%06x)\n", BYTE_XOR_LE(offset), data, mem_mask, cpu_get_pc(&space->device()));
338		COMBINE_DATA(&share16[BYTE_XOR_LE(offset)]);
339		}
340
341	228	static WRITE16_HANDLER ( z80_ram_w )
342	229	{
343	230	pgm_state *state = space->machine().driver_data<pgm_state>();
r14798	r14799
407	294	soundlatch3_w(space, 0, data);
408	295	}
409	296
410		~~static~~ void sound_irq( device_t *device, int level )
	297	void pgm_sound_irq( device_t *device, int level )
411	298	{
412	299	pgm_state *state = device->machine().driver_data<pgm_state>();
413	300	device_set_input_line(state->m_soundcpu, 0, level);
r14798	r14799
418	305	sound_irq
419	306	};*/
420	307
421		/* Misc Protection Handlers ***********************************************************/
422	308
423		/* Kov Superheroes */
424
425		static READ32_HANDLER( kovsh_arm7_protlatch_r )
426		{
427		pgm_state *state = space->machine().driver_data<pgm_state>();
428
429		space->machine().scheduler().synchronize(); // force resync
430
431		return (state->m_kovsh_highlatch_68k_w << 16) \| (state->m_kovsh_lowlatch_68k_w);
432		}
433
434		static WRITE32_HANDLER( kovsh_arm7_protlatch_w )
435		{
436		pgm_state *state = space->machine().driver_data<pgm_state>();
437
438		space->machine().scheduler().synchronize(); // force resync
439
440		if (ACCESSING_BITS_16_31)
441		{
442		state->m_kovsh_highlatch_arm_w = data >> 16;
443		state->m_kovsh_highlatch_68k_w = 0;
444		}
445		if (ACCESSING_BITS_0_15)
446		{
447		state->m_kovsh_lowlatch_arm_w = data;
448		state->m_kovsh_lowlatch_68k_w = 0;
449		}
450		}
451
452		static READ16_HANDLER( kovsh_68k_protlatch_r )
453		{
454		pgm_state *state = space->machine().driver_data<pgm_state>();
455
456		space->machine().scheduler().synchronize(); // force resync
457
458		switch (offset)
459		{
460		case 1: return state->m_kovsh_highlatch_arm_w;
461		case 0: return state->m_kovsh_lowlatch_arm_w;
462		}
463		return -1;
464		}
465
466		static WRITE16_HANDLER( kovsh_68k_protlatch_w )
467		{
468		pgm_state *state = space->machine().driver_data<pgm_state>();
469
470		space->machine().scheduler().synchronize(); // force resync
471
472		switch (offset)
473		{
474		case 1:
475		state->m_kovsh_highlatch_68k_w = data;
476		break;
477
478		case 0:
479		state->m_kovsh_lowlatch_68k_w = data;
480		break;
481		}
482		}
483
484		static READ16_HANDLER( kovsh_arm7_ram_r )
485		{
486		pgm_state *state = space->machine().driver_data<pgm_state>();
487		UINT16 share16 = (UINT16 )state->m_arm7_shareram;
488
489		if (PGMARM7LOGERROR)
490		logerror("M68K: ARM7 Shared RAM Read: %04x = %04x (%08x) (%06x)\n", BYTE_XOR_LE(offset), share16[BYTE_XOR_LE(offset)], mem_mask, cpu_get_pc(&space->device()));
491		return share16[BYTE_XOR_LE(offset << 1)];
492		}
493
494		static WRITE16_HANDLER( kovsh_arm7_ram_w )
495		{
496		pgm_state *state = space->machine().driver_data<pgm_state>();
497		UINT16 share16 = (UINT16 )state->m_arm7_shareram;
498
499		if (PGMARM7LOGERROR)
500		logerror("M68K: ARM7 Shared RAM Write: %04x = %04x (%04x) (%06x)\n", BYTE_XOR_LE(offset), data, mem_mask, cpu_get_pc(&space->device()));
501		COMBINE_DATA(&share16[BYTE_XOR_LE(offset << 1)]);
502		}
503
504
505
506
507		static READ32_HANDLER( kovsh_arm7_unk_r )
508		{
509		pgm_state *state = space->machine().driver_data<pgm_state>();
510		return state->m_kovsh_counter++;
511		}
512
513		static READ32_HANDLER( kovsh_exrom_r )
514		{
515		return 0x00000000;
516		}
517
518
519		//55857G
520
521		static WRITE32_HANDLER( svg_arm7_ram_sel_w )
522		{
523		pgm_state *state = space->machine().driver_data<pgm_state>();
524		state->m_svg_ram_sel = data & 1;
525		}
526
527		static READ32_HANDLER( svg_arm7_shareram_r )
528		{
529		pgm_state *state = space->machine().driver_data<pgm_state>();
530		return state->m_svg_shareram[state->m_svg_ram_sel & 1][offset];
531		}
532
533		static WRITE32_HANDLER( svg_arm7_shareram_w )
534		{
535		pgm_state *state = space->machine().driver_data<pgm_state>();
536		COMBINE_DATA(&state->m_svg_shareram[state->m_svg_ram_sel & 1][offset]);
537		}
538
539		static READ16_HANDLER( svg_m68k_ram_r )
540		{
541		pgm_state *state = space->machine().driver_data<pgm_state>();
542		int ram_sel = (state->m_svg_ram_sel & 1) ^ 1;
543		UINT16 share16 = (UINT16 )(state->m_svg_shareram[ram_sel & 1]);
544
545		return share16[BYTE_XOR_LE(offset)];
546		}
547
548		static WRITE16_HANDLER( svg_m68k_ram_w )
549		{
550		pgm_state *state = space->machine().driver_data<pgm_state>();
551		int ram_sel = (state->m_svg_ram_sel & 1) ^ 1;
552		UINT16 share16 = (UINT16 )(state->m_svg_shareram[ram_sel & 1]);
553
554		COMBINE_DATA(&share16[BYTE_XOR_LE(offset)]);
555		}
556
557		static READ16_HANDLER( svg_68k_nmi_r )
558		{
559		return 0;
560		}
561
562		static WRITE16_HANDLER( svg_68k_nmi_w )
563		{
564		pgm_state *state = space->machine().driver_data<pgm_state>();
565		generic_pulse_irq_line(state->m_prot, ARM7_FIRQ_LINE, 1);
566		}
567
568		static WRITE16_HANDLER( svg_latch_68k_w )
569		{
570		pgm_state *state = space->machine().driver_data<pgm_state>();
571		if (PGMARM7LOGERROR)
572		logerror("M68K: Latch write: %04x (%04x) (%06x)\n", data & 0x0000ffff, mem_mask, cpu_get_pc(&space->device()));
573		COMBINE_DATA(&state->m_kov2_latchdata_68k_w);
574		}
575
576	309	/* Memory Maps ***********************************************************/
577	310
578	311	/* Z80 (sound CPU)********************************************************/
579	312
580		~~static~~ ADDRESS_MAP_START( z80_mem, AS_PROGRAM, 8 )
	313	ADDRESS_MAP_START( pgm_z80_mem, AS_PROGRAM, 8 )
581	314	AM_RANGE(0x0000, 0xffff) AM_RAM AM_BASE_MEMBER(pgm_state, m_z80_mainram)
582	315	ADDRESS_MAP_END
583	316
584		~~static~~ ADDRESS_MAP_START( z80_io, AS_IO, 8 )
	317	ADDRESS_MAP_START( pgm_z80_io, AS_IO, 8 )
585	318	AM_RANGE(0x8000, 0x8003) AM_DEVREADWRITE("ics", ics2115_device::read, ics2115_device::write)
586	319	AM_RANGE(0x8100, 0x81ff) AM_READWRITE(soundlatch3_r, z80_l3_w)
587	320	AM_RANGE(0x8200, 0x82ff) AM_READWRITE(soundlatch_r, soundlatch_w)
r14798	r14799
590	323
591	324	/* 68000 (main CPU) + variants for protection devices ********************/
592	325
593		~~static~~ ADDRESS_MAP_START( pgm_base_mem, AS_PROGRAM, 16)
	326	ADDRESS_MAP_START( pgm_base_mem, AS_PROGRAM, 16)
594	327	AM_RANGE(0x700006, 0x700007) AM_WRITENOP // Watchdog?
595	328
596	329	AM_RANGE(0x800000, 0x81ffff) AM_RAM AM_MIRROR(0x0e0000) AM_BASE(&pgm_mainram) AM_SHARE("sram") /* Main Ram */
r14798	r14799
614	347	AM_RANGE(0xc10000, 0xc1ffff) AM_READWRITE(z80_ram_r, z80_ram_w) /* Z80 Program */
615	348	ADDRESS_MAP_END
616	349
617		~~static~~ ADDRESS_MAP_START( pgm_mem, AS_PROGRAM, 16)
	350	ADDRESS_MAP_START( pgm_mem, AS_PROGRAM, 16)
618	351	AM_IMPORT_FROM(pgm_base_mem)
619	352	AM_RANGE(0x000000, 0x01ffff) AM_ROM /* BIOS ROM */
620	353	ADDRESS_MAP_END
621	354
622		~~static~~ ADDRESS_MAP_START( pgm_basic_mem, AS_PROGRAM, 16)
	355	ADDRESS_MAP_START( pgm_basic_mem, AS_PROGRAM, 16)
623	356	AM_IMPORT_FROM(pgm_mem)
624	357	AM_RANGE(0x100000, 0x3fffff) AM_ROMBANK("bank1") /* Game ROM */
625	358	ADDRESS_MAP_END
626	359
627		static ADDRESS_MAP_START( killbld_mem, AS_PROGRAM, 16)
628		AM_IMPORT_FROM(pgm_mem)
629		AM_RANGE(0x100000, 0x2fffff) AM_ROMBANK("bank1") /* Game ROM */
630		AM_RANGE(0x300000, 0x303fff) AM_RAM AM_BASE_MEMBER(pgm_state, m_sharedprotram) // Shared with protection device
631		ADDRESS_MAP_END
632	360
633		static ADDRESS_MAP_START( olds_mem, AS_PROGRAM, 16)
634		AM_IMPORT_FROM(pgm_mem)
635		AM_RANGE(0x100000, 0x3fffff) AM_ROMBANK("bank1") /* Game ROM */
636		AM_RANGE(0x400000, 0x403fff) AM_RAM AM_BASE_MEMBER(pgm_state, m_sharedprotram) // Shared with protection device
637		ADDRESS_MAP_END
638	361
639		/* 55857E? */
640		/* Knights of Valor, Photo Y2k */
641		/* no execute only space? */
642		static ADDRESS_MAP_START( kov_map, AS_PROGRAM, 16)
643		AM_IMPORT_FROM(pgm_mem)
644		AM_RANGE(0x100000, 0x4effff) AM_ROMBANK("bank1") /* Game ROM */
645		AM_RANGE(0x4f0000, 0x4f003f) AM_READWRITE(kovsh_arm7_ram_r, kovsh_arm7_ram_w) /* ARM7 Shared RAM */
646		AM_RANGE(0x500000, 0x500005) AM_READWRITE(kovsh_68k_protlatch_r, kovsh_68k_protlatch_w) /* ARM7 Latch */
647		ADDRESS_MAP_END
648	362
649		/* 55857F? */
650		/* Knights of Valor 2, Martial Masters, DoDonpachi 2 */
651		/* no execute only space? */
652		static ADDRESS_MAP_START( kov2_mem, AS_PROGRAM, 16)
653		AM_IMPORT_FROM(pgm_mem)
654		AM_RANGE(0x100000, 0x5fffff) AM_ROMBANK("bank1") /* Game ROM */
655		AM_RANGE(0xd00000, 0xd0ffff) AM_READWRITE(arm7_ram_r, arm7_ram_w) /* ARM7 Shared RAM */
656		AM_RANGE(0xd10000, 0xd10001) AM_READWRITE(arm7_latch_68k_r, arm7_latch_68k_w) /* ARM7 Latch */
657		ADDRESS_MAP_END
658
659		/* 55857G? */
660		/* Demon Front, The Gladiator, Happy 6-in-1, Spectral Vs. Generation, Killing Blade EX */
661		/* the ones with an EXECUTE ONLY region of ARM space? */
662		static ADDRESS_MAP_START( svg_68k_mem, AS_PROGRAM, 16)
663		AM_IMPORT_FROM(pgm_mem)
664		AM_RANGE(0x100000, 0x1fffff) AM_ROMBANK("bank1") /* Game ROM */
665
666		AM_RANGE(0x500000, 0x51ffff) AM_READWRITE(svg_m68k_ram_r, svg_m68k_ram_w) /* ARM7 Shared RAM */
667		AM_RANGE(0x5c0000, 0x5c0001) AM_READWRITE(svg_68k_nmi_r, svg_68k_nmi_w) /* ARM7 FIQ */
668		AM_RANGE(0x5c0300, 0x5c0301) AM_READWRITE(arm7_latch_68k_r, svg_latch_68k_w) /* ARM7 Latch */
669		ADDRESS_MAP_END
670
671
672		static ADDRESS_MAP_START( cavepgm_mem, AS_PROGRAM, 16)
673		AM_IMPORT_FROM(pgm_base_mem)
674		AM_RANGE(0x000000, 0x3fffff) AM_ROM
675		/* protection devices installed (simulated) later */
676		ADDRESS_MAP_END
677
678		/* ARM7 (protection CPUs) ************************************************/
679
680		static ADDRESS_MAP_START( 55857E_arm7_map, AS_PROGRAM, 32 )
681		AM_RANGE(0x00000000, 0x00003fff) AM_ROM
682		AM_RANGE(0x08100000, 0x083fffff) AM_READ(kovsh_exrom_r) // unpopulated, returns 0 to keep checksum happy
683		AM_RANGE(0x10000000, 0x100003ff) AM_RAM // internal ram for asic
684		AM_RANGE(0x40000000, 0x40000003) AM_READWRITE(kovsh_arm7_protlatch_r, kovsh_arm7_protlatch_w)
685		AM_RANGE(0x40000008, 0x4000000b) AM_WRITENOP // ?
686		AM_RANGE(0x4000000c, 0x4000000f) AM_READ(kovsh_arm7_unk_r)
687		AM_RANGE(0x50800000, 0x5080003f) AM_READWRITE(arm7_shareram_r, arm7_shareram_w) AM_BASE_MEMBER(pgm_state, m_arm7_shareram)
688		AM_RANGE(0x50000000, 0x500003ff) AM_RAM // uploads xor table to decrypt 68k rom here
689		ADDRESS_MAP_END
690
691		static ADDRESS_MAP_START( 55857F_arm7_map, AS_PROGRAM, 32 )
692		AM_RANGE(0x00000000, 0x00003fff) AM_ROM
693		AM_RANGE(0x08000000, 0x083fffff) AM_ROM AM_REGION("user1", 0)
694		AM_RANGE(0x10000000, 0x100003ff) AM_RAM
695		AM_RANGE(0x18000000, 0x1800ffff) AM_RAM AM_BASE_MEMBER(pgm_state, m_arm_ram)
696		AM_RANGE(0x38000000, 0x38000003) AM_READWRITE(arm7_latch_arm_r, arm7_latch_arm_w) /* 68k Latch */
697		AM_RANGE(0x48000000, 0x4800ffff) AM_READWRITE(arm7_shareram_r, arm7_shareram_w) AM_BASE_MEMBER(pgm_state, m_arm7_shareram)
698		AM_RANGE(0x50000000, 0x500003ff) AM_RAM
699		ADDRESS_MAP_END
700
701
702		static ADDRESS_MAP_START( 55857G_arm7_map, AS_PROGRAM, 32 )
703		AM_RANGE(0x00000000, 0x00003fff) AM_ROM
704		AM_RANGE(0x08000000, 0x087fffff) AM_ROM AM_REGION("user1", 0)
705		AM_RANGE(0x10000000, 0x100003ff) AM_RAM
706		AM_RANGE(0x18000000, 0x1803ffff) AM_RAM AM_BASE_MEMBER(pgm_state, m_arm_ram)
707		AM_RANGE(0x38000000, 0x3801ffff) AM_READWRITE(svg_arm7_shareram_r, svg_arm7_shareram_w)
708		AM_RANGE(0x48000000, 0x48000003) AM_READWRITE(arm7_latch_arm_r, arm7_latch_arm_w) /* 68k Latch */
709		AM_RANGE(0x40000018, 0x4000001b) AM_WRITE(svg_arm7_ram_sel_w) /* RAM SEL */
710		AM_RANGE(0x50000000, 0x500003ff) AM_RAM
711		ADDRESS_MAP_END
712
713
714	363	/* Input Ports ***********************************************************/
715	364
716	365	/* enough for 4 players, the basic dips mapped are listed in the test mode */
717	366
718		~~static~~ INPUT_PORTS_START( pgm )
	367	INPUT_PORTS_START( pgm )
719	368	PORT_START("P1P2")
720	369	PORT_BIT( 0x0001, IP_ACTIVE_LOW, IPT_START1 )
721	370	PORT_BIT( 0x0002, IP_ACTIVE_LOW, IPT_JOYSTICK_UP ) PORT_PLAYER(1)
r14798	r14799
800	449	PORT_BIT( 0xffff, IP_ACTIVE_LOW, IPT_UNUSED )
801	450	INPUT_PORTS_END
802	451
803		static INPUT_PORTS_START( orlegend )
804		PORT_INCLUDE ( pgm )
805	452
806		PORT_MODIFY("Region")
807		PORT_DIPNAME( 0x0003, 0x0000, DEF_STR( Region ) )
808		PORT_CONFSETTING( 0x0000, DEF_STR( World ) )
809		PORT_CONFSETTING( 0x0001, "World (duplicate)" ) // again?
810		PORT_CONFSETTING( 0x0002, DEF_STR( Korea ) )
811		PORT_CONFSETTING( 0x0003, DEF_STR( China ) )
812		INPUT_PORTS_END
813	453
814		static INPUT_PORTS_START( orld105k )
815		PORT_INCLUDE ( pgm )
816	454
817		PORT_MODIFY("Region")
818		PORT_DIPNAME( 0x0003, 0x0002, DEF_STR( Unused ) ) // region switch
819		PORT_DIPSETTING( 0x0002, DEF_STR( Off ) ) // if enabled, game gives
820		PORT_DIPSETTING( 0x0000, DEF_STR( On ) ) // "incorrect version" error
821		INPUT_PORTS_END
822	455
823		static INPUT_PORTS_START( sango )
824		PORT_INCLUDE ( pgm )
825	456
826		PORT_MODIFY("Region") /* Region - supplied by protection device */
827		PORT_CONFNAME( 0x000f, 0x0005, DEF_STR( Region ) )
828		PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
829		PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
830		PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
831		PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
832		PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
833		PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
834		INPUT_PORTS_END
835
836		static INPUT_PORTS_START( sango_ch )
837		PORT_INCLUDE ( pgm )
838
839		PORT_MODIFY("Region") /* Region - supplied by protection device */
840		PORT_CONFNAME( 0x000f, 0x0000, DEF_STR( Region ) )
841		PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
842		PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
843		PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
844		PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
845		PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
846		PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
847		INPUT_PORTS_END
848
849		static INPUT_PORTS_START( dw3 )
850		PORT_INCLUDE ( pgm )
851
852		PORT_MODIFY("Region") /* Region - supplied by protection device */
853		PORT_CONFNAME( 0x000f, 0x0006, DEF_STR( Region ) )
854		PORT_CONFSETTING( 0x0000, "0" )
855		PORT_CONFSETTING( 0x0001, "1" )
856		PORT_CONFSETTING( 0x0002, "2" )
857		PORT_CONFSETTING( 0x0003, "3" )
858		PORT_CONFSETTING( 0x0004, "4" )
859		PORT_CONFSETTING( 0x0005, "5" )
860		PORT_CONFSETTING( 0x0006, DEF_STR( World ) )
861		PORT_CONFSETTING( 0x0007, "7" )
862
863		INPUT_PORTS_END
864
865
866		static INPUT_PORTS_START( olds )
867		PORT_INCLUDE ( pgm )
868
869		PORT_MODIFY("Region") /* Region - supplied by protection device */
870		PORT_CONFNAME( 0x000f, 0x0006, DEF_STR( Region ) )
871		/* includes the following regions:
872		1 = taiwan, 2 = china, 3 = japan (title = orlegend special),
873		4 = korea, 5 = hong kong, 6 = world */
874		PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
875		PORT_CONFSETTING( 0x0002, DEF_STR( China ) )
876		PORT_CONFSETTING( 0x0003, DEF_STR( Japan ) )
877		PORT_CONFSETTING( 0x0004, DEF_STR( Korea ) )
878		PORT_CONFSETTING( 0x0005, DEF_STR( Hong_Kong ) )
879		PORT_CONFSETTING( 0x0006, DEF_STR( World ) )
880		INPUT_PORTS_END
881
882		static INPUT_PORTS_START( killbld )
883		PORT_INCLUDE ( pgm )
884
885		PORT_MODIFY("Region") /* Region - supplied by protection device */
886		PORT_DIPNAME( 0x00ff, 0x0021, "Region (not currently working)" ) // different regions supply different protection code sequences, we only have the China one ATM
887		PORT_DIPSETTING( 0x0016, DEF_STR( Taiwan ) )
888		PORT_DIPSETTING( 0x0017, DEF_STR( China ) )
889		PORT_DIPSETTING( 0x0018, DEF_STR( Hong_Kong ) )
890		PORT_DIPSETTING( 0x0019, DEF_STR( Japan ) )
891		// PORT_DIPSETTING( 0x001a, "1a" ) // invalid
892		// PORT_DIPSETTING( 0x001b, "1b" ) // invalid
893		// PORT_DIPSETTING( 0x001c, "1c" ) // invalid
894		// PORT_DIPSETTING( 0x001d, "1d" ) // invalid
895		// PORT_DIPSETTING( 0x001e, "1e" ) // invalid
896		// PORT_DIPSETTING( 0x001f, "1f" ) // invalid
897		PORT_DIPSETTING( 0x0020, DEF_STR( Korea ) )
898		PORT_DIPSETTING( 0x0021, DEF_STR( World ) )
899		INPUT_PORTS_END
900
901		static INPUT_PORTS_START( photoy2k )
902		PORT_INCLUDE ( pgm )
903
904		PORT_MODIFY("Region") /* Region - supplied by protection device */
905		PORT_CONFNAME( 0x000f, 0x0003, DEF_STR( Region ) )
906		PORT_CONFSETTING( 0x0000, DEF_STR( Taiwan ) )
907		PORT_CONFSETTING( 0x0001, DEF_STR( China ) )
908		PORT_CONFSETTING( 0x0002, "Japan (Alta license)" )
909		PORT_CONFSETTING( 0x0003, DEF_STR( World ) )
910		PORT_CONFSETTING( 0x0004, DEF_STR( Korea ) )
911		PORT_CONFSETTING( 0x0005, DEF_STR( Hong_Kong ) )
912		INPUT_PORTS_END
913
914		static INPUT_PORTS_START( ddp2 )
915		PORT_INCLUDE ( pgm )
916
917		PORT_START("RegionHack") /* Region - actually supplied by protection device */
918		PORT_CONFNAME( 0x00ff, 0x00ff, DEF_STR( Region ) )
919		PORT_CONFSETTING( 0x0000, DEF_STR( China ) )
920		PORT_CONFSETTING( 0x0001, DEF_STR( Taiwan ) )
921		PORT_CONFSETTING( 0x0002, "Japan (Cave license)" )
922		PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
923		PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
924		PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
925		PORT_CONFSETTING( 0x00ff, "Untouched" ) // don't hack the region
926		INPUT_PORTS_END
927
928		static INPUT_PORTS_START( oldsplus )
929		PORT_INCLUDE ( pgm )
930
931		PORT_MODIFY("Region") /* Region - supplied by protection device */
932		PORT_CONFNAME( 0x000f, 0x0001, DEF_STR( Region ) )
933		PORT_CONFSETTING( 0x0001, DEF_STR( China ) )
934		PORT_CONFSETTING( 0x0002, DEF_STR( Japan ) )
935		PORT_CONFSETTING( 0x0003, DEF_STR( Korea ) )
936		PORT_CONFSETTING( 0x0004, DEF_STR( Hong_Kong ) )
937		PORT_CONFSETTING( 0x0005, DEF_STR( World ) )
938		PORT_CONFSETTING( 0x0006, DEF_STR( Taiwan ) )
939		INPUT_PORTS_END
940
941
942	457	/* GFX Decodes ***********************************************************/
943	458
944	459	/* we can't decode the sprite data like this because it isn't tile based. the
r14798	r14799
972	487	32*256
973	488	};
974	489
975		~~static~~ GFXDECODE_START( pgm )
	490	GFXDECODE_START( pgm )
976	491	GFXDECODE_ENTRY( "tiles", 0, pgm8_charlayout, 0x800, 32 ) /* 8x8x4 Tiles */
977	492	// we have to unpack the data before we can decode it as 32x32, hence we don't know how many tiles etc. in advance, see INIT
978	493	//GFXDECODE_ENTRY( "gfx2", 0, pgm32_charlayout, 0x400, 32 ) /* 32x32x5 Tiles */
r14798	r14799
980	495
981	496	/* Machine Driver ********************************************************/
982	497
983		/* only dragon world 2 NEEDs irq4, Puzzli 2 explicitly doesn't want it, what
984		is the source? maybe the protection device? */
985		static TIMER_DEVICE_CALLBACK( drgw_interrupt )
	498	/* most games require IRQ4 for inputs to work, Puzzli 2 is explicit about not wanting it tho
	499	what is the source? */
	500	TIMER_DEVICE_CALLBACK( pgm_interrupt )
986	501	{
987	502	pgm_state *state = timer.machine().driver_data<pgm_state>();
988	503	int scanline = param;
r14798	r14799
994	509	if (!state->m_irq4_disabled) device_set_input_line(state->m_maincpu, 4, HOLD_LINE);
995	510	}
996	511
997		~~static~~ MACHINE_START( pgm )
	512	MACHINE_START( pgm )
998	513	{
999	514	pgm_state *state = machine.driver_data<pgm_state>();
1000	515
r14798	r14799
1004	519	state->m_soundcpu = machine.device<cpu_device>("soundcpu");
1005	520	state->m_prot = machine.device<cpu_device>("prot");
1006	521	state->m_ics = machine.device("ics");
1007
1008		// state->save_item(NAME(state->m_cal_val));
1009		// state->save_item(NAME(state->m_cal_mask));
1010		// state->save_item(NAME(state->m_cal_com));
1011		// state->save_item(NAME(state->m_cal_cnt));
1012	522	}
1013	523
1014		~~static~~ MACHINE_RESET( pgm )
	524	MACHINE_RESET( pgm )
1015	525	{
1016		// pgm_state *state = machine.driver_data<pgm_state>();
1017
1018	526	cputag_set_input_line(machine, "soundcpu", INPUT_LINE_HALT, ASSERT_LINE);
1019
1020		// state->m_cal_val = 0;
1021		// state->m_cal_mask = 0;
1022		// state->m_cal_com = 0;
1023		// state->m_cal_cnt = 0;
1024	527	}
1025	528
1026		static MACHINE_RESET( killbld );
1027		static MACHINE_RESET( dw3 );
1028		static MACHINE_RESET( olds );
1029		extern MACHINE_RESET( kov );
1030	529
1031	530	MACHINE_CONFIG_FRAGMENT( pgmbase )
1032	531	/* basic machine hardware */
1033	532	MCFG_CPU_ADD("maincpu", M68000, 20000000) /* 20 mhz! verified on real board */
1034	533	MCFG_CPU_PROGRAM_MAP(pgm_basic_mem)
1035	534	MCFG_CPU_VBLANK_INT("screen", irq6_line_hold)
1036		MCFG_TIMER_ADD_SCANLINE("scantimer", drgw_interrupt, "screen", 0, 1)
	535	MCFG_TIMER_ADD_SCANLINE("scantimer", pgm_interrupt, "screen", 0, 1)
1037	536
1038	537	MCFG_CPU_ADD("soundcpu", Z80, 33868800/4)
1039		MCFG_CPU_PROGRAM_MAP(z80_mem)
1040		MCFG_CPU_IO_MAP(z80_io)
	538	MCFG_CPU_PROGRAM_MAP(pgm_z80_mem)
	539	MCFG_CPU_IO_MAP(pgm_z80_io)
1041	540
1042	541	MCFG_MACHINE_START( pgm )
1043	542	MCFG_MACHINE_RESET( pgm )
r14798	r14799
1061	560
1062	561	/sound hardware /
1063	562	MCFG_SPEAKER_STANDARD_MONO("mono")
1064		MCFG_ICS2115_ADD("ics", 0, sound_irq)
	563	MCFG_ICS2115_ADD("ics", 0, pgm_sound_irq)
1065	564	MCFG_SOUND_ROUTE(ALL_OUTPUTS, "mono", 5.0)
1066	565	MACHINE_CONFIG_END
1067	566
1068		~~static~~ MACHINE_CONFIG_START( pgm, pgm_state )
	567	MACHINE_CONFIG_START( pgm, pgm_state )
1069	568	MCFG_FRAGMENT_ADD(pgmbase)
1070	569	MACHINE_CONFIG_END
1071	570
1072	571
1073	572
1074	573
1075		static MACHINE_CONFIG_DERIVED( killbld, pgm )
1076		MCFG_CPU_MODIFY("maincpu")
1077		MCFG_CPU_PROGRAM_MAP(killbld_mem)
1078	574
1079		MCFG_MACHINE_RESET(killbld)
1080		MACHINE_CONFIG_END
1081	575
1082	576
1083		static MACHINE_CONFIG_DERIVED( dw3, pgm )
1084		MCFG_CPU_MODIFY("maincpu")
1085		MCFG_CPU_PROGRAM_MAP(killbld_mem)
1086	577
1087		MCFG_MACHINE_RESET(dw3)
1088		MACHINE_CONFIG_END
1089	578
1090	579
1091		static MACHINE_CONFIG_DERIVED( olds, pgm )
1092		MCFG_CPU_MODIFY("maincpu")
1093		MCFG_CPU_PROGRAM_MAP(olds_mem)
1094	580
1095		MCFG_MACHINE_RESET(olds)
1096		MACHINE_CONFIG_END
1097
1098		/***** ARM 55857E *****/
1099
1100		static MACHINE_CONFIG_DERIVED( kov, pgm )
1101		MCFG_CPU_MODIFY("maincpu")
1102		MCFG_CPU_PROGRAM_MAP(kov_map)
1103
1104		/* protection CPU */
1105		MCFG_CPU_ADD("prot", ARM7, 20000000) // 55857E?
1106		MCFG_CPU_PROGRAM_MAP(55857E_arm7_map)
1107		MACHINE_CONFIG_END
1108
1109		static MACHINE_CONFIG_DERIVED( kov_disabled_arm, pgm ) // for simulated cases
1110		MCFG_CPU_MODIFY("maincpu")
1111		MCFG_CPU_PROGRAM_MAP(pgm_basic_mem)
1112
1113		/* protection CPU */
1114		MCFG_CPU_ADD("prot", ARM7, 20000000) // 55857E?
1115		MCFG_CPU_PROGRAM_MAP(55857E_arm7_map)
1116		MCFG_DEVICE_DISABLE()
1117		MACHINE_CONFIG_END
1118
1119		static MACHINE_CONFIG_DERIVED( kov_simulated_arm, kov_disabled_arm ) // for simulated cases
1120		MCFG_CPU_MODIFY("maincpu")
1121		MCFG_CPU_PROGRAM_MAP(kov_map)
1122
1123		MCFG_MACHINE_RESET(kov)
1124		MACHINE_CONFIG_END
1125
1126		/***** ARM 55857F *****/
1127
1128		static MACHINE_CONFIG_DERIVED( kov2, pgm )
1129		MCFG_CPU_MODIFY("maincpu")
1130		MCFG_CPU_PROGRAM_MAP(kov2_mem)
1131
1132		/* protection CPU */
1133		MCFG_CPU_ADD("prot", ARM7, 20000000) // 55857F
1134		MCFG_CPU_PROGRAM_MAP(55857F_arm7_map)
1135		MACHINE_CONFIG_END
1136
1137		static MACHINE_CONFIG_DERIVED( kov2_disabled_arm, pgm ) // for simulated cases
1138		MCFG_CPU_MODIFY("maincpu")
1139		MCFG_CPU_PROGRAM_MAP(pgm_basic_mem)
1140
1141		/* protection CPU */
1142		MCFG_CPU_ADD("prot", ARM7, 20000000) // 55857F
1143		MCFG_CPU_PROGRAM_MAP(55857F_arm7_map)
1144		MCFG_DEVICE_DISABLE()
1145		MACHINE_CONFIG_END
1146
1147		/***** ARM 55857G *****/
1148
1149		static MACHINE_CONFIG_DERIVED( svg, pgm )
1150		MCFG_CPU_MODIFY("maincpu")
1151		MCFG_CPU_PROGRAM_MAP(svg_68k_mem)
1152
1153		/* protection CPU */
1154		MCFG_CPU_ADD("prot", ARM7, 33333333) // 55857G
1155		MCFG_CPU_PROGRAM_MAP(55857G_arm7_map)
1156
1157		MACHINE_CONFIG_END
1158
1159
1160		static MACHINE_CONFIG_DERIVED( svg_disabled_arm, pgm ) // for simulated cases
1161		MCFG_CPU_MODIFY("maincpu")
1162		MCFG_CPU_PROGRAM_MAP(pgm_basic_mem)
1163
1164		/* protection CPU */
1165		MCFG_CPU_ADD("prot", ARM7, 33333333) // 55857G
1166		MCFG_CPU_PROGRAM_MAP(55857G_arm7_map)
1167		MCFG_DEVICE_DISABLE()
1168		MACHINE_CONFIG_END
1169
1170		class cavepgm_state : public pgm_state
1171		{
1172		public:
1173		cavepgm_state(const machine_config &mconfig, device_type type, const char *tag)
1174		: pgm_state(mconfig, type, tag) {
1175
1176		m_ddp3internal_slot = 0;
1177		}
1178
1179		UINT16 m_value0;
1180		UINT16 m_value1;
1181		UINT16 m_valuekey;
1182		UINT16 m_ddp3lastcommand;
1183		UINT32 m_valueresponse;
1184		int m_ddp3internal_slot;
1185		UINT32 m_ddp3slots[0x100];
1186		INT16 m_ddp3thrust;
1187		};
1188
1189		static MACHINE_START( cavepgm )
1190		{
1191		MACHINE_START_CALL(pgm);
1192
1193		cavepgm_state *state = machine.driver_data<cavepgm_state>();
1194
1195		state->save_item(NAME(state->m_value0));
1196		state->save_item(NAME(state->m_value1));
1197		state->save_item(NAME(state->m_valuekey));
1198		state->save_item(NAME(state->m_valueresponse));
1199		state->save_item(NAME(state->m_ddp3internal_slot));
1200		state->save_item(NAME(state->m_ddp3slots));
1201		}
1202
1203		static MACHINE_CONFIG_START( cavepgm, cavepgm_state )
1204
1205		/* basic machine hardware */
1206		MCFG_CPU_ADD("maincpu", M68000, 20000000)
1207		MCFG_CPU_PROGRAM_MAP(cavepgm_mem)
1208		MCFG_TIMER_ADD_SCANLINE("scantimer", drgw_interrupt, "screen", 0, 1)
1209
1210		MCFG_CPU_ADD("soundcpu", Z80, 33868800/4)
1211		MCFG_CPU_PROGRAM_MAP(z80_mem)
1212		MCFG_CPU_IO_MAP(z80_io)
1213
1214		MCFG_MACHINE_START( cavepgm )
1215		MCFG_MACHINE_RESET( pgm )
1216		MCFG_NVRAM_ADD_0FILL("sram")
1217
1218		MCFG_V3021_ADD("rtc")
1219
1220		/* video hardware */
1221		MCFG_SCREEN_ADD("screen", RASTER)
1222		MCFG_SCREEN_REFRESH_RATE(59.17) // verified on pcb
1223		MCFG_SCREEN_VBLANK_TIME(ATTOSECONDS_IN_USEC(0))
1224		MCFG_SCREEN_SIZE(648, 648)
1225		MCFG_SCREEN_VISIBLE_AREA(08, 568-1, 08, 288-1)
1226		MCFG_SCREEN_UPDATE_STATIC(pgm)
1227		MCFG_SCREEN_VBLANK_STATIC(pgm)
1228
1229		MCFG_GFXDECODE(pgm)
1230		MCFG_PALETTE_LENGTH(0x1200/2)
1231
1232		MCFG_VIDEO_START(pgm)
1233
1234		/sound hardware /
1235		MCFG_SPEAKER_STANDARD_MONO("mono")
1236		MCFG_ICS2115_ADD("ics", 0, sound_irq)
1237		MCFG_SOUND_ROUTE(ALL_OUTPUTS, "mono", 5.0)
1238		MACHINE_CONFIG_END
1239
1240		// for now we're using a protection sim close ot the CavePgm one, so use that state.
1241		static MACHINE_CONFIG_DERIVED( puzzli2_disabled_arm, cavepgm )
1242		MCFG_CPU_MODIFY("maincpu")
1243		MCFG_CPU_PROGRAM_MAP(pgm_basic_mem)
1244
1245		/* protection CPU */
1246		MCFG_CPU_ADD("prot", ARM7, 20000000) // 55857F?
1247		MCFG_CPU_PROGRAM_MAP(55857F_arm7_map)
1248		MCFG_DEVICE_DISABLE()
1249		MACHINE_CONFIG_END
1250
1251
1252	581	/* Rom Loading ***********************************************************/
1253	582
1254	583	/* take note of "gfx2" needed for expanding the 32x32x5bpp data and
r14798	r14799
3197	2526	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
3198	2527	ROM_LOAD( "ddp2_igs027a_japan.bin", 0x000000, 0x04000, CRC(742d34d2) SHA1(4491c08f3cefef2933ad5a741f4bb05cc2f3e1a0) )
3199	2528
3200		ROM_REGION32_LE( 0x400000, "user1", 0 ) /* Protection Data (encrypted external ARM data~~, internal missing~~) */
	2529	ROM_REGION32_LE( 0x400000, "user1", 0 ) /* Protection Data (encrypted external ARM data) */
3201	2530	ROM_LOAD( "v100.u23", 0x000000, 0x20000, CRC(06c3dd29) SHA1(20c9479f158467fc2037dcf162b6c6be18c91d46) )
3202	2531
3203	2532	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
r14798	r14799
3224	2553	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
3225	2554	ROM_LOAD( "ddp2_igs027a_japan.bin", 0x000000, 0x04000, CRC(742d34d2) SHA1(4491c08f3cefef2933ad5a741f4bb05cc2f3e1a0) )
3226	2555
3227		ROM_REGION32_LE( 0x400000, "user1", 0 ) /* Protection Data (encrypted external ARM data~~, internal missing~~) */
	2556	ROM_REGION32_LE( 0x400000, "user1", 0 ) /* Protection Data (encrypted external ARM data) */
3228	2557	ROM_LOAD( "v100.u23", 0x000000, 0x20000, CRC(06c3dd29) SHA1(20c9479f158467fc2037dcf162b6c6be18c91d46) )
3229	2558
3230	2559	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
r14798	r14799
3251	2580	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
3252	2581	ROM_LOAD( "ddp2_igs027a_japan.bin", 0x000000, 0x04000, CRC(742d34d2) SHA1(4491c08f3cefef2933ad5a741f4bb05cc2f3e1a0) )
3253	2582
3254		ROM_REGION32_LE( 0x400000, "user1", 0 ) /* Protection Data (encrypted external ARM data~~, internal missing~~) */
	2583	ROM_REGION32_LE( 0x400000, "user1", 0 ) /* Protection Data (encrypted external ARM data) */
3255	2584	ROM_LOAD( "v100.u23", 0x000000, 0x20000, CRC(06c3dd29) SHA1(20c9479f158467fc2037dcf162b6c6be18c91d46) )
3256	2585
3257	2586	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
r14798	r14799
3381	2710	ROM_REGION( 0x4000, "prot", ROMREGION_ERASEFF ) /* ARM protection ASIC - internal rom */
3382	2711	ROM_LOAD( "puzzli2_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
3383	2712
3384		ROM_REGION32_LE( 0x4000000, "user1", ROMREGION_ERASEFF )
3385		/* not on this PCB */
3386
3387	2713	ROM_REGION( 0x600000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
3388	2714	PGM_VIDEO_BIOS
3389	2715	ROM_LOAD( "t0900.u9", 0x180000, 0x200000, CRC(70615611) SHA1(a46d4aa71396947b427f9ba4ba0e636876c09d6b) )
r14798	r14799
3670	2996
3671	2997	ROM_START( dmnfrntpcb )
3672	2998	ROM_REGION( 0x600000, "maincpu", 0 ) /* 68000 Code */
3673		ROM_LOAD16_WORD_SWAP( "~~demonfront~~pcb_~~bio~~s.42", 0x000000, 0x020000, ~~NO_DUMP~~ ) // missing
	2999	ROM_LOAD16_WORD_SWAP( "pgm_p02s.u42", 0x00000, 0x020000, CRC(78c15fa2) SHA1(885a6558e022602cc6f482ac9667ba9f61e75092) ) /* IGS PGM P02S 1A3708A1A0 S002838 (uses standard PGM v2 bios) */
3674	3000	ROM_LOAD16_WORD_SWAP( "demonfront_v107-u43.bin", 0x100000, 0x200000, CRC(671d8a31) SHA1(a0c2af67d7c56b4b355883892a47640fc72408a1) )
3675	3001
3676	3002	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
r14798	r14799
3765	3091
3766	3092	ROM_REGION( 0x800000, "user1", 0 ) /* Protection Data (encrypted external ARM data, internal missing) */
3767	3093	ROM_LOAD( "igs.62", 0x000000, 0x200000, CRC(0f3f511e) SHA1(28dd8d27495cec86e968a3ea549c5b30513dbb6e) )
3768
	3094
3769	3095	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
3770	3096	PGM_VIDEO_BIOS
3771	3097	ROM_LOAD( "t04601.u33", 0x180000, 0x800000, CRC(e5dab371) SHA1(2e3c93958eb0326b6b84b95c2168626f26bbac76) )
r14798	r14799
3976	3302	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
3977	3303	ROM_LOAD( "ket_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
3978	3304
3979		ROM_REGION32_LE( 0x400000, "user1", ROMREGION_ERASE00 )
3980		/* no external protection rom */
3981
3982	3305	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
3983	3306	ROM_LOAD( "pgm_t01s.rom", 0x000000, 0x200000, CRC(1a7123a0) SHA1(cc567f577bfbf45427b54d6695b11b74f2578af3) ) // same as standard PGM text bios - surface scratched to remove details
3984	3307	ROM_LOAD( "t04701w064.u19", 0x180000, 0x800000, CRC(2665b041) SHA1(fb1107778b66f2af0de77ac82e1ee2902f53a959) ) //text-1
r14798	r14799
4006	3329	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
4007	3330	ROM_LOAD( "ket_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
4008	3331
4009		ROM_REGION32_LE( 0x400000, "user1", ROMREGION_ERASE00 )
4010		/* no external protection rom */
4011
4012	3332	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
4013	3333	ROM_LOAD( "pgm_t01s.rom", 0x000000, 0x200000, CRC(1a7123a0) SHA1(cc567f577bfbf45427b54d6695b11b74f2578af3) ) // same as standard PGM text bios - surface scratched to remove details
4014	3334	ROM_LOAD( "t04701w064.u19", 0x180000, 0x800000, CRC(2665b041) SHA1(fb1107778b66f2af0de77ac82e1ee2902f53a959) ) //text-1
r14798	r14799
4036	3356	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
4037	3357	ROM_LOAD( "ket_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
4038	3358
4039		ROM_REGION32_LE( 0x400000, "user1", ROMREGION_ERASE00 )
4040		/* no external protection rom */
4041
4042	3359	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
4043	3360	ROM_LOAD( "pgm_t01s.rom", 0x000000, 0x200000, CRC(1a7123a0) SHA1(cc567f577bfbf45427b54d6695b11b74f2578af3) ) // same as standard PGM text bios - surface scratched to remove details
4044	3361	ROM_LOAD( "t04701w064.u19", 0x180000, 0x800000, CRC(2665b041) SHA1(fb1107778b66f2af0de77ac82e1ee2902f53a959) ) //text-1
r14798	r14799
4066	3383	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
4067	3384	ROM_LOAD( "espgal_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
4068	3385
4069		ROM_REGION32_LE( 0x400000, "user1", ROMREGION_ERASE00 )
4070		/* no external protection rom */
4071
4072	3386	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
4073	3387	ROM_LOAD( "t01s.u18", 0x000000, 0x200000, CRC(1a7123a0) SHA1(cc567f577bfbf45427b54d6695b11b74f2578af3) ) // same as standard PGM text bios - surface scratched to remove details
4074	3388	ROM_LOAD( "t04801w064.u19", 0x180000, 0x800000, CRC(6021c79e) SHA1(fbc340dafb18aa3094de29b881318a5a9794e4bc) ) //text-1
r14798	r14799
4093	3407	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
4094	3408	ROM_LOAD( "ddp3_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
4095	3409
4096		ROM_REGION32_LE( 0x400000, "user1", ROMREGION_ERASE00 )
4097		/* no external protection rom */
4098
4099	3410	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
4100	3411	ROM_LOAD( "pgm_t01s.rom", 0x000000, 0x200000, CRC(1a7123a0) SHA1(cc567f577bfbf45427b54d6695b11b74f2578af3) ) // same as standard PGM bios
4101	3412	ROM_LOAD( "t04401w064.u19",0x180000, 0x800000, CRC(3a95f19c) SHA1(fd3c47cf0b8b1e20c6bec4be68a089fc8bbf4dbe) ) //text-1
r14798	r14799
4124	3435	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
4125	3436	ROM_LOAD( "ddp3_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
4126	3437
4127		ROM_REGION32_LE( 0x400000, "user1", ROMREGION_ERASE00 )
4128		/* no external protection rom */
4129
4130	3438	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
4131	3439	ROM_LOAD( "pgm_t01s.rom", 0x000000, 0x200000, CRC(1a7123a0) SHA1(cc567f577bfbf45427b54d6695b11b74f2578af3) ) // same as standard PGM bios
4132	3440	ROM_LOAD( "t04401w064.u19",0x180000, 0x800000, CRC(3a95f19c) SHA1(fd3c47cf0b8b1e20c6bec4be68a089fc8bbf4dbe) ) //text-1
r14798	r14799
4154	3462	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
4155	3463	ROM_LOAD( "ddp3_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
4156	3464
4157		ROM_REGION32_LE( 0x400000, "user1", ROMREGION_ERASE00 )
4158		/* no external protection rom */
4159
4160	3465	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
4161	3466	ROM_LOAD( "pgm_t01s.rom", 0x000000, 0x200000, CRC(1a7123a0) SHA1(cc567f577bfbf45427b54d6695b11b74f2578af3) ) // same as standard PGM bios
4162	3467	ROM_LOAD( "t04401w064.u19",0x180000, 0x800000, CRC(3a95f19c) SHA1(fd3c47cf0b8b1e20c6bec4be68a089fc8bbf4dbe) ) //text-1
r14798	r14799
4185	3490	ROM_REGION( 0x4000, "prot", 0 ) /* ARM protection ASIC - internal rom */
4186	3491	ROM_LOAD( "ddp3_igs027a.bin", 0x000000, 0x04000, NO_DUMP )
4187	3492
4188		ROM_REGION32_LE( 0x400000, "user1", ROMREGION_ERASE00 )
4189		/* no external protection rom */
4190
4191	3493	ROM_REGION( 0xc00000, "tiles", 0 ) /* 8x8 Text Tiles + 32x32 BG Tiles */
4192	3494	ROM_LOAD( "pgm_t01s.rom", 0x000000, 0x200000, CRC(1a7123a0) SHA1(cc567f577bfbf45427b54d6695b11b74f2578af3) ) // same as standard PGM bios
4193	3495	ROM_LOAD( "t04401w064.u19",0x180000, 0x800000, CRC(3a95f19c) SHA1(fd3c47cf0b8b1e20c6bec4be68a089fc8bbf4dbe) ) //text-1
r14798	r14799
4286	3588
4287	3589
4288	3590
4289		~~static~~ void pgm_basic_init( running_machine &machine, bool set_bank ~~= true~~ )
	3591	void pgm_basic_init( running_machine &machine, bool set_bank)
4290	3592	{
4291	3593	pgm_state *state = machine.driver_data<pgm_state>();
4292	3594
r14798	r14799
4306	3608	pgm_basic_init(machine);
4307	3609	}
4308	3610
4309		/* Oriental Legend INIT */
4310	3611
4311		static DRIVER_INIT( orlegend )
4312		{
4313		pgm_state *state = machine.driver_data<pgm_state>();
4314		pgm_basic_init(machine);
4315	3612
4316		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0xC0400e, 0xC0400f, FUNC(pgm_asic3_r), FUNC(pgm_asic3_w));
4317		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_write_handler(0xC04000, 0xC04001, FUNC(pgm_asic3_reg_w));
4318	3613
4319		state->m_asic3_reg = 0;
4320		state->m_asic3_latch[0] = 0;
4321		state->m_asic3_latch[1] = 0;
4322		state->m_asic3_latch[2] = 0;
4323		state->m_asic3_x = 0;
4324		state->m_asic3_y = 0;
4325		state->m_asic3_z = 0;
4326		state->m_asic3_h1 = 0;
4327		state->m_asic3_h2 = 0;
4328		state->m_asic3_hold = 0;
4329	3614
4330		state->save_item(NAME(state->m_asic3_reg));
4331		state->save_item(NAME(state->m_asic3_latch));
4332		state->save_item(NAME(state->m_asic3_x));
4333		state->save_item(NAME(state->m_asic3_y));
4334		state->save_item(NAME(state->m_asic3_z));
4335		state->save_item(NAME(state->m_asic3_h1));
4336		state->save_item(NAME(state->m_asic3_h2));
4337		state->save_item(NAME(state->m_asic3_hold));
4338		}
4339	3615
4340		static void drgwld2_common_init(running_machine &machine)
4341		{
4342		pgm_basic_init(machine);
4343		pgm_dw2_decrypt(machine);
4344		/*
4345		Info from Elsemi
4346		Here is how to "bypass" the dw2 hang protection, it fixes the mode
4347		select and after failing in the 2nd stage (probably there are other checks
4348		out there).
4349		*/
4350		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0xd80000, 0xd80003, FUNC(dw2_d80000_r));
4351		}
4352	3616
4353		static DRIVER_INIT( drgw2 )
4354		{ /* incomplete? */
4355		UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
4356		drgwld2_common_init(machine);
4357		/* These ROM patches are not hacks, the protection device
4358		overlays the normal ROM code, this has been confirmed on a real PCB
4359		although some addresses may be missing */
4360		mem16[0x131098 / 2] = 0x4e93;
4361		mem16[0x13113e / 2] = 0x4e93;
4362		mem16[0x1311ce / 2] = 0x4e93;
4363		}
4364	3617
4365		static DRIVER_INIT( dw2v100x )
4366		{
4367		UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
4368		drgwld2_common_init(machine);
4369
4370		mem16[0x131084 / 2] = 0x4e93;
4371		mem16[(0x131084+0xa6) / 2] = 0x4e93;
4372		mem16[(0x131084+0x136) / 2] = 0x4e93;
4373		}
4374
4375		static DRIVER_INIT( drgw2c )
4376		{
4377		UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
4378		drgwld2_common_init(machine);
4379		/* These ROM patches are not hacks, the protection device
4380		overlays the normal ROM code, this has been confirmed on a real PCB
4381		although some addresses may be missing */
4382		mem16[0x1303bc / 2] = 0x4e93;
4383		mem16[0x130462 / 2] = 0x4e93;
4384		mem16[0x1304f2 / 2] = 0x4e93;
4385		}
4386
4387		static DRIVER_INIT( drgw2j )
4388		{
4389		UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
4390		drgwld2_common_init(machine);
4391		/* These ROM patches are not hacks, the protection device
4392		overlays the normal ROM code, this has been confirmed on a real PCB
4393		although some addresses may be missing */
4394		mem16[0x1302c0 / 2] = 0x4e93;
4395		mem16[0x130366 / 2] = 0x4e93;
4396		mem16[0x1303f6 / 2] = 0x4e93;
4397		}
4398
4399		static void kovsh_latch_init( running_machine &machine )
4400		{
4401		pgm_state *state = machine.driver_data<pgm_state>();
4402
4403		state->m_kovsh_highlatch_arm_w = 0;
4404		state->m_kovsh_lowlatch_arm_w = 0;
4405		state->m_kovsh_highlatch_68k_w = 0;
4406		state->m_kovsh_lowlatch_68k_w = 0;
4407		state->m_kovsh_counter = 1;
4408
4409		state->save_item(NAME(state->m_kovsh_highlatch_arm_w));
4410		state->save_item(NAME(state->m_kovsh_lowlatch_arm_w));
4411		state->save_item(NAME(state->m_kovsh_highlatch_68k_w));
4412		state->save_item(NAME(state->m_kovsh_lowlatch_68k_w));
4413		state->save_item(NAME(state->m_kovsh_counter));
4414		}
4415
4416		static DRIVER_INIT( kov )
4417		{
4418		pgm_basic_init(machine);
4419		pgm_kov_decrypt(machine);
4420		kovsh_latch_init(machine);
4421		install_protection_asic_sim_kov(machine);
4422		}
4423
4424		static DRIVER_INIT( kovboot )
4425		{
4426		pgm_basic_init(machine);
4427		// pgm_kov_decrypt(machine);
4428		kovsh_latch_init(machine);
4429		install_protection_asic_sim_kov(machine);
4430		}
4431
4432		static DRIVER_INIT( pstar )
4433		{
4434		pgm_state *state = machine.driver_data<pgm_state>();
4435
4436		pgm_basic_init(machine);
4437		pgm_pstar_decrypt(machine);
4438		kovsh_latch_init(machine);
4439
4440		state->m_pstars_key = 0;
4441		state->m_pstars_int[0] = 0;
4442		state->m_pstars_int[1] = 0;
4443		state->m_pstars_val = 0;
4444		state->m_pstar_e7 = 0;
4445		state->m_pstar_b1 = 0;
4446		state->m_pstar_ce = 0;
4447		state->m_pstar_ram[0] = 0;
4448		state->m_pstar_ram[1] = 0;
4449		state->m_pstar_ram[2] = 0;
4450		memset(state->m_pstars_regs, 0, 16);
4451
4452		state->save_item(NAME(state->m_pstars_key));
4453		state->save_item(NAME(state->m_pstars_int));
4454		state->save_item(NAME(state->m_pstars_regs));
4455		state->save_item(NAME(state->m_pstars_val));
4456		state->save_item(NAME(state->m_pstar_e7));
4457		state->save_item(NAME(state->m_pstar_b1));
4458		state->save_item(NAME(state->m_pstar_ce));
4459		state->save_item(NAME(state->m_pstar_ram));
4460
4461		}
4462
4463		static DRIVER_INIT( photoy2k )
4464		{
4465		pgm_basic_init(machine);
4466		pgm_photoy2k_decrypt(machine);
4467		kovsh_latch_init(machine);
4468		}
4469
4470		static DRIVER_INIT( py2k2 )
4471		{
4472		pgm_basic_init(machine);
4473		pgm_py2k2_decrypt(machine);
4474		kovsh_latch_init(machine);
4475		}
4476
4477
4478		static DRIVER_INIT( kovsh )
4479		{
4480		pgm_basic_init(machine);
4481		pgm_kovsh_decrypt(machine);
4482		kovsh_latch_init(machine);
4483		}
4484
4485		static DRIVER_INIT( kovshp )
4486		{
4487		pgm_basic_init(machine);
4488		pgm_kovshp_decrypt(machine);
4489		kovsh_latch_init(machine);
4490		}
4491
4492
4493		static void kov2_latch_init( running_machine &machine )
4494		{
4495		pgm_state *state = machine.driver_data<pgm_state>();
4496
4497		state->m_kov2_latchdata_68k_w = 0;
4498		state->m_kov2_latchdata_arm_w = 0;
4499
4500		state->save_item(NAME(state->m_kov2_latchdata_68k_w));
4501		state->save_item(NAME(state->m_kov2_latchdata_arm_w));
4502		}
4503
4504		static DRIVER_INIT( kov2 )
4505		{
4506		pgm_basic_init(machine);
4507		pgm_kov2_decrypt(machine);
4508		kov2_latch_init(machine);
4509		}
4510
4511
4512		static DRIVER_INIT( martmast )
4513		{
4514		pgm_basic_init(machine);
4515		pgm_mm_decrypt(machine);
4516		kov2_latch_init(machine);
4517		}
4518
4519
4520		static WRITE32_HANDLER( ddp2_arm_region_w )
4521		{
4522		pgm_state *state = space->machine().driver_data<pgm_state>();
4523		int pc = cpu_get_pc(&space->device());
4524		int regionhack = input_port_read(space->machine(), "RegionHack");
4525		if (pc==0x0174 && regionhack != 0xff) data = (data & 0x0000ffff) \| (regionhack << 16);
4526		COMBINE_DATA(&state->m_arm7_shareram[0x0]);
4527		}
4528
4529		static READ32_HANDLER( ddp2_speedup_r )
4530		{
4531		pgm_state *state = space->machine().driver_data<pgm_state>();
4532		int pc = cpu_get_pc(&space->device());
4533		UINT32 data = state->m_arm_ram[0x300c/4];
4534
4535		if (pc==0x080109b4)
4536		{
4537		/* if we've hit the loop where this is read and both values are 0 then the only way out is an interrupt */
4538		int r4 = (cpu_get_reg(&space->device(), ARM7_R4));
4539		r4 += 0xe;
4540
4541		if (r4==0x18002f9e)
4542		{
4543		UINT32 data2 = state->m_arm_ram[0x2F9C/4]&0xffff0000;
4544		if ((data==0x00000000) && (data2==0x00000000)) device_spin_until_interrupt(&space->device());
4545		}
4546		}
4547
4548		return data;
4549		}
4550
4551
4552
4553		static DRIVER_INIT( ddp2 )
4554		{
4555		pgm_basic_init(machine);
4556		pgm_ddp2_decrypt(machine);
4557		kov2_latch_init(machine);
4558
4559		// we only have a Japan internal ROM dumped for now, allow us to override that for debugging purposes.
4560		machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_write_handler(0x48000000, 0x48000003, FUNC(ddp2_arm_region_w));
4561
4562		machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x1800300c, 0x1800300f, FUNC(ddp2_speedup_r));
4563
4564
4565		}
4566
4567		static void svg_basic_init(running_machine &machine)
4568		{
4569		pgm_state *state = machine.driver_data<pgm_state>();
4570
4571		pgm_basic_init(machine);
4572		state->m_svg_shareram[0] = auto_alloc_array(machine, UINT32, 0x10000 / 4);
4573		state->m_svg_shareram[1] = auto_alloc_array(machine, UINT32, 0x10000 / 4);
4574		state->m_svg_ram_sel = 0;
4575
4576		state->save_pointer(NAME(state->m_svg_shareram[0]), 0x10000 / 4);
4577		state->save_pointer(NAME(state->m_svg_shareram[1]), 0x10000 / 4);
4578		state->save_item(NAME(state->m_svg_ram_sel));
4579		}
4580
4581		static DRIVER_INIT( theglad )
4582		{
4583		svg_basic_init(machine);
4584		pgm_theglad_decrypt(machine);
4585		kov2_latch_init(machine);
4586		}
4587
4588		static DRIVER_INIT( svg )
4589		{
4590		svg_basic_init(machine);
4591		pgm_svg_decrypt(machine);
4592		kov2_latch_init(machine);
4593		}
4594
4595		static DRIVER_INIT( svgpcb )
4596		{
4597		svg_basic_init(machine);
4598		pgm_svgpcb_decrypt(machine);
4599		kov2_latch_init(machine);
4600		}
4601
4602		static DRIVER_INIT( killbldp )
4603		{
4604		svg_basic_init(machine);
4605		pgm_killbldp_decrypt(machine);
4606		kov2_latch_init(machine);
4607		}
4608
4609		static READ32_HANDLER( dmnfrnt_speedup_r )
4610		{
4611		pgm_state *state = space->machine().driver_data<pgm_state>();
4612		int pc = cpu_get_pc(&space->device());
4613		if (pc == 0x8000fea) device_eat_cycles(&space->device(), 500);
4614		// else printf("dmn_speedup_r %08x\n", pc);
4615		return state->m_arm_ram[0x000444/4];
4616		}
4617
4618
4619		static DRIVER_INIT( dmnfrnt )
4620		{
4621		pgm_state *state = machine.driver_data<pgm_state>();
4622
4623		svg_basic_init(machine);
4624		pgm_dfront_decrypt(machine);
4625		kov2_latch_init(machine);
4626
4627		/* put some fake code for the ARM here ... */
4628		UINT16 temp16 = (UINT16 )machine.region("prot")->base();
4629		temp16[(0x0000)/2] = 0xd088;
4630		temp16[(0x0002)/2] = 0xe59f;
4631		temp16[(0x0004)/2] = 0x0680;
4632		temp16[(0x0006)/2] = 0xe3a0;
4633		temp16[(0x0008)/2] = 0xff10;
4634		temp16[(0x000a)/2] = 0xe12f;
4635		temp16[(0x0090)/2] = 0x0400;
4636		temp16[(0x0092)/2] = 0x1000;
4637
4638		machine.device("prot")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x18000444, 0x18000447, FUNC(dmnfrnt_speedup_r));
4639
4640		// the internal rom probably also supplies the region here
4641		UINT16 share16 = (UINT16 )(state->m_svg_shareram[0]);
4642		share16[0x158/2] = 0x0005;
4643
4644
4645		}
4646
4647
4648		/* The IGS022 is an MCU which performs encrypted DMA used by
4649		- The Killing Blade
4650		- Dragon World 3
4651
4652		There is also an automatic transfer which happens on startup using params stored in the data ROM.
4653		This has been verified on real hardware running without any 68k game program.
4654
4655		*/
4656
4657
4658		static void IGS022_do_dma(running_machine& machine, UINT16 src, UINT16 dst, UINT16 size, UINT16 mode)
4659		{
4660		pgm_state *state = machine.driver_data<pgm_state>();
4661		UINT16 param;
4662		/*
4663		P_SRC =0x300290 (offset from prot rom base)
4664		P_DST =0x300292 (words from 0x300000)
4665		P_SIZE=0x300294 (words)
4666		P_MODE=0x300296
4667
4668		Mode 5 direct
4669		Mode 6 swap nibbles and bytes
4670
4671		1,2,3 table based ops
4672		*/
4673
4674		//mame_printf_debug("src %04x dst %04x size %04x mode %04x\n", src, dst, size, mode);
4675
4676		//if (src&1) mame_printf_debug("odd offset\n");
4677
4678		param = mode >> 8;
4679		mode &=0xf; // what are the other bits?
4680
4681
4682		if ((mode == 0) \|\| (mode == 1) \|\| (mode == 2) \|\| (mode == 3))
4683		{
4684		/* mode3 applies a xor from a 0x100 byte table to the data being
4685		transferred
4686
4687		the table is stored at the start of the protection rom.
4688
4689		the param used with the mode gives a start offset into the table
4690
4691		odd offsets seem to change the table slightly (see rawDataOdd)
4692
4693		*/
4694
4695		/*
4696		unsigned char rawDataOdd[256] = {
4697		0xB6, 0xA8, 0xB1, 0x5D, 0x2C, 0x5D, 0x4F, 0xC1,
4698		0xCF, 0x39, 0x3A, 0xB7, 0x65, 0x85, 0xD9, 0xEE,
4699		0xDB, 0x7B, 0x5F, 0x81, 0x03, 0x6D, 0xEB, 0x07,
4700		0x0F, 0xB5, 0x61, 0x59, 0xCD, 0x60, 0x06, 0x21,
4701		0xA0, 0x99, 0xDD, 0x27, 0x42, 0xD7, 0xC5, 0x5B,
4702		0x3B, 0xC6, 0x4F, 0xA2, 0x20, 0xF6, 0x61, 0x61,
4703		0x8C, 0x46, 0x8C, 0xCA, 0xE0, 0x0E, 0x2C, 0xE9,
4704		0xBA, 0x0F, 0x45, 0x6D, 0x36, 0x1C, 0x18, 0x37,
4705		0xE7, 0x85, 0x89, 0xA4, 0x94, 0x46, 0x30, 0x9B,
4706		0xB2, 0xF4, 0x41, 0x55, 0xA5, 0x63, 0x1C, 0xEF,
4707		0xB7, 0x18, 0xB3, 0xB1, 0xD4, 0x72, 0xA0, 0x1C,
4708		0x0B, 0x97, 0x02, 0xB6, 0xC5, 0x1F, 0x1B, 0x94,
4709		0xC3, 0x83, 0xAA, 0xAC, 0xD9, 0x44, 0x09, 0xD7,
4710		0x6C, 0xDB, 0x07, 0xA9, 0xAD, 0x64, 0x83, 0xF1,
4711		0x92, 0x09, 0xCD, 0x0E, 0x99, 0x2F, 0xBC, 0xF8,
4712		0x3C, 0x63, 0x8F, 0x0A, 0x33, 0x03, 0x84, 0x91,
4713		0x6C, 0xAC, 0x3A, 0x15, 0xCB, 0x67, 0xC7, 0x69,
4714		0xA1, 0x92, 0x99, 0x74, 0xEE, 0x90, 0x0D, 0xBE,
4715		0x57, 0x30, 0xD1, 0xBA, 0xE5, 0xDE, 0xFA, 0xD6,
4716		0x83, 0x8C, 0xE4, 0x43, 0x36, 0x5E, 0xCD, 0x84,
4717		0x1A, 0x18, 0x31, 0xB9, 0x20, 0x48, 0xE3, 0xA8,
4718		0x89, 0x32, 0xF0, 0x90, 0x21, 0x80, 0x33, 0xAE,
4719		0x3C, 0xA6, 0xB8, 0x8C, 0x72, 0x17, 0xD1, 0x0C,
4720		0x1A, 0x29, 0xFA, 0x38, 0x87, 0xC9, 0x6E, 0xC7,
4721		0x05, 0xDE, 0x85, 0x6E, 0x92, 0x7E, 0xD4, 0xED,
4722		0x5C, 0xD3, 0x03, 0xD4, 0xFE, 0xCB, 0x6C, 0x19,
4723		0x7A, 0x83, 0x79, 0x5B, 0xF6, 0x71, 0xBA, 0xF4,
4724		0x37, 0x53, 0xC9, 0xC1, 0xDE, 0xDB, 0xDE, 0xB1,
4725		0x64, 0x17, 0x31, 0x0E, 0xD7, 0xA2, 0x13, 0x8E,
4726		0x52, 0x8D, 0xCB, 0x19, 0x3D, 0x0B, 0x31, 0x58,
4727		0x4A, 0xDE, 0x0C, 0x01, 0x2B, 0x85, 0x2D, 0xE5,
4728		0x13, 0x22, 0x48, 0xB6, 0xF3, 0x2D, 0x00, 0x9A
4729		};
4730		*/
4731		int x;
4732		UINT16 PROTROM = (UINT16)machine.region("igs022data")->base();
4733
4734		for (x = 0; x < size; x++)
4735		{
4736		//UINT16 RAMDUMP = (UINT16)space->machine().region("user2")->base();
4737		//UINT16 dat = RAMDUMP[dst + x];
4738
4739		UINT16 dat2 = PROTROM[src + x];
4740
4741		UINT8 extraoffset = param&0xfe; // the lowest bit changed the table addressing in tests, see 'rawDataOdd' table instead.. it's still related to the main one, not identical
4742		UINT8* dectable = (UINT8*)machine.region("igs022data")->base();//rawDataEven; // the basic decryption table is at the start of the mcu data rom! at least in killbld
4743		UINT16 extraxor = ((dectable[((x2)+0+extraoffset)&0xff]) << 8) \| (dectable[((x2)+1+extraoffset)&0xff] << 0);
4744
4745		dat2 = ((dat2 & 0x00ff)<<8) \| ((dat2 & 0xff00)>>8);
4746
4747		// mode==0 plain
4748		if (mode==3) dat2 ^= extraxor;
4749		if (mode==2) dat2 += extraxor;
4750		if (mode==1) dat2 -= extraxor;
4751
4752		//if (dat!=dat2)
4753		// printf("Mode %04x Param %04x Mismatch %04x %04x\n", mode, param, dat, dat2);
4754
4755		state->m_sharedprotram[dst + x] = dat2;
4756		}
4757
4758		/* Killing Blade: hack, patches out some additional security checks... we need to emulate them instead! */
4759		// different region IGS025 devices supply different sequences - we currently only have the china sequence for Killing Blade
4760		//if ((mode==3) && (param==0x54) && (src2==0x2120) && (dst2==0x2600)) state->m_sharedprotram[0x2600 / 2] = 0x4e75;
4761
4762		}
4763		if (mode == 4)
4764		{
4765		mame_printf_debug("unhandled copy mode %04x!\n", mode);
4766		// not used by killing blade
4767		/* looks almost like a fixed value xor, but isn't */
4768		}
4769		else if (mode == 5)
4770		{
4771		/* mode 5 seems to be a straight copy */
4772		int x;
4773		UINT16 PROTROM = (UINT16)machine.region("igs022data")->base();
4774		for (x = 0; x < size; x++)
4775		{
4776		UINT16 dat = PROTROM[src + x];
4777
4778
4779		state->m_sharedprotram[dst + x] = dat;
4780		}
4781		}
4782		else if (mode == 6)
4783		{
4784		/* mode 6 seems to swap bytes and nibbles */
4785		int x;
4786		UINT16 PROTROM = (UINT16)machine.region("igs022data")->base();
4787		for (x = 0; x < size; x++)
4788		{
4789		UINT16 dat = PROTROM[src + x];
4790
4791		dat = ((dat & 0xf000) >> 12)\|
4792		((dat & 0x0f00) >> 4)\|
4793		((dat & 0x00f0) << 4)\|
4794		((dat & 0x000f) << 12);
4795
4796		state->m_sharedprotram[dst + x] = dat;
4797		}
4798		}
4799		else if (mode == 7)
4800		{
4801		mame_printf_debug("unhandled copy mode %04x!\n", mode);
4802		// not used by killing blade
4803		/* weird mode, the params get left in memory? - maybe it's a NOP? */
4804		}
4805		else
4806		{
4807		mame_printf_debug("unhandled copy mode %04x!\n", mode);
4808		// not used by killing blade
4809		/* invalid? */
4810
4811		}
4812		}
4813
4814		// the internal MCU boot code automatically does this DMA
4815		// and puts the version # of the data rom in ram
4816		static void IGS022_reset(running_machine& machine)
4817		{
4818		int i;
4819		UINT16 PROTROM = (UINT16)machine.region("igs022data")->base();
4820		pgm_state *state = machine.driver_data<pgm_state>();
4821		UINT16 tmp;
4822
4823		// fill ram with A5 patern
4824		for (i = 0; i < 0x4000/2; i++)
4825		state->m_sharedprotram[i] = 0xa55a;
4826
4827		// the auto-dma
4828		UINT16 src = PROTROM[0x100 / 2];
4829		UINT32 dst = PROTROM[0x102 / 2];
4830		UINT16 size = PROTROM[0x104/ 2];
4831		UINT16 mode = PROTROM[0x106 / 2];
4832
4833		src = ((src & 0xff00) >> 8) \| ((src & 0x00ff) << 8);
4834		dst = ((dst & 0xff00) >> 8) \| ((dst & 0x00ff) << 8);
4835		size = ((size & 0xff00) >> 8) \| ((size & 0x00ff) << 8);
4836		mode &= 0xff;
4837
4838		src >>= 1;
4839
4840		printf("Auto-DMA %04x %04x %04x %04x\n",src,dst,size,mode);
4841
4842		IGS022_do_dma(machine,src,dst,size,mode);
4843
4844		// there is also a version ID? (or is it some kind of checksum) that is stored in the data rom, and gets copied..
4845		// Dragon World 3 checks it
4846		tmp = PROTROM[0x114/2];
4847		tmp = ((tmp & 0xff00) >> 8) \| ((tmp & 0x00ff) << 8);
4848		state->m_sharedprotram[0x2a2/2] = tmp;
4849		}
4850
4851		static void IGS022_handle_command(running_machine& machine)
4852		{
4853		pgm_state *state = machine.driver_data<pgm_state>();
4854		UINT16 cmd = state->m_sharedprotram[0x200/2];
4855		//mame_printf_debug("command %04x\n", cmd);
4856		if (cmd == 0x6d) //Store values to asic ram
4857		{
4858		UINT32 p1 = (state->m_sharedprotram[0x298/2] << 16) \| state->m_sharedprotram[0x29a/2];
4859		UINT32 p2 = (state->m_sharedprotram[0x29c/2] << 16) \| state->m_sharedprotram[0x29e/2];
4860
4861		if ((p2 & 0xffff) == 0x9) //Set value
4862		{
4863		int reg = (p2 >> 16) & 0xffff;
4864		if (reg & 0x200)
4865		state->m_kb_regs[reg & 0xff] = p1;
4866		}
4867		if ((p2 & 0xffff) == 0x6) //Add value
4868		{
4869		int src1 = (p1 >> 16) & 0xff;
4870		int src2 = (p1 >> 0) & 0xff;
4871		int dst = (p2 >> 16) & 0xff;
4872		state->m_kb_regs[dst] = state->m_kb_regs[src2] - state->m_kb_regs[src1];
4873		}
4874		if ((p2 & 0xffff) == 0x1) //Add Imm?
4875		{
4876		int reg = (p2 >> 16) & 0xff;
4877		int imm = (p1 >> 0) & 0xffff;
4878		state->m_kb_regs[reg] += imm;
4879		}
4880		if ((p2 & 0xffff) == 0xa) //Get value
4881		{
4882		int reg = (p1 >> 16) & 0xFF;
4883		state->m_sharedprotram[0x29c/2] = (state->m_kb_regs[reg] >> 16) & 0xffff;
4884		state->m_sharedprotram[0x29e/2] = state->m_kb_regs[reg] & 0xffff;
4885		}
4886		}
4887		if(cmd == 0x4f) //memcpy with encryption / scrambling
4888		{
4889		UINT16 src = state->m_sharedprotram[0x290 / 2] >> 1; // ?
4890		UINT32 dst = state->m_sharedprotram[0x292 / 2];
4891		UINT16 size = state->m_sharedprotram[0x294 / 2];
4892		UINT16 mode = state->m_sharedprotram[0x296 / 2];
4893
4894		IGS022_do_dma(machine, src,dst,size,mode);
4895		}
4896
4897		}
4898
4899
4900		static WRITE16_HANDLER( killbld_igs025_prot_w )
4901		{
4902		// mame_printf_debug("killbrd prot r\n");
4903		// return 0;
4904		pgm_state *state = space->machine().driver_data<pgm_state>();
4905		offset &= 0xf;
4906
4907		if (offset == 0)
4908		state->m_kb_cmd = data;
4909		else //offset==2
4910		{
4911		logerror("%06X: ASIC25 W CMD %X VAL %X\n", cpu_get_pc(&space->device()), state->m_kb_cmd, data);
4912		if (state->m_kb_cmd == 0)
4913		state->m_kb_reg = data;
4914		else if (state->m_kb_cmd == 2)
4915		{
4916		if (data == 1) //Execute cmd
4917		{
4918		IGS022_handle_command(space->machine());
4919		state->m_kb_reg++;
4920		}
4921		}
4922		else if (state->m_kb_cmd == 4)
4923		state->m_kb_ptr = data;
4924		else if (state->m_kb_cmd == 0x20)
4925		state->m_kb_ptr++;
4926		}
4927		}
4928
4929		static READ16_HANDLER( killbld_igs025_prot_r )
4930		{
4931		// mame_printf_debug("killbld prot w\n");
4932		pgm_state *state = space->machine().driver_data<pgm_state>();
4933		UINT16 res ;
4934
4935		offset &= 0xf;
4936		res = 0;
4937
4938		if (offset == 1)
4939		{
4940		if (state->m_kb_cmd == 1)
4941		{
4942		res = state->m_kb_reg & 0x7f;
4943		}
4944		else if (state->m_kb_cmd == 5)
4945		{
4946
4947		UINT8 kb_region_sequence[11] = {0x17, 0x14, 0x91, 0x89, 0x21, 0xD5, 0x7C, 0x65, 0x8F, 0x8E, 0xE1};
4948		UINT8 ret;
4949
4950		// this isn't properly understood.. should be some kind of bitswap / xor / shift..based on values written to 0x22/0x23 etc.?
4951		// return hardcoded china sequence results for now, avoids rom patch
4952		if (state->m_kb_region_sequence_position < 11)
4953		{
4954		ret = kb_region_sequence[state->m_kb_region_sequence_position];
4955		state->m_kb_region_sequence_position++;
4956		}
4957		else
4958		{
4959		UINT32 protvalue = 0x89911400 \| input_port_read(space->machine(), "Region");
4960		ret = (protvalue >> (8 * (state->m_kb_ptr - 1))) & 0xff;
4961		}
4962
4963		res = 0x3f00 \| ret; // always 0x3fxx in logged behavior...
4964
4965		}
4966		}
4967		logerror("%06X: ASIC25 R CMD %X VAL %X\n", cpu_get_pc(&space->device()), state->m_kb_cmd, res);
4968		return res;
4969		}
4970
4971
4972
4973
4974		static MACHINE_RESET( killbld )
4975		{
4976		pgm_state *state = machine.driver_data<pgm_state>();
4977
4978		MACHINE_RESET_CALL(pgm);
4979		/* fill the protection ram with a5 + auto dma */
4980		IGS022_reset(machine);
4981
4982		// Reset IGS025 stuff
4983		state->m_kb_cmd = 0;
4984		state->m_kb_reg = 0;
4985		state->m_kb_ptr = 0;
4986		state->m_kb_region_sequence_position = 0;
4987		memset(state->m_kb_regs, 0, 0x10);
4988
4989		}
4990
4991
4992
4993
4994		/* ASIC025/ASIC022 don't provide rom patches like the DW2 protection does, the previous dump was bad :-) */
4995		static DRIVER_INIT( killbld )
4996		{
4997		pgm_state *state = machine.driver_data<pgm_state>();
4998
4999		pgm_basic_init(machine);
5000		pgm_killbld_decrypt(machine);
5001
5002		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0xd40000, 0xd40003, FUNC(killbld_igs025_prot_r), FUNC(killbld_igs025_prot_w));
5003
5004		state->m_kb_cmd = 0;
5005		state->m_kb_reg = 0;
5006		state->m_kb_ptr = 0;
5007		state->m_kb_region_sequence_position = 0;
5008		memset(state->m_kb_regs, 0, 0x10);
5009
5010		state->save_item(NAME(state->m_kb_region_sequence_position));
5011		state->save_item(NAME(state->m_kb_cmd));
5012		state->save_item(NAME(state->m_kb_reg));
5013		state->save_item(NAME(state->m_kb_ptr));
5014		state->save_item(NAME(state->m_kb_regs));
5015		}
5016
5017		static MACHINE_RESET( dw3 )
5018		{
5019		pgm_state *state = machine.driver_data<pgm_state>();
5020
5021
5022		MACHINE_RESET_CALL(pgm);
5023		/* fill the protection ram with a5 + auto dma */
5024		IGS022_reset(machine);
5025
5026		/* game won't boot unless various values are in protection RAM
5027		- these should almost certainly end up there as the result of executing the protection
5028		commands are startup, but which, and how? */
5029
5030		// state->m_sharedprotram[0x200/2] = 0x006d;
5031		state->m_sharedprotram[0x202/2] = 0x007c; // it cares about this, operation status flag?
5032
5033		// state->m_sharedprotram[0x20c/2] = 0x0000;
5034		// state->m_sharedprotram[0x20e/2] = 0x0007;
5035		// state->m_sharedprotram[0x210/2] = 0x0000;
5036		// state->m_sharedprotram[0x212/2] = 0x0004;
5037		// state->m_sharedprotram[0x214/2] = 0x0000;
5038		// state->m_sharedprotram[0x216/2] = 0x0007;
5039		// state->m_sharedprotram[0x218/2] = 0x0000;
5040		// state->m_sharedprotram[0x21a/2] = 0x0004;
5041
5042		// state->m_sharedprotram[0x288/2] = 0x0000;
5043		// state->m_sharedprotram[0x28a/2] = 0x00c2;
5044		// state->m_sharedprotram[0x28c/2] = 0x0000;
5045		// state->m_sharedprotram[0x28e/2] = 0x00c2;
5046		// state->m_sharedprotram[0x290/2] = 0x0500;
5047		// state->m_sharedprotram[0x292/2] = 0x1000;
5048		// state->m_sharedprotram[0x294/2] = 0x00c3;
5049		// state->m_sharedprotram[0x296/2] = 0x7104;
5050		// state->m_sharedprotram[0x298/2] = 0x0000;
5051		// state->m_sharedprotram[0x29a/2] = 0x0003;
5052		// state->m_sharedprotram[0x29c/2] = 0x0108;
5053		// state->m_sharedprotram[0x29e/2] = 0x0009;
5054
5055		// state->m_sharedprotram[0x2a2/2] = 0x84f6; // it cares about this, it's the version number of the data rom, copied automatically!
5056
5057		// state->m_sharedprotram[0x2ac/2] = 0x006d;
5058		// state->m_sharedprotram[0x2ae/2] = 0x0000;
5059
5060		// state->m_sharedprotram[0x2b0/2] = 0xaf56;
5061
5062
5063		// Reset IGS025 stuff
5064		state->m_kb_cmd = 0;
5065		state->m_kb_reg = 0;
5066		state->m_kb_ptr = 0;
5067		state->m_kb_region_sequence_position = 0;
5068		memset(state->m_kb_regs, 0, 0x10);
5069
5070		}
5071
5072
5073
5074		static int reg;
5075		static int ptr=0;
5076
5077		#define DW3BITSWAP(s,d,bs,bd) d=((d&(~(1<<bd)))\|(((s>>bs)&1)<<bd))
5078		static UINT8 dw3_swap;
5079		static WRITE16_HANDLER( drgw3_igs025_prot_w )
5080		{
5081		pgm_state *state = space->machine().driver_data<pgm_state>();
5082
5083		offset&=0xf;
5084
5085		if(offset==0)
5086		state->m_kb_cmd=data;
5087		else //offset==2
5088		{
5089		printf("%06X: ASIC25 W CMD %X VAL %X\n",cpu_get_pc(&space->device()),state->m_kb_cmd,data);
5090		if(state->m_kb_cmd==0)
5091		reg=data;
5092		else if(state->m_kb_cmd==3) //??????????
5093		{
5094		dw3_swap = data;
5095
5096		printf("SWAP %02x\n",dw3_swap);
5097		}
5098		//else if(kb_cmd==4)
5099		// ptr=data;
5100		else if(state->m_kb_cmd==0x20)
5101		ptr++;
5102		}
5103		}
5104
5105		static READ16_HANDLER( drgw3_igs025_prot_r )
5106		{
5107		// mame_printf_debug("killbld prot w\n");
5108		pgm_state *state = space->machine().driver_data<pgm_state>();
5109
5110		UINT16 res ;
5111
5112		offset&=0xf;
5113		res=0;
5114
5115		if(offset==1)
5116		{
5117		if(state->m_kb_cmd==0) //swap
5118		{
5119		UINT8 v1=(dw3_swap+1)&0x7F;
5120		UINT8 v2=0;
5121		DW3BITSWAP(v1,v2,7,0);
5122		DW3BITSWAP(v1,v2,6,1);
5123		DW3BITSWAP(v1,v2,5,2);
5124		DW3BITSWAP(v1,v2,4,3);
5125		DW3BITSWAP(v1,v2,3,4);
5126		DW3BITSWAP(v1,v2,2,5);
5127		DW3BITSWAP(v1,v2,1,6);
5128		DW3BITSWAP(v1,v2,0,7);
5129
5130		res=v2;
5131
5132		}
5133		else if(state->m_kb_cmd==1)
5134		{
5135		res=reg&0x7f;
5136		}
5137		else if(state->m_kb_cmd==5)
5138		{
5139		UINT32 protvalue;
5140		protvalue = 0x60000\|input_port_read(space->machine(), "Region");
5141		res=(protvalue>>(8*(ptr-1)))&0xff;
5142
5143
5144		}
5145		}
5146		logerror("%06X: ASIC25 R CMD %X VAL %X\n",cpu_get_pc(&space->device()),state->m_kb_cmd,res);
5147		return res;
5148		}
5149
5150
5151		static DRIVER_INIT( drgw3 )
5152		{
5153		pgm_basic_init(machine);
5154
5155		/*
5156		pgm_state *state = machine.driver_data<pgm_state>();
5157
5158		{
5159		int x;
5160		UINT16 RAMDUMP = (UINT16)machine.region("user2")->base();
5161		for (x=0;x<(0x4000/2);x++)
5162		{
5163		state->m_sharedprotram[x] = RAMDUMP[x];
5164		if((x>=0x100)&&(x<0x110)) printf("data 0x%4x, offset:%x\n",state->m_sharedprotram[x],x);
5165		}
5166		}
5167		*/
5168		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0xDA5610, 0xDA5613, FUNC(drgw3_igs025_prot_r), FUNC(drgw3_igs025_prot_w));
5169
5170		pgm_dw3_decrypt(machine);
5171		}
5172
5173		static INT32 puzzli_54_trigger = 0;
5174
5175		// Preliminary
5176		static WRITE16_HANDLER( puzzli2_asic_w )
5177		{
5178		cavepgm_state *state = space->machine().driver_data<cavepgm_state>();
5179
5180		switch (offset & 0x03)
5181		{
5182		case 0: state->m_value0 = data; return;
5183
5184		case 1:
5185		{
5186		if ((data >> 8) == 0xff) state->m_valuekey = 0xffff;
5187
5188		state->m_value0 ^= state->m_valuekey;
5189
5190		switch ((data ^ state->m_valuekey) & 0xff)
5191		{
5192		case 0x13: // ASIC status?
5193		state->m_valueresponse = 0x74<<16; // 2d or 74! (based on?)
5194		break;
5195
5196		case 0x31:
5197		{
5198		// how is this selected? command 54?
5199
5200		// just a wild guess
5201		if (puzzli_54_trigger) {
5202		// pc == 1387de
5203		state->m_valueresponse = 0x63<<16; // ?
5204		} else {
5205		// pc == 14cf58
5206		state->m_valueresponse = 0xd2<<16;
5207		}
5208
5209		puzzli_54_trigger = 0;
5210		}
5211		break;
5212
5213		case 0x38: // Reset
5214		state->m_valueresponse = 0x78<<16;
5215		state->m_valuekey = 0;
5216		puzzli_54_trigger = 0;
5217		break;
5218
5219		case 0x41: // ASIC status?
5220		state->m_valueresponse = 0x74<<16;
5221		break;
5222
5223		case 0x47: // ASIC status?
5224		state->m_valueresponse = 0x74<<16;
5225		break;
5226
5227		case 0x52: // ASIC status?
5228		{
5229		// how is this selected?
5230
5231		//if (state->m_value0 == 6) {
5232		state->m_valueresponse = (0x74<<16)\|1; // \|1?
5233		//} else {
5234		// state->m_valueresponse = 0x74<<16;
5235		//}
5236		}
5237		break;
5238
5239		case 0x54: // ??
5240		puzzli_54_trigger = 1;
5241		state->m_valueresponse = 0x36<<16;
5242		break;
5243
5244		case 0x61: // ??
5245		state->m_valueresponse = 0x36<<16;
5246		break;
5247
5248		case 0x63: // probably read from a data table?
5249		state->m_valueresponse = 0; // wrong...
5250		break;
5251
5252		case 0x67: // probably read from a data table?
5253		state->m_valueresponse = 0; // wrong...
5254		break;
5255
5256		default:
5257		state->m_valueresponse = 0x74<<16;
5258		break;
5259		}
5260
5261		state->m_valuekey = (state->m_valuekey + 0x0100) & 0xff00;
5262		if (state->m_valuekey == 0xff00) state->m_valuekey = 0x0100;
5263		state->m_valuekey \|= state->m_valuekey >> 8;
5264		}
5265		return;
5266
5267		case 2: return;
5268		}
5269		}
5270
5271
5272		static DRIVER_INIT( dw2001 )
5273		{
5274		//pgm_state *state = machine.driver_data<pgm_state>();
5275		UINT16 mem16 = (UINT16 )machine.region("maincpu")->base();
5276
5277		pgm_basic_init(machine);
5278		kovsh_latch_init(machine);
5279		pgm_mm_decrypt(machine); // encryption is the same as martial masters
5280
5281		mem16[0x11e90c / 2] = 0x4e71;
5282		mem16[0x11e90e / 2] = 0x4e71;
5283
5284		mem16[0x11e91a / 2] = 0x4e71;
5285
5286		mem16[0x11eaf6 / 2] = 0x4e71;
5287		mem16[0x11eaf8 / 2] = 0x4e71;
5288
5289		mem16[0x11eb04 / 2] = 0x4e71;
5290
5291		}
5292
5293		static UINT32 olds_prot_addr( UINT16 addr )
5294		{
5295		UINT32 mode = addr & 0xff;
5296		UINT32 offset = addr >> 8;
5297		UINT32 realaddr;
5298
5299		switch(mode)
5300		{
5301		case 0x0:
5302		case 0x5:
5303		case 0xa:
5304		realaddr = 0x402a00 + (offset << 2);
5305		break;
5306
5307		case 0x2:
5308		case 0x8:
5309		realaddr = 0x402e00 + (offset << 2);
5310		break;
5311
5312		case 0x1:
5313		realaddr = 0x40307e;
5314		break;
5315
5316		case 0x3:
5317		realaddr = 0x403090;
5318		break;
5319
5320		case 0x4:
5321		realaddr = 0x40309a;
5322		break;
5323
5324		case 0x6:
5325		realaddr = 0x4030a4;
5326		break;
5327
5328		case 0x7:
5329		realaddr = 0x403000;
5330		break;
5331
5332		case 0x9:
5333		realaddr = 0x40306e;
5334		break;
5335
5336		default:
5337		realaddr = 0;
5338		}
5339		return realaddr;
5340		}
5341
5342		static UINT32 olds_read_reg( running_machine &machine, UINT16 addr )
5343		{
5344		pgm_state *state = machine.driver_data<pgm_state>();
5345		UINT32 protaddr = (olds_prot_addr(addr) - 0x400000) / 2;
5346		return state->m_sharedprotram[protaddr] << 16 \| state->m_sharedprotram[protaddr + 1];
5347		}
5348
5349		static void olds_write_reg( running_machine &machine, UINT16 addr, UINT32 val )
5350		{
5351		pgm_state *state = machine.driver_data<pgm_state>();
5352		state->m_sharedprotram[(olds_prot_addr(addr) - 0x400000) / 2] = val >> 16;
5353		state->m_sharedprotram[(olds_prot_addr(addr) - 0x400000) / 2 + 1] = val & 0xffff;
5354		}
5355
5356		static MACHINE_RESET( olds )
5357		{
5358		pgm_state *state = machine.driver_data<pgm_state>();
5359		UINT16 mem16 = (UINT16 )machine.region("user2")->base();
5360		int i;
5361
5362		MACHINE_RESET_CALL(pgm);
5363
5364		/* populate shared protection ram with data read from pcb .. */
5365		for (i = 0; i < 0x4000 / 2; i++)
5366		{
5367		state->m_sharedprotram[i] = mem16[i];
5368		}
5369
5370		//ROM:004008B4 .word 0xFBA5
5371		for(i = 0; i < 0x4000 / 2; i++)
5372		{
5373		if (state->m_sharedprotram[i] == (0xffff - i))
5374		state->m_sharedprotram[i] = 0x4e75;
5375		}
5376		}
5377
5378		static READ16_HANDLER( olds_r )
5379		{
5380		pgm_state *state = space->machine().driver_data<pgm_state>();
5381		UINT16 res = 0;
5382
5383		if (offset == 1)
5384		{
5385		if (state->m_kb_cmd == 1)
5386		res = state->m_kb_reg & 0x7f;
5387		if (state->m_kb_cmd == 2)
5388		res = state->m_olds_bs \| 0x80;
5389		if (state->m_kb_cmd == 3)
5390		res = state->m_olds_cmd3;
5391		else if (state->m_kb_cmd == 5)
5392		{
5393		UINT32 protvalue = 0x900000 \| input_port_read(space->machine(), "Region"); // region from protection device.
5394		res = (protvalue >> (8 * (state->m_kb_ptr - 1))) & 0xff; // includes region 1 = taiwan , 2 = china, 3 = japan (title = orlegend special), 4 = korea, 5 = hongkong, 6 = world
5395
5396		}
5397		}
5398		logerror("%06X: ASIC25 R CMD %X VAL %X\n", cpu_get_pc(&space->device()), state->m_kb_cmd, res);
5399		return res;
5400		}
5401
5402		static WRITE16_HANDLER( olds_w )
5403		{
5404		pgm_state *state = space->machine().driver_data<pgm_state>();
5405		if (offset == 0)
5406		state->m_kb_cmd = data;
5407		else //offset==2
5408		{
5409		logerror("%06X: ASIC25 W CMD %X VAL %X\n",cpu_get_pc(&space->device()), state->m_kb_cmd, data);
5410		if (state->m_kb_cmd == 0)
5411		state->m_kb_reg = data;
5412		else if(state->m_kb_cmd == 2) //a bitswap=
5413		{
5414		int reg = 0;
5415		if (data & 0x01)
5416		reg \|= 0x40;
5417		if (data & 0x02)
5418		reg \|= 0x80;
5419		if (data & 0x04)
5420		reg \|= 0x20;
5421		if (data & 0x08)
5422		reg \|= 0x10;
5423		state->m_olds_bs = reg;
5424		}
5425		else if (state->m_kb_cmd == 3)
5426		{
5427		UINT16 cmd = state->m_sharedprotram[0x3026 / 2];
5428		switch (cmd)
5429		{
5430		case 0x11:
5431		case 0x12:
5432		break;
5433		case 0x64:
5434		{
5435		UINT16 cmd0 = state->m_sharedprotram[0x3082 / 2];
5436		UINT16 val0 = state->m_sharedprotram[0x3050 / 2]; //CMD_FORMAT
5437		{
5438		if ((cmd0 & 0xff) == 0x2)
5439		olds_write_reg(space->machine(), val0, olds_read_reg(space->machine(), val0) + 0x10000);
5440		}
5441		break;
5442		}
5443
5444		default:
5445		break;
5446		}
5447		state->m_olds_cmd3 = ((data >> 4) + 1) & 0x3;
5448		}
5449		else if (state->m_kb_cmd == 4)
5450		state->m_kb_ptr = data;
5451		else if(state->m_kb_cmd == 0x20)
5452		state->m_kb_ptr++;
5453		}
5454		}
5455
5456		static READ16_HANDLER( olds_prot_swap_r )
5457		{
5458		if (cpu_get_pc(&space->device()) < 0x100000) //bios
5459		return pgm_mainram[0x178f4 / 2];
5460		else //game
5461		return pgm_mainram[0x178d8 / 2];
5462
5463		}
5464
5465		static DRIVER_INIT( olds )
5466		{
5467		pgm_state *state = machine.driver_data<pgm_state>();
5468		pgm_basic_init(machine);
5469
5470		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0xdcb400, 0xdcb403, FUNC(olds_r), FUNC(olds_w));
5471		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x8178f4, 0x8178f5, FUNC(olds_prot_swap_r));
5472
5473		state->m_kb_cmd = 0;
5474		state->m_kb_reg = 0;
5475		state->m_kb_ptr = 0;
5476		state->m_olds_bs = 0;
5477		state->m_olds_cmd3 = 0;
5478
5479		state->save_item(NAME(state->m_kb_cmd));
5480		state->save_item(NAME(state->m_kb_reg));
5481		state->save_item(NAME(state->m_kb_ptr));
5482		state->save_item(NAME(state->m_olds_bs));
5483		state->save_item(NAME(state->m_olds_cmd3));
5484		}
5485
5486
5487
5488		static void pgm_decode_kovlsqh2_tiles( running_machine &machine )
5489		{
5490		int i, j;
5491		UINT16 src = (UINT16 )(machine.region("tiles")->base() + 0x180000);
5492		UINT16 *dst = auto_alloc_array(machine, UINT16, 0x800000);
5493
5494		for (i = 0; i < 0x800000 / 2; i++)
5495		{
5496		j = BITSWAP24(i, 23, 22, 9, 8, 21, 18, 0, 1, 2, 3, 16, 15, 14, 13, 12, 11, 10, 19, 20, 17, 7, 6, 5, 4);
5497
5498		dst[j] = BITSWAP16(src[i], 1, 14, 8, 7, 0, 15, 6, 9, 13, 2, 5, 10, 12, 3, 4, 11);
5499		}
5500
5501		memcpy( src, dst, 0x800000 );
5502
5503		auto_free( machine, dst );
5504		}
5505
5506		static void pgm_decode_kovlsqh2_sprites( running_machine &machine, UINT8 *src )
5507		{
5508		int i, j;
5509		UINT8 *dst = auto_alloc_array(machine, UINT8, 0x800000);
5510
5511		for (i = 0; i < 0x800000; i++)
5512		{
5513		j = BITSWAP24(i, 23, 10, 9, 22, 19, 18, 20, 21, 17, 16, 15, 14, 13, 12, 11, 8, 7, 6, 5, 4, 3, 2, 1, 0);
5514
5515		dst[j] = src[i];
5516		}
5517
5518		memcpy( src, dst, 0x800000 );
5519
5520		auto_free( machine, dst );
5521		}
5522
5523		static void pgm_decode_kovlsqh2_samples( running_machine &machine )
5524		{
5525		int i;
5526		UINT8 src = (UINT8 )(machine.region("ics")->base() + 0x400000);
5527
5528		for (i = 0; i < 0x400000; i+=2) {
5529		src[i + 0x000001] = src[i + 0x400001];
5530		}
5531
5532		memcpy( src + 0x400000, src, 0x400000 );
5533		}
5534
5535		static void pgm_decode_kovqhsgs_program( running_machine &machine )
5536		{
5537		int i;
5538		UINT16 src = (UINT16 )(machine.region("maincpu")->base() + 0x100000);
5539		UINT16 *dst = auto_alloc_array(machine, UINT16, 0x400000);
5540
5541		for (i = 0; i < 0x400000 / 2; i++)
5542		{
5543		int j = BITSWAP24(i, 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13, 12, 11, 10, 9, 8, 6, 7, 5, 4, 3, 2, 1, 0);
5544
5545		dst[j] = BITSWAP16(src[i], 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 4, 5, 3, 2, 1, 0);
5546		}
5547
5548		memcpy( src, dst, 0x400000 );
5549
5550		auto_free( machine, dst );
5551		}
5552
5553		static void pgm_decode_kovqhsgs2_program( running_machine &machine )
5554		{
5555		int i;
5556		UINT16 src = (UINT16 )(machine.region("maincpu")->base() + 0x100000);
5557		UINT16 *dst = auto_alloc_array(machine, UINT16, 0x400000);
5558
5559		for (i = 0; i < 0x400000 / 2; i++)
5560		{
5561		int j = BITSWAP24(i, 23, 22, 21, 20, 19, 16, 15, 14, 13, 12, 11, 10, 9, 8, 0, 1, 2, 3, 4, 5, 6, 18, 17, 7);
5562
5563		dst[j] = src[i];
5564		}
5565
5566		memcpy( src, dst, 0x400000 );
5567
5568		auto_free( machine, dst );
5569		}
5570
5571
5572		static DRIVER_INIT( kovlsqh2 )
5573		{
5574		pgm_decode_kovqhsgs2_program(machine);
5575		pgm_decode_kovlsqh2_tiles(machine);
5576
5577		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x0000000);
5578		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x0800000);
5579		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x1000000);
5580		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x1800000);
5581		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x2000000);
5582		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x2800000);
5583		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprmask")->base() + 0x0000000);
5584		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprmask")->base() + 0x0800000);
5585
5586		pgm_decode_kovlsqh2_samples(machine);
5587		pgm_basic_init(machine);
5588		kovsh_latch_init(machine);
5589		}
5590
5591		static DRIVER_INIT( kovqhsgs )
5592		{
5593		pgm_decode_kovqhsgs_program(machine);
5594		pgm_decode_kovlsqh2_tiles(machine);
5595
5596		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x0000000);
5597		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x0800000);
5598		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x1000000);
5599		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x1800000);
5600		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x2000000);
5601		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprcol")->base() + 0x2800000);
5602		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprmask")->base() + 0x0000000);
5603		pgm_decode_kovlsqh2_sprites(machine, machine.region("sprmask")->base() + 0x0800000);
5604
5605		pgm_decode_kovlsqh2_samples(machine);
5606
5607		pgm_basic_init(machine);
5608		kovsh_latch_init(machine);
5609		}
5610
5611		/*
5612		in Ketsui (ket) @ 000A719C (move.w)
5613
5614		if you change D0 to 0x12
5615		the game will runs to "Asic27 Test" mode
5616
5617		bp A71A0,1,{d0=0x12;g}
5618		*/
5619
5620		static WRITE16_HANDLER( ddp3_asic_w )
5621		{
5622		cavepgm_state *state = space->machine().driver_data<cavepgm_state>();
5623
5624		if (offset == 0)
5625		{
5626		state->m_value0 = data;
5627		return;
5628		}
5629		else if (offset == 1)
5630		{
5631		UINT16 realkey;
5632		if ((data >> 8) == 0xff)
5633		state->m_valuekey = 0xff00;
5634		realkey = state->m_valuekey >> 8;
5635		realkey \|= state->m_valuekey;
5636		{
5637		state->m_valuekey += 0x0100;
5638		state->m_valuekey &= 0xff00;
5639		if (state->m_valuekey == 0xff00)
5640		state->m_valuekey = 0x0100;
5641		}
5642		data ^= realkey;
5643		state->m_value1 = data;
5644		state->m_value0 ^= realkey;
5645
5646		state->m_ddp3lastcommand = state->m_value1 & 0xff;
5647
5648		/* typical frame (ddp3) (all 3 games use only these commands? for the most part of levels espgal just issues 8e)
5649		vbl
5650		145f28 command 67
5651		145f70 command e5
5652		145f28 command 67
5653		145f70 command e5
5654		1460c6 command 40
5655		145ec0 command 8e
5656		*/
5657
5658		switch (state->m_ddp3lastcommand)
5659		{
5660		default:
5661		printf("%06x command %02x \| %04x\n", cpu_get_pc(&space->device()), state->m_ddp3lastcommand, state->m_value0);
5662		state->m_valueresponse = 0x880000;
5663		break;
5664
5665		case 0x40:
5666		state->m_valueresponse = 0x880000;
5667		state->m_ddp3slots[(state->m_value0>>10)&0x1F]=
5668		(state->m_ddp3slots[(state->m_value0>>5)&0x1F]+
5669		state->m_ddp3slots[(state->m_value0>>0)&0x1F])&0xffffff;
5670		break;
5671
5672		case 0x67: // set high bits
5673		// printf("%06x command %02x \| %04x\n", cpu_get_pc(&space->device()), state->m_ddp3lastcommand, state->m_value0);
5674		state->m_valueresponse = 0x880000;
5675		state->m_ddp3internal_slot = (state->m_value0 & 0xff00)>>8;
5676		state->m_ddp3slots[state->m_ddp3internal_slot] = (state->m_value0 & 0x00ff) << 16;
5677		break;
5678
5679		case 0xe5: // set low bits for operation?
5680		// printf("%06x command %02x \| %04x\n", cpu_get_pc(&space->device()), state->m_ddp3lastcommand, state->m_value0);
5681		state->m_valueresponse = 0x880000;
5682		state->m_ddp3slots[state->m_ddp3internal_slot] \|= (state->m_value0 & 0xffff);
5683		break;
5684
5685
5686		case 0x8e: // read back result of operations
5687		// printf("%06x command %02x \| %04x\n", cpu_get_pc(&space->device()), state->m_ddp3lastcommand, state->m_value0);
5688		state->m_valueresponse = state->m_ddp3slots[state->m_value0&0xff];
5689		break;
5690
5691
5692		case 0x99: // reset?
5693		state->m_valuekey = 0x100;
5694		state->m_valueresponse = 0x00880000;
5695		break;
5696
5697		}
5698		}
5699		else if (offset==2)
5700		{
5701
5702		}
5703
5704		}
5705
5706		static READ16_HANDLER( ddp3_asic_r )
5707		{
5708		cavepgm_state *state = space->machine().driver_data<cavepgm_state>();
5709
5710		if (offset == 0)
5711		{
5712		UINT16 d = state->m_valueresponse & 0xffff;
5713		UINT16 realkey = state->m_valuekey >> 8;
5714		realkey \|= state->m_valuekey;
5715		d ^= realkey;
5716
5717		return d;
5718
5719		}
5720		else if (offset == 1)
5721		{
5722		UINT16 d = state->m_valueresponse >> 16;
5723		UINT16 realkey = state->m_valuekey >> 8;
5724		realkey \|= state->m_valuekey;
5725		d ^= realkey;
5726		return d;
5727
5728		}
5729		return 0xffff;
5730		}
5731
5732
5733		void install_asic27a_ddp3(running_machine& machine)
5734		{
5735		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
5736		}
5737
5738		void install_asic27a_ket(running_machine& machine)
5739		{
5740		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x400000, 0x400005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
5741		}
5742
5743		void install_asic27a_espgal(running_machine& machine)
5744		{
5745		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x400000, 0x400005, FUNC(ddp3_asic_r), FUNC(ddp3_asic_w));
5746		}
5747
5748		static DRIVER_INIT( ddp3 )
5749		{
5750		pgm_basic_init(machine, false);
5751		pgm_py2k2_decrypt(machine); // yes, it's the same as photo y2k2
5752		install_asic27a_ddp3(machine);
5753		}
5754
5755		static DRIVER_INIT( ket )
5756		{
5757		pgm_basic_init(machine, false);
5758		pgm_ket_decrypt(machine);
5759		install_asic27a_ket(machine);
5760		}
5761
5762		static DRIVER_INIT( espgal )
5763		{
5764		pgm_basic_init(machine, false);
5765		pgm_espgal_decrypt(machine);
5766		install_asic27a_espgal(machine);
5767		}
5768
5769		static DRIVER_INIT( puzzli2 )
5770		{
5771		cavepgm_state *state = machine.driver_data<cavepgm_state>();
5772
5773		pgm_basic_init(machine);
5774
5775		pgm_puzzli2_decrypt(machine);
5776
5777		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500005, FUNC(ddp3_asic_r), FUNC(puzzli2_asic_w));
5778		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4fffff, FUNC(sango_protram_r));
5779
5780		// doesn't like this irq??
5781		state->m_irq4_disabled = 1;
5782		}
5783
5784		static void oldsplus_latch_init( running_machine &machine )
5785		{
5786		pgm_state *state = machine.driver_data<pgm_state>();
5787
5788		state->m_oldsplus_key = 0;
5789		state->m_oldsplus_int[0] = 0;
5790		state->m_oldsplus_int[1] = 0;
5791		state->m_oldsplus_val = 0;
5792		memset(state->m_oldsplus_ram, 0, 0x100);
5793		memset(state->m_oldsplus_regs, 0, 0x100);
5794
5795		state_save_register_global(machine, state->m_oldsplus_key);
5796		state_save_register_global(machine, state->m_oldsplus_val);
5797		state_save_register_global_array(machine, state->m_oldsplus_int);
5798		state_save_register_global_array(machine, state->m_oldsplus_ram);
5799		state_save_register_global_array(machine, state->m_oldsplus_regs);
5800		}
5801
5802		#if 0
5803		static DRIVER_INIT( oldsplus )
5804		{
5805		pgm_basic_init(machine);
5806		pgm_oldsplus_decrypt(machine);
5807		kovsh_latch_init(machine);
5808		}
5809		#endif
5810
5811		static DRIVER_INIT( oldsplus )
5812		{
5813		pgm_basic_init(machine);
5814		pgm_oldsplus_decrypt(machine);
5815		oldsplus_latch_init(machine);
5816
5817		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_readwrite_handler(0x500000, 0x500003, FUNC(oldsplus_r), FUNC(oldsplus_w));
5818		machine.device("maincpu")->memory().space(AS_PROGRAM)->install_legacy_read_handler(0x4f0000, 0x4fffff, FUNC(oldsplus_protram_r));
5819		}
5820
5821		static DRIVER_INIT( kov2p )
5822		{
5823		// this hacks the identification of the kov2 rom to return the string required for kov2p
5824		// this isn't guaranteed to work properly (and definitely wouldn't on real hardware due to the internal
5825		// ROM uploading the encryption table) The internal ROM should be dumped properly.
5826		UINT8 mem8 = (UINT8 )machine.region("user1")->base();
5827		pgm_basic_init(machine);
5828		pgm_kov2p_decrypt(machine);
5829		kov2_latch_init(machine);
5830		mem8[0xDE] = 0xC0;
5831		mem8[0xDF] = 0x46;
5832		mem8[0x4ED8] = 0xA8;// B0
5833		mem8[0x4EDC] = 0x9C;// A4
5834		mem8[0x4EE0] = 0x5C;// 64
5835		mem8[0x4EE4] = 0x94;// 9C
5836		mem8[0x4EE8] = 0xE8;// F0
5837		mem8[0x4EEC] = 0x6C;// 74
5838		mem8[0x4EF0] = 0xD4;// DC
5839		mem8[0x4EF4] = 0x50;// 58
5840		mem8[0x4EF8] = 0x80;// 88
5841		mem8[0x4EFC] = 0x9C;// A4
5842		mem8[0x4F00] = 0x28;// 30
5843		mem8[0x4F04] = 0x30;// 38
5844		mem8[0x4F08] = 0x34;// 3C
5845		mem8[0x4F0C] = 0x1C;// 24
5846		mem8[0x1FFFFC] = 0x33;
5847		mem8[0x1FFFFD] = 0x99;
5848		}
5849
5850		static DRIVER_INIT( happy6 )
5851		{
5852		svg_basic_init(machine);
5853		pgm_happy6_decrypt(machine);
5854		kov2_latch_init(machine);
5855		}
5856
5857
5858	3618	/* GAME ******************************************************************/
5859	3619
5860	3620	GAME( 1997, pgm, 0, pgm, pgm, pgm, ROT0, "IGS", "PGM (Polygame Master) System BIOS", GAME_IS_BIOS_ROOT )
r14798	r14799
5882	3642	GAME( 1999, photoy2k102, photoy2k, kov, photoy2k, photoy2k, ROT0, "IGS", "Photo Y2K (ver. 102, Japanese Board)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) /* region provided by protection device */
5883	3643
5884	3644	// region provided by internal ARM rom
5885		GAME( 1999, kovsh, pgm, kov, sango, kovsh, ROT0, "IGS", "Knights of Valour Super Heroes / Sangoku Senki Super Heroes (ver. 104, CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V104, China internal ROM
5886		GAME( 1999, kovsh103, kovsh, kov, sango, kovsh, ROT0, "IGS", "Knights of Valour Super Heroes / Sangoku Senki Super Heroes (ver. 103, CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V103, China internal ROM
	3645	GAME( 1999, kovsh, pgm, kov, kovsh, kovsh, ROT0, "IGS", "Knights of Valour Super Heroes / Sangoku Senki Super Heroes (ver. 104, CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V104, China internal ROM
	3646	GAME( 1999, kovsh103, kovsh, kov, kovsh, kovsh, ROT0, "IGS", "Knights of Valour Super Heroes / Sangoku Senki Super Heroes (ver. 103, CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V103, China internal ROM
5887	3647	// nasty modern asian bootleg of Knights of Valour Super Heroes with characters ripped from SNK's The King of Fighters series!
5888		GAME( 1999, kovqhsgs, kovsh, kov, ~~sang~~o, kovqhsgs, ROT0, "bootleg", "Knights of Valour: Quan Huang San Guo Special / Sangoku Senki: Quan Huang San Guo Special (ver. 303CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE )
	3648	GAME( 1999, kovqhsgs, kovsh, kov, kovsh, kovqhsgs, ROT0, "bootleg", "Knights of Valour: Quan Huang San Guo Special / Sangoku Senki: Quan Huang San Guo Special (ver. 303CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE )
5889	3649
5890	3650	// region provided by internal ARM rom
5891		GAME( 2000, kov2, pgm, kov2, sango, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 107, 102, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 05/10/01 14:24:08 V107 (Ext. Arm V102, Int. Arm V100HK)
5892		GAME( 2000, kov2106, kov2, kov2, sango, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 106, 102, 100KH)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 02/27/01 13:26:46 V106 (Ext. Arm V102, Int. Arm V100HK)
5893		GAME( 2000, kov2103, kov2, kov2, sango, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 103, 101, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 12/28/00 15:09:31 V103 (Ext. Arm V101, Int. Arm V100HK)
5894		GAME( 2000, kov2102, kov2, kov2, sango, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 102, 101, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 12/14/00 10:33:36 V102 (Ext. Arm V101, Int. Arm V100HK)
5895		GAME( 2000, kov2101, kov2, kov2, sango, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 101, 101, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 11/29/00 11:03:08 V100 (Ext. Arm V100, Int. Arm V100HK)
5896		GAME( 2000, kov2100, kov2, kov2, sango, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 100, 100, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 11/29/00 11:03:08 V100 (Ext. Arm V100, Int. Arm V100HK)
	3651	GAME( 2000, kov2, pgm, kov2, kov2, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 107, 102, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 05/10/01 14:24:08 V107 (Ext. Arm V102, Int. Arm V100HK)
	3652	GAME( 2000, kov2106, kov2, kov2, kov2, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 106, 102, 100KH)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 02/27/01 13:26:46 V106 (Ext. Arm V102, Int. Arm V100HK)
	3653	GAME( 2000, kov2103, kov2, kov2, kov2, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 103, 101, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 12/28/00 15:09:31 V103 (Ext. Arm V101, Int. Arm V100HK)
	3654	GAME( 2000, kov2102, kov2, kov2, kov2, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 102, 101, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 12/14/00 10:33:36 V102 (Ext. Arm V101, Int. Arm V100HK)
	3655	GAME( 2000, kov2101, kov2, kov2, kov2, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 101, 101, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 11/29/00 11:03:08 V100 (Ext. Arm V100, Int. Arm V100HK)
	3656	GAME( 2000, kov2100, kov2, kov2, kov2, kov2, ROT0, "IGS", "Knights of Valour 2 / Sangoku Senki 2 (ver. 100, 100, 100HK)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 11/29/00 11:03:08 V100 (Ext. Arm V100, Int. Arm V100HK)
5897	3657
5898	3658	// region provided by internal ARM rom
5899		GAME( 2001, kov2p, pgm, kov2, sango, kov2p, ROT0, "IGS", "Knights of Valour 2 Plus - Nine Dragons / Sangoku Senki 2 Plus - Nine Dragons (ver. M204XX)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
5900		GAME( 2001, kov2p205, kov2p, kov2, sango, kov2p, ROT0, "IGS", "Knights of Valour 2 Plus - Nine Dragons / Sangoku Senki 2 Plus - Nine Dragons (ver. M205XX)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3659	GAME( 2001, kov2p, pgm, kov2, kov2, kov2p, ROT0, "IGS", "Knights of Valour 2 Plus - Nine Dragons / Sangoku Senki 2 Plus - Nine Dragons (ver. M204XX)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3660	GAME( 2001, kov2p205, kov2p, kov2, kov2, kov2p, ROT0, "IGS", "Knights of Valour 2 Plus - Nine Dragons / Sangoku Senki 2 Plus - Nine Dragons (ver. M205XX)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
5901	3661
5902	3662	// region provided by internal ARM rom
5903		GAME( 2001, martmast, pgm, kov2, sango, martmast, ROT0, "IGS", "Martial Masters (ver. 104, 102, 102US)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V104, Ext Arm 102, Int Arm 102US
5904		GAME( 2001, martmastc, martmast, kov2, sango, martmast, ROT0, "IGS", "Martial Masters (ver. 104, 102, 101CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V104, Ext Arm 102, Int Arm 101CN
5905		GAME( 2001, martmastc102, martmast, kov2, sango, martmast, ROT0, "IGS", "Martial Masters (ver. 102, 101, 101CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V102, Ext Arm 101, Int Arm 101CN
	3663	GAME( 2001, martmast, pgm, kov2, martmast, martmast, ROT0, "IGS", "Martial Masters (ver. 104, 102, 102US)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V104, Ext Arm 102, Int Arm 102US
	3664	GAME( 2001, martmastc, martmast, kov2, martmast, martmast, ROT0, "IGS", "Martial Masters (ver. 104, 102, 101CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V104, Ext Arm 102, Int Arm 101CN
	3665	GAME( 2001, martmastc102, martmast, kov2, martmast, martmast, ROT0, "IGS", "Martial Masters (ver. 102, 101, 101CN)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k V102, Ext Arm 101, Int Arm 101CN
5906	3666
5907	3667	// region provided by internal ARM rom
5908	3668	GAME( 2001, ddp2, pgm, kov2, ddp2, ddp2, ROT270, "IGS", "DoDonPachi II - Bee Storm (Japan, ver. 102)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE )
r14798	r14799
5911	3671
5912	3672	// we bypass the internal ARM rom on these, ideally it should still be dumped tho!
5913	3673	// ARM version strings don't match 100% with labels... for 68k ROMs I'm using the build time / date stamp from near the start of the rom, there are some slightly different time stamps later
5914		GAME( 2002, dmnfrnt, pgm, svg, sango, dmnfrnt, ROT0, "IGS", "Demon Front (68k label V105, ROM M105XX 08/05/02) (ARM label V105, ROM 08/05/02 S105XX)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k time: 10:24:11 ARM time: 10:33:23
5915		GAME( 2002, dmnfrnta, dmnfrnt, svg, sango, dmnfrnt, ROT0, "IGS", "Demon Front (68k label V102, ROM M102XX 06/19/02) (ARM label V102, ROM 05/24/02 S101XX)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k time: 13:44:08 ARM time: 13:04:31
5916		GAME( 2002, dmnfrntpcb, dmnfrnt, svg, sango, dmnfrnt, ROT0, "IGS", "Demon Front (68k label V107KR, ROM M107KR 11/03/03) (ARM label V107KR, ROM 10/16/03 S106KR) (JAMMA PCB)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) // works but reports version mismatch (wants internal rom version and region to match external?)
	3674	GAME( 2002, dmnfrnt, pgm, svg, pgm, dmnfrnt, ROT0, "IGS", "Demon Front (68k label V105, ROM M105XX 08/05/02) (ARM label V105, ROM 08/05/02 S105XX)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k time: 10:24:11 ARM time: 10:33:23
	3675	GAME( 2002, dmnfrnta, dmnfrnt, svg, pgm, dmnfrnt, ROT0, "IGS", "Demon Front (68k label V102, ROM M102XX 06/19/02) (ARM label V102, ROM 05/24/02 S101XX)", GAME_IMPERFECT_SOUND \| GAME_SUPPORTS_SAVE ) // 68k time: 13:44:08 ARM time: 13:04:31
	3676	GAME( 2002, dmnfrntpcb, dmnfrnt, svg, pgm, dmnfrnt, ROT0, "IGS", "Demon Front (68k label V107KR, ROM M107KR 11/03/03) (ARM label V107KR, ROM 10/16/03 S106KR) (JAMMA PCB)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) // works but reports version mismatch (wants internal rom version and region to match external?)
5917	3677
5918	3678
5919	3679
r14798	r14799
5972	3732
5973	3733	GAME( 1998, dwex, pgm, dw3, dw3, drgw3, ROT0, "IGS", "Dragon World 3 EX (ver. 100)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE )
5974	3734
5975		GAME( 1~~999~~, ~~puzlstar~~, pgm, kov~~_disabled_arm~~, ~~sango~~, ~~pstar~~, ROT0, "IGS", "~~Puzzle Sta~~r ~~(ve~~r. 100~~MG)~~", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* ~~need~~ ~~internal rom of IGS~~027A */
	3735	GAME( 2001, dw2001, pgm, kov2, dw2001, dw2001, ROT0, "IGS", "Dragon World 2001", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) // V0000 02/21/01 16:05:16
5976	3736
5977		GAME( ~~200~~1, p~~y2k2~~, pgm, kov_disabled_arm, phot~~oy2k~~, p~~y2k2~~, ROT0, "IGS", "Photo ~~Y2K~~ 2", GAME_NOT_WORKING ) /* need internal rom of IGS027A */
	3737	GAME( 1999, puzlstar, pgm, kov_simulated_arm, pstar, pstar, ROT0, "IGS", "Puzzle Star (ver. 100MG)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
5978	3738
5979		GAME( 2001, dw2~~001~~, pgm, kov2_disabled_arm, ~~sango~~, dw2~~001~~, ROT0, "IGS", "~~Drag~~o~~n W~~o~~rld~~ 2~~001~~", GAME_~~IMPERFECT_SOU~~N~~D \| GAME_UNEMULATED_PR~~OT~~ECTION \| GAME~~_~~NOT_~~WORKING ~~\| GAME_SUPPORTS_SAVE~~ ) // ~~V0000~~ 02~~/21/01~~ ~~16:05:16~~
	3739	GAME( 2001, py2k2, pgm, kov_simulated_arm, py2k2, py2k2, ROT0, "IGS", "Photo Y2K 2", GAME_NOT_WORKING ) /* need internal rom of IGS027A */
5980	3740
5981		GAME( 2001, puzzli2, pgm, ~~puzzli2~~_disabled_arm, ~~sango~~, puzzli2, ROT0, "IGS", "Puzzli 2 Super (ver. 200)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE )
	3741	GAME( 2001, puzzli2, pgm, kov_simulated_arm, puzzli2, puzzli2, ROT0, "IGS", "Puzzli 2 Super (ver. 200)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE )
5982	3742
5983	3743
5984	3744
r14798	r14799
5986	3746
5987	3747
5988	3748	// all 3 68k roms still have V100 strings, but are clearly different builds, there don't appear to be build string dates in them. Two of the external ARM roms are marked V100 but are different builds, it's possible the single PCB version 100 is based on a later main revision
5989		GAME( 2003, theglad, pgm, svg, sango, theglad, ROT0, "IGS", "The Gladiator - Road of the Sword / Shen Jian (M68k label V100) (ARM label V100, ROM 01/16/03 SHEN JIAN)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // ARM time: 10:39:25
5990		GAME( 2003, theglada, theglad, svg, sango, theglad, ROT0, "IGS", "The Gladiator - Road of the Sword / Shen Jian (M68k label V101) (ARM label V107, ROM 06/06/03 SHEN JIAN V107)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // ARM time: 16:17:27
5991		GAME( 2003, thegladpcb, theglad, svg, sango, theglad, ROT0, "IGS", "The Gladiator - Road of the Sword / Shen Jian (M68k label V100) (ARM label V100, ROM 02/25/03 SHEN JIAN) (JAMMA PCB)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // ARM time: 16:32:21
	3749	GAME( 2003, theglad, pgm, svg, pgm, theglad, ROT0, "IGS", "The Gladiator - Road of the Sword / Shen Jian (M68k label V100) (ARM label V100, ROM 01/16/03 SHEN JIAN)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // ARM time: 10:39:25
	3750	GAME( 2003, theglada, theglad, svg, pgm, theglad, ROT0, "IGS", "The Gladiator - Road of the Sword / Shen Jian (M68k label V101) (ARM label V107, ROM 06/06/03 SHEN JIAN V107)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // ARM time: 16:17:27
	3751	GAME( 2003, thegladpcb, theglad, svg, pgm, theglad, ROT0, "IGS", "The Gladiator - Road of the Sword / Shen Jian (M68k label V100) (ARM label V100, ROM 02/25/03 SHEN JIAN) (JAMMA PCB)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // ARM time: 16:32:21
5992	3752
5993	3753
5994	3754
5995		GAME( 2004, oldsplus, pgm, svg_disabled_arm, oldsplus, oldsplus, ROT0, "IGS", "Oriental Legend Special Plus / Xi You Shi E Zhuan Super Plus", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3755	GAME( 2004, oldsplus, pgm, kov_simulated_arm, oldsplus, oldsplus, ROT0, "IGS", "Oriental Legend Special Plus / Xi You Shi E Zhuan Super Plus", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
5996	3756
5997		GAME( 2004, kovshp, pgm, kov, ~~sang~~o, kovshp, ROT0, "IGS", "Knights of Valour Super Heroes Plus / Sangoku Senki Super Heroes Plus (ver. 100)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3757	GAME( 2004, kovshp, pgm, kov, kovsh, kovshp, ROT0, "IGS", "Knights of Valour Super Heroes Plus / Sangoku Senki Super Heroes Plus (ver. 100)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
5998	3758	// these bootlegs are clones of this instead
5999		GAME( 2004, kovlsqh, kovshp, kov, sango, kovlsqh2, ROT0, "bootleg", "Knights of Valour: Luan Shi Quan Huang / Sangoku Senki: Luan Shi Quan Huang (ver. 200CN)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
6000		GAME( 2004, kovlsqh2, kovshp, kov, sango, kovlsqh2, ROT0, "bootleg", "Knights of Valour: Luan Shi Quan Huang 2 / Sangoku Senki: Luan Shi Quan Huang 2 (ver. 200CN)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
6001		GAME( 2004, kovlsjb, kovshp, kov, sango, kovlsqh2, ROT0, "bootleg", "Knights of Valour: Luan Shi Jie Ba / Sangoku Senki: Luan Shi Jie Ba (ver. 200CN, set 1)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
6002		GAME( 2004, kovlsjba, kovshp, kov, sango, kovlsqh2, ROT0, "bootleg", "Knights of Valour: Luan Shi Jie Ba / Sangoku Senki: Luan Shi Jie Ba (ver. 200CN, set 2)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3759	GAME( 2004, kovlsqh, kovshp, kov, kovsh, kovlsqh2, ROT0, "bootleg", "Knights of Valour: Luan Shi Quan Huang / Sangoku Senki: Luan Shi Quan Huang (ver. 200CN)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3760	GAME( 2004, kovlsqh2, kovshp, kov, kovsh, kovlsqh2, ROT0, "bootleg", "Knights of Valour: Luan Shi Quan Huang 2 / Sangoku Senki: Luan Shi Quan Huang 2 (ver. 200CN)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3761	GAME( 2004, kovlsjb, kovshp, kov, kovsh, kovlsqh2, ROT0, "bootleg", "Knights of Valour: Luan Shi Jie Ba / Sangoku Senki: Luan Shi Jie Ba (ver. 200CN, set 1)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3762	GAME( 2004, kovlsjba, kovshp, kov, kovsh, kovlsqh2, ROT0, "bootleg", "Knights of Valour: Luan Shi Jie Ba / Sangoku Senki: Luan Shi Jie Ba (ver. 200CN, set 2)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
6003	3763
6004		GAME( 2005, killbldp, pgm, svg, ~~san~~go, killbldp, ROT0, "IGS", "The Killing Blade Plus (ver. 300)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3764	GAME( 2005, killbldp, pgm, svg, pgm, killbldp, ROT0, "IGS", "The Killing Blade Plus (ver. 300)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
6005	3765
6006		GAME( 2004, happy6, pgm, svg, ~~san~~go, happy6, ROT0, "IGS", "Happy 6-in-1 (ver. 101CN)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
	3766	GAME( 2004, happy6, pgm, svg, pgm, happy6, ROT0, "IGS", "Happy 6-in-1 (ver. 101CN)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */
6007	3767
6008		GAME( 2005, svg, pgm, svg, sango, svg, ROT0, "IGS / Idea Factory", "S.V.G. - Spectral vs Generation (M68k label V200) (ARM label V200, ROM 10/11/05 S.V.G V201)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // label was 200, but it's code rev 201? // ARM time: 10:07:20
6009		GAME( 2005, svgpcb, svg, svg, sango, svgpcb, ROT0, "IGS / Idea Factory", "S.V.G. - Spectral vs Generation (M68k label V100JP) (ARM label V100JP ROM 05/12/05 S.V.G V100) (JAMMA PCB)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // ARM time: 15:31:35
	3768	GAME( 2005, svg, pgm, svg, pgm, svg, ROT0, "IGS / Idea Factory", "S.V.G. - Spectral vs Generation (M68k label V200) (ARM label V200, ROM 10/11/05 S.V.G V201)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // label was 200, but it's code rev 201? // ARM time: 10:07:20
	3769	GAME( 2005, svgpcb, svg, svg, pgm, svgpcb, ROT0, "IGS / Idea Factory", "S.V.G. - Spectral vs Generation (M68k label V100JP) (ARM label V100JP ROM 05/12/05 S.V.G V100) (JAMMA PCB)", GAME_IMPERFECT_SOUND \| GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING \| GAME_SUPPORTS_SAVE ) /* need internal rom of IGS027A */ // ARM time: 15:31:35
6010	3770
6011	3771
6012	3772

src/mame/drivers/galaxia.c
r14798	r14799
113	113	{
114	114	// background vs. bullet collision detection
115	115	if (background) state->m_collision \|= 0x80;
116
	116
117	117	// bullet size/color/priority is guessed
118	118	bitmap.pix16(y, x) = 7;
119	119	if (x) bitmap.pix16(y, x-1) = 7;
120	120	}
121
	121
122	122	// copy the S2636 images into the main bitmap and check collision
123	123	int pixel0 = s2636_0_bitmap.pix16(y, x);
124	124	int pixel1 = s2636_1_bitmap.pix16(y, x);
125	125	int pixel2 = s2636_2_bitmap.pix16(y, x);
126
	126
127	127	int pixel = pixel0 \| pixel1 \| pixel2;
128
	128
129	129	if (S2636_IS_PIXEL_DRAWN(pixel))
130	130	{
131	131	// S2636 vs. S2636 collision detection
132	132	if (S2636_IS_PIXEL_DRAWN(pixel0) && S2636_IS_PIXEL_DRAWN(pixel1)) state->m_collision \|= 0x01;
133	133	if (S2636_IS_PIXEL_DRAWN(pixel1) && S2636_IS_PIXEL_DRAWN(pixel2)) state->m_collision \|= 0x02;
134	134	if (S2636_IS_PIXEL_DRAWN(pixel2) && S2636_IS_PIXEL_DRAWN(pixel0)) state->m_collision \|= 0x04;
135
	135
136	136	// S2636 vs. bullet collision detection
137	137	if (bullet) state->m_collision \|= 0x08;
138	138
r14798	r14799
140	140	if (background)
141	141	{
142	142	/* bit4 causes problems on 2nd level
143		if (S2636_IS_PIXEL_DRAWN(pixel0)) state->m_collision \|= 0x10; */
	143	if (S2636_IS_PIXEL_DRAWN(pixel0)) state->m_collision \|= 0x10; */
144	144	if (S2636_IS_PIXEL_DRAWN(pixel1)) state->m_collision \|= 0x20;
145	145	if (S2636_IS_PIXEL_DRAWN(pixel2)) state->m_collision \|= 0x40;
146	146	}
r14798	r14799
191	191	break;
192	192
193	193	int pixel = s2636_0_bitmap.pix16(y, x + s_offset);
194
	194
195	195	if (S2636_IS_PIXEL_DRAWN(pixel))
196	196	{
197	197	// S2636 vs. background collision detection
r14798	r14799
217	217	static WRITE8_HANDLER(galaxia_video_w)
218	218	{
219	219	galaxia_state *state = space->machine().driver_data<galaxia_state>();
220		// space->machine().primary_screen->update_partial(space->machine().primary_screen->vpos());
	220	// space->machine().primary_screen->update_partial(space->machine().primary_screen->vpos());
221	221	if (*state->m_fo_state)
222	222	state->m_video[offset] = data;
223	223	else

src/mame/drivers/cninja.c
r14798	r14799
1508	1508	ROM_LOAD( "joe mac 6.samples", 0x00000, 0x80000, CRC(dbecad83) SHA1(de34653606f12d2c606ff7d1cbce993521772884) ) // 1ST AND 2ND HALF IDENTICAL
1509	1509	ROM_END
1510	1510
1511		ROM_START( cninjabl2 )
	1511	ROM_START( cninjabl2 )
1512	1512	ROM_REGION( 0xc0000, "maincpu", 0 ) /* 68000 code */
1513	1513	ROM_LOAD16_BYTE( "6.bin", 0x00001, 0x40000, CRC(a86ccfb7) SHA1(c4ac331d5750a35cd48e5d75f0247758b892b034) )
1514	1514	ROM_LOAD16_BYTE( "4.bin", 0x00000, 0x40000, CRC(88c7043a) SHA1(9981d10f6c88556ceda083158d9835fdeb191511) )

src/mame/drivers/igs_m027.c
r14798	r14799
1		/* IGS ARM7 (IGS027A) based Mahjong / Gambling platform
	1	/* IGS ARM7 (IGS027A) based Mahjong / Gambling platform(s)
2	2	Driver by Xing Xing
3	3
4	4	These games use the IGS027A processor.
r14798	r14799
242	242	0x12,0x56,0x97,0x26,0x1D,0x5F,0xA7,0xF8,0x89,0x3F,0x14,0x36,0x72,0x3B,0x48,0x7B,
243	243	0xF1,0xED,0x72,0xB7,0x7A,0x56,0x05,0xDE,0x7B,0x27,0x6D,0xCF,0x33,0x4C,0x14,0x86,
244	244	};
245		static void sdwx_decrypt(running_machine &machine)
246		{
247	245
248		int i;
249		UINT16 src = (UINT16 ) machine.region("user1")->base();
250	246
251		int rom_size = 0x80000;
252	247
253		for(i=0; i<rom_size/2; i++) {
254		UINT16 x = src[i];
255
256		if((i & 0x00480) != 0x00080)
257		x ^= 0x0001;
258
259
260		if((i & 0x004008) == 0x004008)
261		x ^= 0x0002;
262
263
264		// if((i & 0x000030) == 0x000010)
265		// x ^= 0x0004;
266
267		if((i & 0x000242) != 0x000042)
268		x ^= 0x0008;
269
270		if((i & 0x08100) == 0x08000)
271		x ^= 0x0010;
272
273		if((i & 0x022004) != 0x000004)
274		x ^= 0x0020;
275
276		if((i & 0x11800) != 0x10000)
277		x ^= 0x0040;
278
279		if((i & 0x004820) == 0x004820)
280		x ^= 0x0080;
281
282		x ^= sdwx_tab[(i >> 1) & 0xff] << 8;
283
284		src[i] = x;
285		}
286		}
287
288
289
290	248	static void sdwx_gfx_decrypt(running_machine &machine)
291	249	{
292	250	int i;
r14798	r14799
416	374
417	375
418	376
419		static DRIVER_INIT( sdwx )
420		{
421		sdwx_decrypt(machine);
422		sdwx_gfx_decrypt(machine);
423		logerror("init OK!\n");
424		}
425	377
426
427
428	378	/***************************************************************************
429	379
430	380	ROMs Loading
r14798	r14799
690	640	ROM_REGION( 0x400000, "gfx2", 0 )
691	641	ROM_LOAD( "gfii_cg.u17", 0x000000, 0x200000, CRC(2568359c) SHA1(f1f240246e53496bf624c84f7cae3edb9675579f) )
692	642
693		ROM_REGION( 0x200000, "~~unkn~~own", 0 )
	643	ROM_REGION( 0x200000, "oki", 0 )
694	644	ROM_LOAD( "gfii_sp.u13", 0x00000, 0x080000, CRC(61da1d58) SHA1(0a79578f0daf15f0efe2b0eeac59a60d8372a644) )
695	645	ROM_END
696	646
r14798	r14799
760	710	ROM_START( chessc2 )
761	711	ROM_REGION( 0x04000, "maincpu", 0 )
762	712	/* Internal rom of IGS027A ARM based MCU */
763		ROM_LOAD( "~~gon~~efsh2_igs027a", 0x00000, 0x4000, NO_DUMP )
	713	ROM_LOAD( "chessc2_igs027a", 0x00000, 0x4000, NO_DUMP )
764	714
765	715	ROM_REGION( 0x80000, "user1", 0 ) // external ARM data / prg
766	716	ROM_LOAD( "ccii_v-707uso.u12", 0x000000, 0x80000, CRC(5937b67b) SHA1(967b3adf6f5bf92d63ec460d595e473898a78372) )
r14798	r14799
771	721	ROM_REGION( 0x400000, "gfx2", 0 )
772	722	ROM_LOAD( "ccii_cg.u17", 0x000000, 0x200000, CRC(47e45157) SHA1(4459799a4a6c30a2d0a3ad9ac54e92b62221e10b) )
773	723
774		ROM_REGION( 0x200000, "~~unkn~~own", 0 )
	724	ROM_REGION( 0x200000, "oki", 0 )
775	725	ROM_LOAD( "ccii_sp.u13", 0x00000, 0x080000, CRC(220a7b71) SHA1(7dab7baa97c20b83763cf46ef0a6e5e8c4d6a348) )
776	726	ROM_END
777	727
778	728
779	729
	730
	731
	732	ROM_START( haunthig )
	733	ROM_REGION( 0x04000, "maincpu", 0 )
	734	/* Internal rom of IGS027A ARM based MCU */
	735	ROM_LOAD( "haunthig_igs027a", 0x00000, 0x4000, NO_DUMP )
	736
	737	ROM_REGION( 0x80000, "user1", 0 ) // external ARM data / prg
	738	ROM_LOAD( "hauntedhouse_ver-101us.u34", 0x000000, 0x80000, CRC(4bf045d4) SHA1(78c848fd69961df8d9b75f92ad57c3534fbf08db) )
	739
	740	ROM_REGION( 0x80000, "gfx1", 0 )
	741	ROM_LOAD( "haunted-h_text.u15", 0x000000, 0x80000, CRC(c23f48c8) SHA1(0cb1b6c61611a081ae4a3c0be51812045ff632fe) )
	742
	743	// are these PGM-like sprites?
	744	ROM_REGION( 0x400000, "gfx2", 0 )
	745	ROM_LOAD( "haunted-h_cg.u32", 0x000000, 0x400000, CRC(e0ea10e6) SHA1(e81be78fea93e72d4b1f4c0b58560bda46cf7948) )
	746	ROM_REGION( 0x400000, "gfx3", 0 )
	747	ROM_LOAD( "haunted-h_ext.u12", 0x000000, 0x400000, CRC(662eb883) SHA1(831ebe29e1e7a8b2c2fff7fbc608975771c3486c) )
	748
	749
	750	ROM_REGION( 0x200000, "oki", 0 )
	751	ROM_LOAD( "haunted-h_sp.u3", 0x00000, 0x200000, CRC(fe3fcddf) SHA1(ac57ab6d4e4883747c093bd19d0025cf6588cb2c) )
	752	ROM_END
	753
	754	static void pgm_create_dummy_internal_arm_region(running_machine &machine)
	755	{
	756	UINT16 temp16 = (UINT16 )machine.region("maincpu")->base();
	757
	758	// fill with RX 14
	759	int i;
	760	for (i=0;i<0x4000/2;i+=2)
	761	{
	762	temp16[i] = 0xff1e;
	763	temp16[i+1] = 0xe12f;
	764
	765	}
	766
	767	// jump straight to external area
	768	temp16[(0x0000)/2] = 0xd088;
	769	temp16[(0x0002)/2] = 0xe59f;
	770	temp16[(0x0004)/2] = 0x0680;
	771	temp16[(0x0006)/2] = 0xe3a0;
	772	temp16[(0x0008)/2] = 0xff10;
	773	temp16[(0x000a)/2] = 0xe12f;
	774	temp16[(0x0090)/2] = 0x0400;
	775	temp16[(0x0092)/2] = 0x1000;
	776	}
	777
	778
	779	static void sdwx_decrypt(running_machine &machine)
	780	{
	781
	782	int i;
	783	UINT16 src = (UINT16 ) machine.region("user1")->base();
	784
	785	int rom_size = 0x80000;
	786
	787	for(i=0; i<rom_size/2; i++)
	788	{
	789	UINT16 x = src[i];
	790
	791	if((i & 0x000480) != 0x000080) x ^= 0x0001;
	792	if((i & 0x004008) == 0x004008) x ^= 0x0002;
	793	if((i & 0x000030) == 0x000010) x ^= 0x0004;
	794	if((i & 0x000242) != 0x000042) x ^= 0x0008;
	795	if((i & 0x008100) == 0x008000) x ^= 0x0010;
	796	if((i & 0x022004) != 0x000004) x ^= 0x0020;
	797	if((i & 0x011800) != 0x010000) x ^= 0x0040;
	798	if((i & 0x004820) == 0x004820) x ^= 0x0080;
	799
	800	x ^= sdwx_tab[(i >> 1) & 0xff] << 8;
	801
	802	src[i] = x;
	803	}
	804	}
	805
	806
	807	static const UINT8 hauntedh_tab[0x100] = {
	808	0x49, 0x47, 0x53, 0x30, 0x32, 0x35, 0x34, 0x52, 0x44, 0x34, 0x30, 0x36, 0x30, 0x35, 0x32, 0x36,
	809	0x6C, 0x65, 0x33, 0xFD, 0x7A, 0x71, 0x3D, 0xB8, 0x07, 0xF1, 0x86, 0x96, 0x19, 0x5A, 0xA2, 0x05,
	810	0x49, 0xB1, 0xED, 0x2E, 0x7C, 0x7A, 0x65, 0x8B, 0xE1, 0xE3, 0xC8, 0xAA, 0x2B, 0x32, 0xEE, 0x3F,
	811	0x10, 0x6C, 0x69, 0x70, 0x02, 0x47, 0x5B, 0x5D, 0x2D, 0x52, 0x97, 0xEF, 0xB1, 0x63, 0xFB, 0xE3,
	812	0x21, 0x41, 0x0C, 0x17, 0x3C, 0x93, 0xD4, 0x13, 0xEB, 0x08, 0xF9, 0xDB, 0x7A, 0xC8, 0x1E, 0xF4,
	813	0x1B, 0x1B, 0x7F, 0xB4, 0x98, 0x59, 0xC8, 0xCF, 0x58, 0x12, 0x36, 0x1F, 0x96, 0x7D, 0xF0, 0xB3,
	814	0xDC, 0x26, 0xA8, 0x1C, 0xC6, 0xD4, 0x6E, 0xF3, 0xF5, 0xB9, 0xD4, 0xAF, 0x52, 0xDD, 0x48, 0xA5,
	815	0x85, 0xCC, 0xAD, 0x60, 0xB4, 0x7F, 0x3C, 0x24, 0x80, 0x88, 0x9B, 0xBD, 0x3E, 0x82, 0x3B, 0x8D,
	816	0x73, 0xB8, 0xF7, 0xD5, 0x92, 0x15, 0xeb, 0x43, 0xF9, 0x4C, 0x91, 0xBD, 0x29, 0x48, 0x22, 0x6D,
	817	0x45, 0xD6, 0x2C, 0x0D, 0xCE, 0x91, 0x70, 0x74, 0x9D, 0x0E, 0xFE, 0x62, 0x22, 0x49, 0x94, 0x88,
	818	0xDB, 0x50, 0x33, 0xDB, 0x18, 0x2E, 0x03, 0x1B, 0xED, 0x1A, 0x69, 0x9E, 0x78, 0xE1, 0x66, 0x62,
	819	0x54, 0x91, 0x33, 0x52, 0x5E, 0x67, 0x1B, 0xD9, 0xA7, 0xFB, 0x98, 0xA5, 0xBA, 0xAA, 0xB1, 0xBD,
	820	0x0F, 0x44, 0x93, 0xC6, 0xCF, 0xF7, 0x6F, 0x91, 0xCA, 0x7B, 0x93, 0xEA, 0xB6, 0x7F, 0xCC, 0x9C,
	821	0xAB, 0x54, 0xFB, 0xC8, 0xDB, 0xD9, 0xF5, 0x68, 0x96, 0xA7, 0xA1, 0x1F, 0x7D, 0x7D, 0x4C, 0x43,
	822	0x06, 0xED, 0x50, 0x2D, 0x30, 0x48, 0xE6, 0xC0, 0x88, 0xC8, 0x48, 0x38, 0x5D, 0xFC, 0x0a, 0x35,
	823	0x3F, 0x79, 0xBA, 0x07, 0xBE, 0xBF, 0xB7, 0x3B, 0x61, 0x69, 0x4F, 0x67, 0xE5, 0x9A, 0x1D, 0x33
	824	};
	825
	826	static void hauntedh_decrypt(running_machine &machine)
	827	{
	828	int i;
	829	UINT16 src = (UINT16 ) machine.region("user1")->base();
	830
	831	int rom_size = 0x080000;
	832
	833	for(i=0; i<rom_size/2; i++) {
	834	UINT16 x = src[i];
	835
	836	if ((i & 0x040480) != 0x000080) x ^= 0x0001;
	837	// if ((i & 0x104008) == 0x104008) x ^= 0x0002;
	838	// if ((i & 0x080030) == 0x080010) x ^= 0x0004;
	839	if ((i & 0x000042) != 0x000042) x ^= 0x0008;
	840	// if ((i & 0x048100) == 0x048000) x ^= 0x0010;
	841	if ((i & 0x002004) != 0x000004) x ^= 0x0020;
	842	if ((i & 0x001800) != 0x000000) x ^= 0x0040;
	843	if ((i & 0x004820) == 0x004820) x ^= 0x0080;
	844
	845	x ^= hauntedh_tab[(i>> 1) & 0xff] << 8;
	846
	847	src[i] = x;
	848	}
	849	}
	850
	851
	852	static const UINT8 chessc2_tab[0x100] = {
	853	0x49, 0x47, 0x53, 0x30, 0x30, 0x38, 0x32, 0x52, 0x44, 0x34, 0x30, 0x32, 0x31, 0x32, 0x31, 0x31,
	854	0x28, 0xCA, 0x9C, 0xAD, 0xBB, 0x2D, 0xF0, 0x41, 0x6E, 0xCE, 0xAD, 0x73, 0xAE, 0x1C, 0xD1, 0x14,
	855	0x6F, 0x9A, 0x75, 0x18, 0xA8, 0x91, 0x68, 0xe4, 0x09, 0xF4, 0x0F, 0xD7, 0xFF, 0x93, 0x7D, 0x1B,
	856	0xEB, 0x84, 0xce, 0xAD, 0x9E, 0xCF, 0xC9, 0xAB, 0x18, 0x59, 0xb6, 0xde, 0x82, 0x13, 0x7C, 0x88,
	857	0x69, 0x63, 0xFF, 0x6F, 0x3C, 0xD2, 0xB9, 0x29, 0x09, 0xF8, 0x97, 0xAA, 0x74, 0xA5, 0x16, 0x0D,
	858	0xF9, 0x51, 0x9E, 0x9f, 0x63, 0xC6, 0x1E, 0x32, 0x8C, 0x0C, 0xE9, 0xA0, 0x56, 0x95, 0xD1, 0x9D,
	859	0xEA, 0xA9, 0x82, 0xC3, 0x30, 0x15, 0x21, 0xD8, 0x8F, 0x10, 0x25, 0x61, 0xE6, 0x6D, 0x75, 0x6D,
	860	0xCB, 0x08, 0xC3, 0x9B, 0x03, 0x6A, 0x28, 0x6D, 0x42, 0xBF, 0x00, 0xd2, 0x24, 0xFA, 0x08, 0xEE,
	861	0x6B, 0x46, 0xB7, 0x2C, 0x7B, 0xB0, 0xDA, 0x86, 0x13, 0x14, 0x73, 0x14, 0x4D, 0x45, 0xD3, 0xD4,
	862	0xD9, 0x80, 0xF5, 0xB8, 0x76, 0x13, 0x1E, 0xF6, 0xB1, 0x4A, 0xB3, 0x8B, 0xE2, 0x9A, 0x5A, 0x11,
	863	0x64, 0x11, 0x55, 0xC3, 0x14, 0xFD, 0x1B, 0xCe, 0x0C, 0xDC, 0x38, 0xDA, 0xA1, 0x84, 0x66, 0xD9,
	864	0x9b, 0x93, 0xED, 0x0F, 0xB4, 0x19, 0x38, 0x62, 0x53, 0x85, 0xB9, 0xE5, 0x89, 0xCd, 0xFE, 0x9E,
	865	0x4D, 0xE2, 0x14, 0x9F, 0xF4, 0x53, 0x1C, 0x46, 0xf4, 0x40, 0x2C, 0xCC, 0xDa, 0x82, 0x69, 0x15,
	866	0x88, 0x18, 0x62, 0xB7, 0xB4, 0xD5, 0xAF, 0x4B, 0x9E, 0x48, 0xCA, 0xF4, 0x11, 0xEC, 0x2D, 0x2C,
	867	0x9D, 0x91, 0xAD, 0xDA, 0x13, 0x0A, 0x16, 0x86, 0x41, 0x18, 0x08, 0x01, 0xef, 0x97, 0x11, 0x1f,
	868	0x1A, 0xE7, 0x0C, 0xC9, 0x6D, 0x9D, 0xB9, 0x49, 0x0B, 0x6B, 0x9E, 0xD4, 0x72, 0x4D, 0x1D, 0x59
	869	};
	870
	871	static void chessc2_decrypt(running_machine &machine)
	872	{
	873	int i;
	874	UINT16 src = (UINT16 ) machine.region("user1")->base();
	875
	876	int rom_size = 0x80000;
	877
	878	for(i=0; i<rom_size/2; i++) {
	879	UINT16 x = src[i];
	880
	881	if ((i & 0x040480) != 0x000080) x ^= 0x0001;
	882	if ((i & 0x004008) == 0x004008) x ^= 0x0002;
	883	// if ((i & 0x080030) == 0x080010) x ^= 0x0004;
	884	if ((i & 0x000242) != 0x000042) x ^= 0x0008;
	885	if ((i & 0x008100) == 0x008000) x ^= 0x0010;
	886	if ((i & 0x002004) != 0x000004) x ^= 0x0020; // correct??
	887	if ((i & 0x011800) != 0x010000) x ^= 0x0040;
	888	if ((i & 0x004820) == 0x004820) x ^= 0x0080;
	889
	890	x ^= chessc2_tab[(i>> 1) & 0xff] << 8;
	891
	892	src[i] = x;
	893	}
	894	}
	895
	896
	897	static const UINT8 klxyj_tab[0x100] = {
	898	0x49, 0x47, 0x53, 0x30, 0x30, 0x30, 0x38, 0x52, 0x44, 0x34, 0x30, 0x31, 0x30, 0x39, 0x32, 0x34,
	899	0x3F, 0x0F, 0x66, 0x9A, 0xBF, 0x0D, 0x06, 0x55, 0x09, 0x01, 0xEB, 0x72, 0xEB, 0x9B, 0x89, 0xFA,
	900	0x24, 0xD1, 0x5D, 0xCA, 0xE6, 0x8A, 0x8C, 0xE0, 0x92, 0x8D, 0xBF, 0xE4, 0xAF, 0xAA, 0x3E, 0xFA,
	901	0x2B, 0x27, 0x4B, 0xC7, 0xD6, 0x6D, 0xC1, 0xC2, 0x1C, 0xF4, 0xED, 0xBD, 0x03, 0x6C, 0xAD, 0xB3,
	902	0x65, 0x2D, 0xC7, 0xD3, 0x6E, 0xE0, 0x8C, 0xCE, 0x59, 0x6F, 0xAE, 0x5E, 0x66, 0x2B, 0x5E, 0x17,
	903	0x20, 0x3D, 0xA9, 0x72, 0xCD, 0x4F, 0x14, 0x17, 0x35, 0x7B, 0x77, 0x6B, 0x98, 0x73, 0x17, 0x5A,
	904	0xEA, 0xF2, 0x07, 0x66, 0x51, 0x64, 0xC1, 0xF0, 0xE2, 0xD1, 0x00, 0xC6, 0x97, 0x0F, 0xE0, 0xEE,
	905	0x94, 0x28, 0x39, 0xB2, 0x9B, 0x0A, 0x38, 0xED, 0xCC, 0x6E, 0x40, 0x94, 0xA2, 0x0A, 0x00, 0x88,
	906	0x2B, 0xFA, 0xD5, 0x9A, 0x87, 0x6C, 0x62, 0xDF, 0xA4, 0x8B, 0x6D, 0x37, 0x38, 0xAE, 0xFD, 0x18,
	907	0xFF, 0xC2, 0xB2, 0xA0, 0x37, 0xF5, 0x64, 0xDB, 0x59, 0xA5, 0x00, 0x51, 0x19, 0x88, 0x9F, 0xD4,
	908	0xA0, 0x1C, 0xE7, 0x88, 0x08, 0x51, 0xA7, 0x33, 0x19, 0x75, 0xAE, 0xC7, 0x42, 0x61, 0xEC, 0x2D,
	909	0xDB, 0xE2, 0xCC, 0x54, 0x9A, 0x6A, 0xD1, 0x7A, 0x53, 0xF8, 0x6F, 0xBA, 0xF4, 0x45, 0x2C, 0xD7,
	910	0xC0, 0x30, 0xF7, 0x47, 0xCC, 0x6B, 0xC8, 0x83, 0xB7, 0x67, 0x7A, 0x8E, 0xAD, 0x7E, 0xE5, 0xC4,
	911	0x9F, 0x60, 0x40, 0xE5, 0xBC, 0xC0, 0xB5, 0x61, 0x33, 0x3F, 0x46, 0xE6, 0x2D, 0x98, 0xDF, 0x28,
	912	0x05, 0x0E, 0xBC, 0xF0, 0xCA, 0x13, 0xFE, 0x68, 0xF7, 0x3A, 0x89, 0xA5, 0x71, 0x5F, 0x21, 0x76,
	913	0xC2, 0x14, 0xC5, 0x6C, 0x95, 0x4f, 0x4f, 0x2A, 0x71, 0x52, 0x3C, 0xEE, 0xAA, 0xDB, 0xf1, 0x00
	914	};
	915
	916	static void klxyj_decrypt(running_machine &machine)
	917	{
	918	int i;
	919	UINT16 src = (UINT16 ) machine.region("user1")->base();
	920
	921	int rom_size = 0x80000;
	922
	923	for(i=0; i<rom_size/2; i++) {
	924	UINT16 x = src[i];
	925
	926	if ((i & 0x040480) != 0x000080) x ^= 0x0001;
	927	if ((i & 0x004008) == 0x004008) x ^= 0x0002;
	928	// if ((i & 0x080030) == 0x080010) x ^= 0x0004;
	929	if ((i & 0x000242) != 0x000042) x ^= 0x0008;
	930	if ((i & 0x008100) == 0x008000) x ^= 0x0010;
	931	if ((i & 0x002004) != 0x000004) x ^= 0x0020;
	932	if ((i & 0x011800) != 0x010000) x ^= 0x0040;
	933	if ((i & 0x004820) == 0x004820) x ^= 0x0080;
	934
	935	x ^= klxyj_tab[(i>> 1) & 0xff] << 8;
	936
	937	src[i] = x;
	938	}
	939	}
	940
	941	static DRIVER_INIT( igs_m027 )
	942	{
	943	pgm_create_dummy_internal_arm_region(machine);
	944	}
	945
	946	static DRIVER_INIT( sdwx )
	947	{
	948	sdwx_decrypt(machine);
	949	sdwx_gfx_decrypt(machine);
	950	pgm_create_dummy_internal_arm_region(machine);
	951	}
	952
	953	static DRIVER_INIT( klxyj )
	954	{
	955	klxyj_decrypt(machine);
	956	//sdwx_gfx_decrypt(machine);
	957	pgm_create_dummy_internal_arm_region(machine);
	958	}
	959
	960	static DRIVER_INIT( chessc2 )
	961	{
	962	chessc2_decrypt(machine);
	963	//sdwx_gfx_decrypt(machine);
	964	pgm_create_dummy_internal_arm_region(machine);
	965	}
	966
	967	static DRIVER_INIT( hauntedh )
	968	{
	969	hauntedh_decrypt(machine);
	970	//sdwx_gfx_decrypt(machine);
	971	pgm_create_dummy_internal_arm_region(machine);
	972	}
	973
	974
780	975	/***************************************************************************
781	976
782	977	Game Drivers
783	978
784	979	***************************************************************************/
785	980
786		GAME( 2002, sdwx, 0, igs_majhong, sdwx, sdwx, ROT0, "IGS", "Sheng Dan Wu Xian", GAME_NO_SOUND \| GAME_NOT_WORKING ) // aka Christmas 5 Line?
787		GAME( 200?, sddz, 0, igs_majhong, sdwx, 0, ROT0, "IGS", "Super Dou Di Zhu", GAME_NO_SOUND \| GAME_NOT_WORKING )
788		GAME( 2000, bigd2, 0, igs_majhong, sdwx, 0, ROT0, "IGS", "Big D2", GAME_NO_SOUND \| GAME_NOT_WORKING )
789		GAME( 200?, lhzb3, 0, igs_majhong, sdwx, 0, ROT0, "IGS", "Long Hu Zheng Ba 3", GAME_NO_SOUND \| GAME_NOT_WORKING )
790		GAME( 200?, lhzb4, 0, igs_majhong, sdwx, 0, ROT0, "IGS", "Long Hu Zheng Ba 4", GAME_NO_SOUND \| GAME_NOT_WORKING )
791		GAME( 200?, klxyj, 0, igs_majhong, sdwx, 0, ROT0, "IGS", "Kuai Le Xi You Ji", GAME_NO_SOUND \| GAME_NOT_WORKING )
792		GAME( 2000, mgfx, 0, igs_majhong, sdwx, 0, ROT0, "IGS", "Man Guan Fu Xing", GAME_NO_SOUND \| GAME_NOT_WORKING )
793		GAME( 200?, gonefsh2, 0, igs_majhong, sdwx, 0, ROT0, "IGS", "Gone Fishing 2", GAME_NO_SOUND \| GAME_NOT_WORKING )
794		GAME( 200?, chessc2, 0, igs_majhong, sdwx, 0, ROT0, "IGS", "Chess Challenge 2", GAME_NO_SOUND \| GAME_NOT_WORKING )
	981	GAME( 2002, sdwx, 0, igs_majhong, sdwx, sdwx, ROT0, "IGS", "Sheng Dan Wu Xian", GAME_NO_SOUND \| GAME_NOT_WORKING ) // aka Christmas 5 Line?
	982	GAME( 200?, sddz, 0, igs_majhong, sdwx, igs_m027, ROT0, "IGS", "Super Dou Di Zhu", GAME_NO_SOUND \| GAME_NOT_WORKING )
	983	GAME( 2000, bigd2, 0, igs_majhong, sdwx, igs_m027, ROT0, "IGS", "Big D2", GAME_NO_SOUND \| GAME_NOT_WORKING )
	984	GAME( 200?, lhzb3, 0, igs_majhong, sdwx, igs_m027, ROT0, "IGS", "Long Hu Zheng Ba 3", GAME_NO_SOUND \| GAME_NOT_WORKING )
	985	GAME( 200?, lhzb4, 0, igs_majhong, sdwx, igs_m027, ROT0, "IGS", "Long Hu Zheng Ba 4", GAME_NO_SOUND \| GAME_NOT_WORKING )
	986	GAME( 200?, klxyj, 0, igs_majhong, sdwx, klxyj, ROT0, "IGS", "Kuai Le Xi You Ji", GAME_NO_SOUND \| GAME_NOT_WORKING )
	987	GAME( 2000, mgfx, 0, igs_majhong, sdwx, igs_m027, ROT0, "IGS", "Man Guan Fu Xing", GAME_NO_SOUND \| GAME_NOT_WORKING )
	988	GAME( 200?, gonefsh2, 0, igs_majhong, sdwx, igs_m027, ROT0, "IGS", "Gone Fishing 2", GAME_NO_SOUND \| GAME_NOT_WORKING )
	989	GAME( 200?, chessc2, 0, igs_majhong, sdwx, chessc2, ROT0, "IGS", "Chess Challenge 2", GAME_NO_SOUND \| GAME_NOT_WORKING )
	990	GAME( 200?, haunthig, 0, igs_majhong, sdwx, hauntedh, ROT0, "IGS", "Haunted House (IGS)", GAME_NO_SOUND \| GAME_NOT_WORKING )

src/mame/drivers/goldnpkr.c
r14798	r14799
317	317
318	318
319	319	* Casino Poker
320
	320
321	321	Bipolar PROM 24sa10 is filled with 0x09, so has at least
322	322	fixed bits 0 and 3 along the whole data. Needs a redump using a supported
323	323	EEPROM programmer.
r14798	r14799
838	838	- Added Casino Poker (Ver PM86LO-35-5, German).
839	839	- Inputs from the scratch.
840	840	- Switched manufacturer 'Playman' to PM / Beck Elektronik, since
841		it's PM and Beck Elektronik/Computer/etc...
	841	it's PM and Beck Elektronik/Computer/etc...
842	842	- Added technical and game notes.
843	843
844	844
r14798	r14799
897	897	- Added Wild Witch (Export, 6T/12T ver 1.84A).
898	898	- Worked each game to temporarily bypass the protection,
899	899	laying in the Dallas Timekeeper RAM.
900		- Reworked the parent/clones relationship.
	900	- Reworked the parent/clones relationship.
901	901	- Added technical notes.
902	902
903	903
r14798	r14799
1308	1308	coin_counter_w(device->machine(), 1, data & 0x80); /* counter2 */
1309	1309	coin_counter_w(device->machine(), 2, data & 0x20); /* counter3 */
1310	1310
1311		// popmessage("written : %02X", (0xff - data));
	1311	// popmessage("written : %02X", (0xff - data));
1312	1312
1313	1313	/* Counters:
1314	1314
r14798	r14799
2604	2604	PORT_BIT( 0x80, IP_ACTIVE_LOW, IPT_UNKNOWN )
2605	2605
2606	2606	PORT_START("IN0-1")
2607		// PORT_BIT( 0x01, IP_ACTIVE_LOW, IPT_UNKNOWN )
	2607	// PORT_BIT( 0x01, IP_ACTIVE_LOW, IPT_UNKNOWN )
2608	2608	PORT_BIT( 0x01, IP_ACTIVE_LOW, IPT_OTHER ) PORT_CODE(KEYCODE_1_PAD) PORT_NAME("IN1-1")
2609	2609	PORT_BIT( 0x02, IP_ACTIVE_LOW, IPT_GAMBLE_KEYOUT ) PORT_NAME("Payout") PORT_CODE(KEYCODE_W)
2610	2610	PORT_BIT( 0x04, IP_ACTIVE_LOW, IPT_GAMBLE_TAKE ) PORT_NAME("Take")
r14798	r14799
2626	2626
2627	2627	PORT_START("IN0-3")
2628	2628	PORT_BIT( 0x01, IP_ACTIVE_LOW, IPT_SERVICE ) PORT_NAME("Service") PORT_CODE(KEYCODE_F2)
2629		// PORT_BIT( 0x02, IP_ACTIVE_LOW, IPT_UNKNOWN )
	2629	// PORT_BIT( 0x02, IP_ACTIVE_LOW, IPT_UNKNOWN )
2630	2630	PORT_BIT( 0x02, IP_ACTIVE_LOW, IPT_OTHER ) PORT_CODE(KEYCODE_2_PAD) PORT_NAME("IN3-2")
2631	2631	PORT_BIT( 0x04, IP_ACTIVE_LOW, IPT_COIN2 ) PORT_NAME("Note In")
2632	2632	PORT_BIT( 0x08, IP_ACTIVE_LOW, IPT_COIN1 ) PORT_IMPULSE(3) PORT_NAME("Coin In")
r14798	r14799
8097	8097	Witch Strike (Export, 6T/12T ver 1.01A)
8098	8098	Witch Strike (Export, 6T/12T ver 1.01B)
8099	8099
8100		1992, Video Klein. Prototypes??
	8100	1992, Video Klein. Prototypes??
8101	8101
8102	8102	*********************************************/
8103	8103
r14798	r14799
8288	8288
8289	8289
8290	8290	/*********************************************
8291
	8291
8292	8292	Witch Jack
8293	8293	1992-1996 Video Klein
8294	8294
r14798	r14799
8668	8668
8669	8669	ROM_START( wtchjackd ) /* Witch Jack 0.62 / 1995-08-02 */
8670	8670	ROM_REGION( 0x10000, "maincpu", 0 )
8671		ROM_LOAD( "wj5x563.bin", 0x8000, 0x8000, CRC(55e74382) SHA1(af0a890c55db36e8a2f847ea103858cc7b7115be) ) //
	8671	ROM_LOAD( "wj5x563.bin", 0x8000, 0x8000, CRC(55e74382) SHA1(af0a890c55db36e8a2f847ea103858cc7b7115be) ) //
8672	8672
8673	8673	ROM_REGION( 0x18000, "temp", 0 )
8674	8674	ROM_LOAD( "wj5x5_1zs.bin", 0x00000, 0x8000, BAD_DUMP CRC(a780ba7f) SHA1(dde75187df298392333cfe1a19beed5b9d172aad) )
r14798	r14799
9692	9692
9693	9693	and then...
9694	9694
9695		F2D4: 48 pha
9696		F2D5: 8A txa
9697		F2D6: 48 pha
	9695	F2D4: 48 pha
	9696	F2D5: 8A txa
	9697	F2D6: 48 pha
9698	9698	F2D7: A2 00 ldx #$00
9699	9699	F2D9: BD EE F2 lda $F2EE,x ; read a char.
9700	9700	F2DC: F0 08 beq $F2E6 ; if 0 (end of string), branch to end.
r14798	r14799
9703	9703	F2E3: E8 inx ; increment X-register.
9704	9704	F2E4: D0 F3 bne $F2D9 ; loop to read the next char....
9705	9705	F2E6: 68 pla ; end.
9706		F2E7: AA tax
9707		F2E8: 68 pla
9708		F2E9: 60 rts
	9706	F2E7: AA tax
	9707	F2E8: 68 pla
	9708	F2E9: 60 rts
9709	9709
9710	9710	F2EA: 02 kil $02 ; kill.
9711	9711	F2EB: 4C EA F2 jmp $F2EA ; just in case the 1st time fails, go to kill again.

src/mame/drivers/sderby.c
r14798	r14799
292	292	AM_RANGE(0xffc000, 0xffffff) AM_RAM
293	293	ADDRESS_MAP_END
294	294
	295
	296	static ADDRESS_MAP_START( luckboom_map, AS_PROGRAM, 16 )
	297	AM_RANGE(0x000000, 0x07ffff) AM_ROM
	298	AM_RANGE(0x100000, 0x100fff) AM_RAM_WRITE(sderby_videoram_w) AM_BASE_MEMBER(sderby_state,m_videoram) /* bg */
	299	AM_RANGE(0x101000, 0x101fff) AM_RAM_WRITE(sderby_md_videoram_w) AM_BASE_MEMBER(sderby_state,m_md_videoram) /* mid */
	300	AM_RANGE(0x102000, 0x103fff) AM_RAM_WRITE(sderby_fg_videoram_w) AM_BASE_MEMBER(sderby_state,m_fg_videoram) /* fg */
	301	AM_RANGE(0x104000, 0x10400b) AM_WRITE(sderby_scroll_w)
	302	AM_RANGE(0x10400c, 0x10400d) AM_WRITENOP /* ??? - check code at 0x000456 (executed once at startup) */
	303	AM_RANGE(0x10400e, 0x10400f) AM_WRITENOP /* ??? - check code at 0x000524 (executed once at startup) */
	304	AM_RANGE(0x200000, 0x200fff) AM_RAM AM_BASE_MEMBER(sderby_state,m_spriteram) AM_SIZE_MEMBER(sderby_state,m_spriteram_size)
	305	AM_RANGE(0x308000, 0x30800d) AM_READ(sderby_input_r)
	306	AM_RANGE(0x308008, 0x308009) AM_WRITE(sderby_out_w) /* output port */
	307	AM_RANGE(0x30800e, 0x30800f) AM_DEVREADWRITE8_MODERN("oki", okim6295_device, read, write, 0x00ff)
	308	AM_RANGE(0x380000, 0x380fff) AM_WRITE(paletteram16_RRRRRGGGGGBBBBBx_word_w) AM_BASE_GENERIC(paletteram)
	309	AM_RANGE(0x500000, 0x500001) AM_WRITENOP /* unknown... write 0x01 in game, and 0x00 on reset */
	310	AM_RANGE(0xe00000, 0xe007ff) AM_RAM AM_SHARE("nvram")
	311	AM_RANGE(0xff0000, 0xffffff) AM_RAM
	312	ADDRESS_MAP_END
	313
295	314	static ADDRESS_MAP_START( spacewin_map, AS_PROGRAM, 16 )
296	315	AM_RANGE(0x000000, 0x03ffff) AM_ROM
297	316	AM_RANGE(0x100000, 0x100fff) AM_RAM_WRITE(sderby_videoram_w) AM_BASE_MEMBER(sderby_state,m_videoram) /* bg */
r14798	r14799
359	378	PORT_BIT( 0x8000, IP_ACTIVE_LOW, IPT_UNKNOWN )
360	379	INPUT_PORTS_END
361	380
	381	static INPUT_PORTS_START( luckboom )
	382	PORT_START("IN0") /* 0x308000.w */
	383	PORT_BIT( 0x0001, IP_ACTIVE_LOW, IPT_JOYSTICK_RIGHT )
	384	PORT_BIT( 0x0002, IP_ACTIVE_LOW, IPT_JOYSTICK_LEFT )
	385	PORT_BIT( 0x0004, IP_ACTIVE_LOW, IPT_JOYSTICK_UP )
	386	PORT_BIT( 0x0008, IP_ACTIVE_LOW, IPT_JOYSTICK_DOWN )
	387	PORT_BIT( 0x0010, IP_ACTIVE_LOW, IPT_BUTTON1 )
	388	PORT_BIT( 0x0020, IP_ACTIVE_LOW, IPT_BUTTON2 )
	389	PORT_BIT( 0x0040, IP_ACTIVE_LOW, IPT_UNKNOWN )
	390	PORT_BIT( 0x0080, IP_ACTIVE_LOW, IPT_UNKNOWN )
	391	PORT_BIT( 0x0100, IP_ACTIVE_LOW, IPT_COIN1 )
	392	PORT_BIT( 0x0200, IP_ACTIVE_LOW, IPT_UNKNOWN )
	393	PORT_BIT( 0x0400, IP_ACTIVE_LOW, IPT_UNKNOWN )
	394	PORT_BIT( 0x0800, IP_ACTIVE_LOW, IPT_START1 )
	395	PORT_SERVICE_NO_TOGGLE(0x1000, IP_ACTIVE_LOW)
	396	PORT_BIT( 0x2000, IP_ACTIVE_LOW, IPT_UNKNOWN )
	397	PORT_BIT( 0x4000, IP_ACTIVE_LOW, IPT_UNKNOWN )
	398	PORT_BIT( 0x8000, IP_ACTIVE_LOW, IPT_UNKNOWN )
	399	INPUT_PORTS_END
	400
362	401	static INPUT_PORTS_START( spacewin )
363	402	PORT_START("IN0") /* 0x308000.w */
364	403	PORT_BIT( 0x0001, IP_ACTIVE_LOW, IPT_POKER_HOLD1 )
r14798	r14799
478	517	MCFG_SOUND_ROUTE(ALL_OUTPUTS, "mono", 1.0)
479	518	MACHINE_CONFIG_END
480	519
	520	static MACHINE_CONFIG_START( luckboom, sderby_state )
	521
	522	MCFG_CPU_ADD("maincpu", M68000, 12000000)
	523	MCFG_CPU_PROGRAM_MAP(luckboom_map)
	524	MCFG_CPU_VBLANK_INT("screen", irq4_line_hold)
	525
	526	MCFG_NVRAM_ADD_0FILL("nvram")
	527
	528	MCFG_SCREEN_ADD("screen", RASTER)
	529	MCFG_SCREEN_REFRESH_RATE(60)
	530	MCFG_SCREEN_VBLANK_TIME(ATTOSECONDS_IN_USEC(0))
	531	MCFG_SCREEN_SIZE(648, 648)
	532	MCFG_SCREEN_VISIBLE_AREA(48, 448-1, 38, 338-1)
	533	MCFG_SCREEN_UPDATE_STATIC(sderby)
	534
	535	MCFG_GFXDECODE(sderby)
	536	MCFG_PALETTE_LENGTH(0x1000)
	537	MCFG_VIDEO_START(sderby)
	538
	539	MCFG_SPEAKER_STANDARD_MONO("mono")
	540	MCFG_OKIM6295_ADD("oki", 1056000, OKIM6295_PIN7_HIGH) /* clock frequency & pin 7 not verified */
	541	MCFG_SOUND_ROUTE(ALL_OUTPUTS, "mono", 1.0)
	542	MACHINE_CONFIG_END
	543
481	544	static MACHINE_CONFIG_START( spacewin, sderby_state )
482	545
483	546	MCFG_CPU_ADD("maincpu", M68000, 12000000)
r14798	r14799
718	781	ROM_LOAD( "8.bin", 0x200000, 0x80000, CRC(d4c2b7da) SHA1(515be861443acc5b911241dbaafa42e02f79985a))
719	782	ROM_END
720	783
	784	/*
	785	Lucky Boom (c)1996 Playmark
721	786
	787	QTY Type clock position function
	788	1x MC68000P12 u24 16/32-bit Microprocessor - main
	789	1x M6295 u146 4-Channel Mixing ADCPM Voice Synthesis LSI - sound
	790	1x KA358 u155 Dual Operational Amplifier - sound
	791	1x TDA2003 TD1 Audio Amplifier - sound
	792	1x oscillator 24.000000MHz XL1
	793	1x oscillator 28.000000MHz XL2
	794	1x blu resonator 1000J Y1
	795
	796	ROMs
	797	QTY Type position status
	798	1x TMS27C020 1 dumped
	799	2x AM27C010 2,3 dumped
	800	5x TMS27C010 4-8 dumped
	801
	802	RAMs
	803	QTY Type position
	804	8x HM3-65728BK-5 u42,u73,u74,u75,u80,u81,u124,u125
	805	2x HY62256ALP-10 u2,u6
	806	2x KM6264BL-7L u36,u37
	807	PLDs
	808	QTY Type position status
	809	2x A1020B-PL84C u110,u137 read protected
	810	4x TIBPAL22V10ACNT u1,u77,u111,u112 read protected
	811	*/
	812
	813
	814
	815	ROM_START( luckboom )
	816	ROM_REGION( 0x80000, "maincpu", 0 ) /* 68000 Code */
	817	ROM_LOAD16_BYTE( "2.u16", 0x00000, 0x20000, CRC(0a20eaca) SHA1(edd325b60b3a3ce84e89f8be91b9e19f82d15317) )
	818	ROM_LOAD16_BYTE( "3.u15", 0x00001, 0x20000, CRC(0d3bb24c) SHA1(31826ec29650aa8b70e1b713678401113e008832) )
	819
	820	ROM_REGION( 0x080000, "oki", 0 ) /* Samples */
	821	ROM_LOAD( "1.u147", 0x00000, 0x40000, CRC(0d42c0a3) SHA1(1b1d4c7dcbb063e8bf133063770b753947d1a017) )
	822
	823	ROM_REGION( 0xa0000, "gfx1", 0 ) /* Sprites */
	824	ROM_LOAD( "4.u141", 0x000000, 0x20000, CRC(3aeccad7) SHA1(4104dd3ae928c1a876ac9b460fe18b58ce1206f7) )
	825	ROM_LOAD( "5.u142", 0x020000, 0x20000, CRC(4e4f9ac6) SHA1(e9b0c48195d8b21cdab16d66423ff43e6292ef2c) )
	826	ROM_LOAD( "6.u143", 0x040000, 0x20000, CRC(d1b4910e) SHA1(cfcb14bcd992bceaa634b20eb2d446caa62b6d82) )
	827	ROM_LOAD( "7.u144", 0x060000, 0x20000, CRC(00334bad) SHA1(2d8af2a4b517ceb1ae5504b15086c8faaf934b53) )
	828	ROM_LOAD( "8.u145", 0x080000, 0x20000, CRC(dc12df50) SHA1(0796d6428dc3a032ea55e06e8e07245a256ed036) )
	829	ROM_END
	830
	831
722	832	/******************************
723	833	* Game Drivers *
724	834	******************************/
r14798	r14799
728	838	GAMEL( 1996, spacewin, 0, spacewin, spacewin, 0, ROT0, "Playmark", "Scacco Matto / Space Win", 0, layout_spacewin )
729	839	GAMEL( 1997, croupier, 0, pmroulet, pmroulet, 0, ROT0, "Playmark", "Croupier (Playmark Roulette v.20.05)", GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING, layout_pmroulet )
730	840	GAMEL( 1997, croupiera, croupier, pmroulet, pmroulet, 0, ROT0, "Playmark", "Croupier (Playmark Roulette v.09.04)", GAME_UNEMULATED_PROTECTION \| GAME_NOT_WORKING, layout_pmroulet )
	841	GAME ( 1996, luckboom, 0, luckboom, luckboom, 0, ROT0, "Playmark", "Lucky Boom", 0 )

src/mame/drivers/sidepckt.c
r14798	r14799
27	27
28	28	4062: CE 40 AF LDU #$40AF U = 40AF
29	29	4065: F6 30 03 LDB $3003
30		4068: 53 COMB
31		4069: 54 LSRB
32		406A: 54 LSRB
	30	4068: 53 COMB
	31	4069: 54 LSRB
	32	406A: 54 LSRB
33	33	406B: C4 0C ANDB #$0C
34	34	406D: EC C5 LDD B,U U still = 40AF
35	35	406F: 33 42 LEAU $2,U U ALWAYS = 40B1
r14798	r14799
312	312	PORT_DIPSETTING( 0x30, "10k 60k 50k+" ) /* "10000, after each 50000" in the Dip Switches page */
313	313	PORT_DIPSETTING( 0x20, "20k 70k 50k+" ) /* "20000, after each 70000" in the Dip Switches page */
314	314	PORT_DIPSETTING( 0x10, "30k 80k 50k+" ) /* "30000, after each 100000" in the Dip Switches page */
315		// PORT_DIPSETTING( 0x00, "20k 70k 50k+" ) /* "20000" in the Dip Switches page */
	315	// PORT_DIPSETTING( 0x00, "20k 70k 50k+" ) /* "20000" in the Dip Switches page */
316	316	PORT_BIT( 0x40, IP_ACTIVE_LOW, IPT_SERVICE1 )
317	317	PORT_DIPUNUSED( 0x80, IP_ACTIVE_LOW )
318	318	INPUT_PORTS_END

src/mame/drivers/aerofgt.c
r14798	r14799
1955	1955	/* similar-looking h/w to spikes91, includes roms from spikes91 and svolley. possibly an svolley boot on spikes91 h/w? */
1956	1956	ROM_START( spikes91a )
1957	1957	ROM_REGION( 0x40000, "maincpu", 0 ) /* 68000 code */
1958		ROM_LOAD16_BYTE( "4-prg.bin", 0x00001, 0x10000, CRC(eefaa208) SHA1(2a0417e170de3212f45be64719bb1eb0c6d33c59) )
1959		ROM_LOAD16_BYTE( "6-prg.bin", 0x00000, 0x10000, CRC(da7d2e81) SHA1(ca78a661876ddbcb0e7599edcc819558afb76930) )
	1958	ROM_LOAD16_BYTE( "4-prg.bin", 0x00001, 0x10000, CRC(eefaa208) SHA1(2a0417e170de3212f45be64719bb1eb0c6d33c59) )
	1959	ROM_LOAD16_BYTE( "6-prg.bin", 0x00000, 0x10000, CRC(da7d2e81) SHA1(ca78a661876ddbcb0e7599edcc819558afb76930) )
1960	1960	ROM_LOAD16_BYTE( "5-prg.bin", 0x20000, 0x08000, CRC(e7630122) SHA1(d200afe5134030be615f112af0ab54ac3b349eca) ) // these 2 match program ROMs from svolley
1961	1961	ROM_LOAD16_BYTE( "3-prg.bin", 0x20001, 0x08000, CRC(b6b24910) SHA1(2e4cf80a8eb1fcd9448405ff881bb99ae4ce8909) )
1962	1962
1963	1963	ROM_REGION( 0x080000, "gfx1", 0 )
1964		ROM_LOAD( "19.bin", 0x000000, 0x010000, CRC(12a67e3f) SHA1(c77b264eae0f55af36728b6e5e5e1fec3d366eb1) )
1965		ROM_LOAD( "20.bin", 0x010000, 0x010000, CRC(31828996) SHA1(b324902b9fff0bab1daa3af5136b96d50d12956f) )
1966		ROM_LOAD( "21.bin", 0x020000, 0x010000, CRC(51cbe0d6) SHA1(d60b2a297d7e994c60db28e8ba60b0664e01f61d) )
1967		ROM_LOAD( "22.bin", 0x030000, 0x010000, CRC(c289bfc0) SHA1(4a8929c5f304a1d203cad04c72fc6e96764dc858) )
	1964	ROM_LOAD( "19.bin", 0x000000, 0x010000, CRC(12a67e3f) SHA1(c77b264eae0f55af36728b6e5e5e1fec3d366eb1) )
	1965	ROM_LOAD( "20.bin", 0x010000, 0x010000, CRC(31828996) SHA1(b324902b9fff0bab1daa3af5136b96d50d12956f) )
	1966	ROM_LOAD( "21.bin", 0x020000, 0x010000, CRC(51cbe0d6) SHA1(d60b2a297d7e994c60db28e8ba60b0664e01f61d) )
	1967	ROM_LOAD( "22.bin", 0x030000, 0x010000, CRC(c289bfc0) SHA1(4a8929c5f304a1d203cad04c72fc6e96764dc858) )
1968	1968
1969	1969	ROM_REGION( 0x100000, "gfx2", ROMREGION_INVERT )
1970		ROM_LOAD( "7.bin", 0x000000, 0x010000, CRC(9596a4c0) SHA1(1f233bb2fa662fb8cd9c0db478e392ca26d9484b) )
1971		ROM_LOAD( "8.bin", 0x010000, 0x010000, CRC(451ebd75) SHA1(67d5a9fadf3c8a39d59e7b21cb8633dd19886f76) )
1972		ROM_LOAD( "10.bin", 0x020000, 0x010000, CRC(a05249e6) SHA1(8671e0c980ba87ea14895176fb5c8a48bb4c932e) )
1973		ROM_LOAD( "11.bin", 0x030000, 0x010000, CRC(0983987a) SHA1(c334276774ffdee0023ea6287e98e0e6e372fb80) )
1974		ROM_LOAD( "13.bin", 0x040000, 0x010000, CRC(429159f3) SHA1(4395413c4ab4a1fd322a1af6f2b93bb62b044223) )
1975		ROM_LOAD( "14.bin", 0x050000, 0x010000, CRC(4babf749) SHA1(1d5055e825b9efc17a200f4e04e6fa326397f7cc) )
1976		ROM_LOAD( "16.bin", 0x060000, 0x010000, CRC(f5436c8d) SHA1(d29508cc5ee43d7b072112c6d95c36ee0328e5fb) )
1977		ROM_LOAD( "17.bin", 0x070000, 0x010000, CRC(f82f9664) SHA1(678fd8f3abc39ccb4ef32e9d6ef481d7d751aecb) )
1978		ROM_LOAD( "9.bin", 0x080000, 0x008000, CRC(3291e3e0) SHA1(dcc358bf66e4c65992d4376c203b811928068cf3) )
1979		ROM_LOAD( "12.bin", 0x088000, 0x008000, CRC(40aedad9) SHA1(cbf50eae4ccbc06213a5c227409e1dade7180572) )
1980		ROM_LOAD( "15.bin", 0x090000, 0x008000, CRC(911104d7) SHA1(66b48c34da2cc17faeffa1d36f5b6b7e15c2033b) )
1981		ROM_LOAD( "18.bin", 0x098000, 0x008000, CRC(07265de1) SHA1(bad7f1b168640a7d90b0d4d9c255ba98fa4c6fa8) )
	1970	ROM_LOAD( "7.bin", 0x000000, 0x010000, CRC(9596a4c0) SHA1(1f233bb2fa662fb8cd9c0db478e392ca26d9484b) )
	1971	ROM_LOAD( "8.bin", 0x010000, 0x010000, CRC(451ebd75) SHA1(67d5a9fadf3c8a39d59e7b21cb8633dd19886f76) )
	1972	ROM_LOAD( "10.bin", 0x020000, 0x010000, CRC(a05249e6) SHA1(8671e0c980ba87ea14895176fb5c8a48bb4c932e) )
	1973	ROM_LOAD( "11.bin", 0x030000, 0x010000, CRC(0983987a) SHA1(c334276774ffdee0023ea6287e98e0e6e372fb80) )
	1974	ROM_LOAD( "13.bin", 0x040000, 0x010000, CRC(429159f3) SHA1(4395413c4ab4a1fd322a1af6f2b93bb62b044223) )
	1975	ROM_LOAD( "14.bin", 0x050000, 0x010000, CRC(4babf749) SHA1(1d5055e825b9efc17a200f4e04e6fa326397f7cc) )
	1976	ROM_LOAD( "16.bin", 0x060000, 0x010000, CRC(f5436c8d) SHA1(d29508cc5ee43d7b072112c6d95c36ee0328e5fb) )
	1977	ROM_LOAD( "17.bin", 0x070000, 0x010000, CRC(f82f9664) SHA1(678fd8f3abc39ccb4ef32e9d6ef481d7d751aecb) )
	1978	ROM_LOAD( "9.bin", 0x080000, 0x008000, CRC(3291e3e0) SHA1(dcc358bf66e4c65992d4376c203b811928068cf3) )
	1979	ROM_LOAD( "12.bin", 0x088000, 0x008000, CRC(40aedad9) SHA1(cbf50eae4ccbc06213a5c227409e1dade7180572) )
	1980	ROM_LOAD( "15.bin", 0x090000, 0x008000, CRC(911104d7) SHA1(66b48c34da2cc17faeffa1d36f5b6b7e15c2033b) )
	1981	ROM_LOAD( "18.bin", 0x098000, 0x008000, CRC(07265de1) SHA1(bad7f1b168640a7d90b0d4d9c255ba98fa4c6fa8) )
1982	1982
1983	1983	ROM_REGION( 0x020000, "user1", ROMREGION_ERASEFF ) /* lookup tables for the sprites */
1984	1984
1985	1985	ROM_REGION( 0x20000, "cpu1", 0 ) /* Z80 Sound CPU */
1986	1986	ROM_LOAD( "2-snd.bin", 0x00000, 0x10000, CRC(e3065b1d) SHA1(c4a3a95ba7f43cdf1b0c574f41de06d007ad2bd8) ) // matches 1.ic140 from pspikes91
1987		ROM_LOAD( "1-snd.bin", 0x10000, 0x08000, CRC(009d7157) SHA1(2cdda7094c7476289d75a78ee25b34fa3b3225c0) )
	1987	ROM_LOAD( "1-snd.bin", 0x10000, 0x08000, CRC(009d7157) SHA1(2cdda7094c7476289d75a78ee25b34fa3b3225c0) )
1988	1988	ROM_END
1989	1989
1990	1990	/* this is a bootleg / chinese hack of power spikes */

src/mame/drivers/system1.c
r14798	r14799
3912	3912	ROM_REGION( 0x10000, "maincpu", 0 )
3913	3913	/* this has way more code than the parent sets, I have no idea what to do with it */
3914	3914	ROM_LOAD( "1.bin", 0x0000, 0x8000, CRC(07066b6f) SHA1(1ead373907fd5bd5f4cc003a97218aa582758a00) )
3915		ROM_LOAD( "4.bin", 0x4000, 0x8000, CRC(8b3124e6) SHA1(e90deaa687128c1f0b7e9e6b6d767bd484c7fc61) )
3916		ROM_LOAD( "5.bin", 0x8000, 0x8000, CRC(b75278e7) SHA1(5b7c519f32eac40dc46ca5bba03cec1e893b6fcd) )
	3915	ROM_LOAD( "4.bin", 0x4000, 0x8000, CRC(8b3124e6) SHA1(e90deaa687128c1f0b7e9e6b6d767bd484c7fc61) )
	3916	ROM_LOAD( "5.bin", 0x8000, 0x8000, CRC(b75278e7) SHA1(5b7c519f32eac40dc46ca5bba03cec1e893b6fcd) )
3917	3917	ROM_LOAD( "epr-7491.96", 0x8000, 0x4000, CRC(1f7d0efe) SHA1(a1b4f8faf1614f4808df1292209c340f1490adbd) )
3918	3918	ROM_LOAD( "0cpu.bin", 0xc000, 0x2000, CRC(a962e6af) SHA1(f46b01db38cdc9c8485d7fe0a344e9f6ed918925) ) /* supposedly the encryption key */
3919	3919

src/mame/drivers/bfm_sc2.c
r14798	r14799
3889	3889	#define sc2_gslam_sound \
3890	3890	ROM_REGION( 0x80000, "upd", 0 )\
3891	3891	ROM_LOAD( "grandslamsnd.bin", 0x0000, 0x080000, CRC(e4af3787) SHA1(9aa40f7c4c4db3618b553505b02663c1d5f297c3) )\
3892
	3892
3893	3893	#define sc2_gslam_sound_alt \
3894	3894	ROM_REGION( 0x80000, "upd", 0 )\
3895	3895	ROM_LOAD( "gslamsndb.bin", 0x0000, 0x080000, CRC(c9dfb6f5) SHA1(6e529c210b26e7ce164cebbff8ec314c6fa8f7bf) )
r14798	r14799
4343	4343	ROM_REGION( 0x20000, "upd", 0 )
4344	4344	ROM_LOAD("focsound.bin", 0x00000, 0x20000, CRC(fce86700) SHA1(546680dd85234608c1b7e850bad3165400fd981c))
4345	4345	ROM_END
4346
	4346
4347	4347	ROM_START( sc2gslam )
4348	4348	ROM_REGION( 0x10000, "maincpu", 0 )
4349	4349	ROM_LOAD( "club-grand-slam_std_ac_ass.bin", 0x0000, 0x010000, CRC(b28dcd9c) SHA1(f20ef0f0a1b5cc287cf93a175fede98dde3fecf4) )
r14798	r14799
4382	4382	ROM_START( sc2cshcl )
4383	4383	ROM_REGION( 0x10000, "maincpu", 0 )
4384	4384	ROM_LOAD( "club_cashino_std_ac_f65_rot_ass.bin", 0x0000, 0x010000, CRC(23aa2c72) SHA1(155df9b501cf5ae9eb3afca48c4100617793ac09) )
4385
	4385
4386	4386	ROM_REGION( 0x80000, "upd", 0 )
4387	4387	ROM_LOAD( "cashsnd", 0x0000, 0x080000, CRC(807d37a6) SHA1(bd5f7c39a64a562e96a850a2cc82bfe3f74f1e54) )
4388	4388	ROM_END
r14798	r14799
4415	4415	ROM_END
4416	4416
4417	4417	//There are two distinct builds here, one clearly marked up as mark 2. For sanity's sake, though they share sound, I'm assigning them as separate entities
4418
	4418
4419	4419	ROM_START( sc2catms )
4420	4420	ROM_REGION( 0x10000, "maincpu", 0 )
4421	4421	ROM_LOAD( "cat and mouse p1.bin", 0x0000, 0x010000, CRC(b33b2a75) SHA1(ac57b4d33ac1218e39b8bbd669c40bdbb3839ccf) )
r14798	r14799
5069	5069	ROM_LOAD( "partysnd1.bin", 0x0000, 0x020000, CRC(b5a5cc9e) SHA1(c9b132ad0d1ce9ff6b56ebde89d5006a5cf7dff6) )
5070	5070	ROM_END
5071	5071
5072
	5072
5073	5073	ROM_START( sc2ofool )
5074	5074	ROM_REGION( 0x10000, "maincpu", 0 )
5075	5075	ROM_LOAD( "onlyfoolsnhorses_std.bin", 0x0000, 0x010000, CRC(03cc611a) SHA1(e37d6b87017a52f8de339bbd69b2ccbff9872fae) )
r14798	r14799
5471	5471	sc2_cops_sound
5472	5472	ROM_END
5473	5473
5474
	5474
5475	5475	//Some of these are labelled as for different cabinets, which probably means different reel motors or configurations
5476	5476	ROM_START( sc2copcl )
5477	5477	ROM_REGION( 0x10000, "maincpu", 0 )
r14798	r14799
5502	5502	ROM_LOAD( "club-cops-and-robbers_std_ac_250pnd-20p_ass.bin", 0x0000, 0x010000, CRC(229c65c1) SHA1(8052c4b8702275235545807e7b075571fc97d4f3) )
5503	5503	sc2_copcl_sound
5504	5504	ROM_END
5505
	5505
5506	5506	ROM_START( sc2copcl3 )
5507	5507	ROM_REGION( 0x10000, "maincpu", 0 )
5508	5508	ROM_LOAD( "club-cops-and-robbers_std_fe_ac_p67_ass.bin", 0x0000, 0x010000, CRC(4906d170) SHA1(c304a2986560d675b2e776965fdf444e4d56f104) )
r14798	r14799
5588	5588	ROM_END
5589	5589
5590	5590
5591
	5591
5592	5592	ROM_START( sc2copdc )
5593	5593	ROM_REGION( 0x10000, "maincpu", 0 )
5594	5594	ROM_LOAD( "club-deluxe-cops-and-robbers_std_ac_250pnd-25p_p67_ass.bin", 0x0000, 0x010000, CRC(fd19db9a) SHA1(441d80b8463ffd5f8783b3cb80d8321f64e8fcc5) )
r14798	r14799
5821	5821	ROM_END
5822	5822
5823	5823	// sets below are mazooma
5824		//Protocol status is guessed from part number for now until we're certain everything works with Mazooma games.
	5824	//Protocol status is guessed from part number for now until we're certain everything works with Mazooma games.
5825	5825	ROM_START( sc2delsm )
5826	5826	ROM_REGION( 0x10000, "maincpu", 0 )
5827	5827	ROM_LOAD( "98400005", 0x0000, 0x010000, CRC(bd9153cf) SHA1(695a897077b2136ba4d0699cad616df5ceadf824) )
r14798	r14799
6186	6186	ROM_LOAD( "hiflyergame.bin", 0x0000, 0x010000, CRC(b3627b55) SHA1(105ff7da69eb2ca722ee251a4a6af49c46ab1bc8) )
6187	6187	sc2_hifly_sound
6188	6188	ROM_END
6189
	6189
6190	6190	ROM_START( sc2inst )
6191	6191	ROM_REGION( 0x10000, "maincpu", 0 )
6192	6192	ROM_LOAD( "instant-jackpot_std_ac_var_10pnd_ass.bin", 0x0000, 0x010000, CRC(81a235e9) SHA1(3ed26da7511b2b2324d74f8395215157c41850ce) )
r14798	r14799
6502	6502
6503	6503
6504	6504
6505
6506	6505
	6506
6507	6507	ROM_START( sc2wwcl )
6508	6508	ROM_REGION( 0x10000, "maincpu", 0 )
6509	6509	ROM_LOAD( "club-wild-west_std_ac_var_250pnd_ass.bin", 0x0000, 0x010000, CRC(a4c33524) SHA1(34d46b912488f630ddec301bde5ee1d87661b2a4) )
r14798	r14799
7107	7107	ROM_START( sc2gcclb )
7108	7108	ROM_REGION( 0x10000, "maincpu", 0 )
7109	7109	ROM_LOAD( "club-golden-casino_std_ac_250pnd-20p_ass.bin", 0x0000, 0x010000, CRC(5f7fc343) SHA1(264c5bba36c820440c2ed97c04d4dd3592e111da) )
7110
	7110
7111	7111	ROM_REGION( 0x80000, "altrevs", 0 )//Wrong hardware?
7112	7112	ROM_LOAD( "95004065.p1", 0x0000, 0x080000, CRC(2670726b) SHA1(0f8045c68131191fceea5728e14c901d159bfb57) )
7113	7113
r14798	r14799
7206	7206	ROM_LOAD( "hyperactive_std_wi_ac_10pnd-20p_ass.bin", 0x0000, 0x010000, CRC(2d01bc08) SHA1(c2186fb639735d4e1d46ceaeae6eee63c7a740b7) )
7207	7207	ROM_REGION( 0x200000, "upd", ROMREGION_ERASE00 )
7208	7208	ROM_END
7209
	7209
7210	7210	ROM_START( sc2hypr1p )
7211	7211	ROM_REGION( 0x10000, "maincpu", 0 )
7212	7212	ROM_LOAD( "hyperactive_dat_wi_ac_10pnd-20p_ass.bin", 0x0000, 0x010000, CRC(6d11a9eb) SHA1(d68564a96984c5dde536add4507bc8bae75e19ea) )
r14798	r14799
7286	7286	ROM_START( sc2relgm1p )
7287	7287	ROM_REGION( 0x10000, "maincpu", 0 )
7288	7288	ROM_LOAD( "reel-gems_dat_ga_20p_ass.bin", 0x0000, 0x010000, CRC(86e81781) SHA1(7b59efa627f70b2c3598c5abd276a7c2737b0751) )
7289
	7289
7290	7290	ROM_REGION( 0x200000, "upd", ROMREGION_ERASE00 )
7291	7291	ROM_END
7292	7292
r14798	r14799
7683	7683	GAME( 199?, sc2sstar3 , sc2sstar , scorpion2 , drwho , drwho , 0, "BFM", "Superstar (Bellfruit) (set 4, UK, 2nd Triennial) (Scorpion 2/3)", GAME_FLAGS)
7684	7684	GAME( 199?, sc2sstar3p , sc2sstar , scorpion2 , drwho , drwho , 0, "BFM", "Superstar (Bellfruit) (set 4, UK, 2nd Triennial, Protocol) (Scorpion 2/3)", GAME_FLAGS)
7685	7685	GAME( 199?, sc2sstar4 , sc2sstar , scorpion2 , drwho , drwho , 0, "BFM", "Superstar (Bellfruit) (set 5, UK) (Scorpion 2/3)", GAME_FLAGS)
7686
7687	7686
	7687
7688	7688	GAME( 199?, sc2wwcl , 0 , scorpion2 , drwho , drwho , 0, "BFM", "Wild West Club (Bellfruit) (set 1, UK, 250GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
7689	7689	GAME( 199?, sc2wwclp , sc2wwcl , scorpion2 , drwho , drwho , 0, "BFM", "Wild West Club (Bellfruit) (set 1, UK, 250GBP Jackpot, Protocol) (Scorpion 2/3)", GAME_FLAGS)
7690	7690	GAME( 199?, sc2wwcl1 , sc2wwcl , scorpion2 , drwho , drwho , 0, "BFM", "Wild West Club (Bellfruit) (set 2, UK) (Scorpion 2/3)", GAME_FLAGS)
r14798	r14799
7746	7746	GAME( 199?, sc2scshxstar, sc2scshx , scorpion2 , drwho , drwho , 0, "Concept", "Super Cash X (Concept) (Starpoint Hardware)", GAME_FLAGS)
7747	7747	GAME( 199?, sc2scshxcas, sc2scshx , scorpion2 , drwho , drwho , 0, "Concept", "Super Casino Cash X (Concept)", GAME_FLAGS)
7748	7748
7749		GAME( 199?, sc2cgc , 0 , scorpion2 , drwho , drwho , 0, "BFM", "Carrot Gold Club (Bellfruit) (Scorpion 2/3)", GAME_FLAGS)
7750		GAME( 199?, sc2cnile , 0 , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 1 UK, 150GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
7751		GAME( 199?, sc2cnile1 , sc2cnile , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 2 UK, 150GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
7752		GAME( 199?, sc2cnile2 , sc2cnile , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 2 UK, 200GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
7753		GAME( 199?, sc2cnile2p , sc2cnile , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 2 UK, 150GBP Jackpot, Protocol) (Scorpion 2/3)", GAME_FLAGS)
7754		GAME( 199?, sc2cnile3p , sc2cnile , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 3 UK, 150GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
	7749	GAME( 199?, sc2cgc , 0 , scorpion2 , drwho , drwho , 0, "BFM", "Carrot Gold Club (Bellfruit) (Scorpion 2/3)", GAME_FLAGS)
	7750	GAME( 199?, sc2cnile , 0 , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 1 UK, 150GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
	7751	GAME( 199?, sc2cnile1 , sc2cnile , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 2 UK, 150GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
	7752	GAME( 199?, sc2cnile2 , sc2cnile , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 2 UK, 200GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
	7753	GAME( 199?, sc2cnile2p , sc2cnile , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 2 UK, 150GBP Jackpot, Protocol) (Scorpion 2/3)", GAME_FLAGS)
	7754	GAME( 199?, sc2cnile3p , sc2cnile , scorpion2 , drwho , drwho , 0, "BFM", "Cash On The Nile Club (Bellfruit) (set 3 UK, 150GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
7755	7755
7756		GAME( 199?, sc2casr , 0 , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 1, UK, 10GBP Jackpot, 3rd Triennial) (Scorpion 2/3)", GAME_FLAGS)
7757		GAME( 199?, sc2casrp , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 1, UK, 10GBP Jackpot, 3rd Triennial, Protocol) (Scorpion 2/3)", GAME_FLAGS)
7758		GAME( 199?, sc2casr1 , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 2, UK, 3rd Triennial) (Scorpion 2/3)", GAME_FLAGS)
7759		GAME( 199?, sc2casr1p , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 2, UK, 3rd Triennial, Protocol) (Scorpion 2/3)", GAME_FLAGS)
7760		GAME( 199?, sc2casr2 , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 3, UK) (Scorpion 2/3)", GAME_FLAGS)
7761		GAME( 199?, sc2casr2p , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 3, UK, Protocol) (Scorpion 2/3)", GAME_FLAGS)
7762		GAME( 199?, sc2casr3 , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 4, UK, 8GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
7763		GAME( 199?, sc2casr3p , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 4, UK, 8GBP Jackpot, Protocol) (Scorpion 2/3)", GAME_FLAGS)
7764		GAME( 199?, sc2casr4 , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 5, UK) (Scorpion 2/3)", GAME_FLAGS)
7765		GAME( 199?, sc2casr4p , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 5, UK, Protocol) (Scorpion 2/3)", GAME_FLAGS)
	7756	GAME( 199?, sc2casr , 0 , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 1, UK, 10GBP Jackpot, 3rd Triennial) (Scorpion 2/3)", GAME_FLAGS)
	7757	GAME( 199?, sc2casrp , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 1, UK, 10GBP Jackpot, 3rd Triennial, Protocol) (Scorpion 2/3)", GAME_FLAGS)
	7758	GAME( 199?, sc2casr1 , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 2, UK, 3rd Triennial) (Scorpion 2/3)", GAME_FLAGS)
	7759	GAME( 199?, sc2casr1p , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 2, UK, 3rd Triennial, Protocol) (Scorpion 2/3)", GAME_FLAGS)
	7760	GAME( 199?, sc2casr2 , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 3, UK) (Scorpion 2/3)", GAME_FLAGS)
	7761	GAME( 199?, sc2casr2p , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 3, UK, Protocol) (Scorpion 2/3)", GAME_FLAGS)
	7762	GAME( 199?, sc2casr3 , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 4, UK, 8GBP Jackpot) (Scorpion 2/3)", GAME_FLAGS)
	7763	GAME( 199?, sc2casr3p , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 4, UK, 8GBP Jackpot, Protocol) (Scorpion 2/3)", GAME_FLAGS)
	7764	GAME( 199?, sc2casr4 , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 5, UK) (Scorpion 2/3)", GAME_FLAGS)
	7765	GAME( 199?, sc2casr4p , sc2casr , scorpion2 , drwho , drwho , 0, "BFM", "Casino Royale (Bellfruit) (set 5, UK, Protocol) (Scorpion 2/3)", GAME_FLAGS)
7766	7766
7767	7767	GAME( 199?, sc2cmbt , 0 , scorpion2 , drwho , drwho , 0, "BFM", "Cat & Mouse & Bonzo Too (Bellfruit) (set 1, UK) (Scorpion 2/3)", GAME_FLAGS)
7768	7768	GAME( 199?, sc2cmbtp , sc2cmbt , scorpion2 , drwho , drwho , 0, "BFM", "Cat & Mouse & Bonzo Too (Bellfruit) (set 1, UK, Protocol) (Scorpion 2/3)", GAME_FLAGS)

src/mame/drivers/jankenmn.c
r14798	r14799
60	60	Other specs...
61	61
62	62	Name of game: Janken Man.
63		Manufacturer: Sanwaizu Co., Ltd. (Bankruptcy on March 6, 1998)
	63	Manufacturer: Sanwaizu Co., Ltd. (Bankruptcy on March 6, 1998)
64	64	Year: May 1985 (1985)
65	65	Body dimensions: Depth: 355mm, Width: 340mm, Height: 855mm (body only)
66	66	Weight: 30kg.
r14798	r14799
105	105	1 = Right
106	106
107	107	lamps:
108
	108
109	109	0 = Multiplier 1 "attarii" (pays x1)
110	110	1 = Multiplier 2 "ooatari" (pays x2)
111	111

src/mame/drivers/cps1.c
r14798	r14799
5023	5023	ROM_CONTINUE( 0x10000, 0x08000 )
5024	5024
5025	5025	ROM_REGION( 0x40000, "oki", 0 ) /* Samples */
5026		ROM_LOAD( "41e_18.11c", 0x00000, 0x20000, CRC(d1f15aeb) SHA1(88089383f2d54fc97026a67f067d448eee5bd0c2) ) // == 41_18.11c /* label is 41E_18, pcb verified */
	5026	ROM_LOAD( "41e_18.11c", 0x00000, 0x20000, CRC(d1f15aeb) SHA1(88089383f2d54fc97026a67f067d448eee5bd0c2) ) // == 41_18.11c /* label is 41E_18, pcb verified */
5027	5027	ROM_LOAD( "41_19.12c", 0x20000, 0x20000, CRC(15aec3a6) SHA1(8153c03aba005bab62bf0e8b3d15ec1c346326fd) )
5028	5028
5029	5029	ROM_REGION( 0x0200, "aboardplds", 0 )

src/mame/drivers/dec0.c
r14798	r14799
1879	1879
1880	1880	ROM_START( drgninjab )
1881	1881	ROM_REGION( 0x60000, "maincpu", 0 ) /* 664k for 68000 code, middle 0x20000 unused /
1882		ROM_LOAD16_BYTE( "n-12.d2", 0x00000, 0x10000, CRC(5a70eb52) SHA1(26fd48ea71cd5196e3907eebcf1234f44a3d7dba) )
1883		ROM_LOAD16_BYTE( "n-11.a2", 0x00001, 0x10000, CRC(3887eb92) SHA1(a8650ce128927955497540d7c6fbd23516afdb24) )
	1882	ROM_LOAD16_BYTE( "n-12.d2", 0x00000, 0x10000, CRC(5a70eb52) SHA1(26fd48ea71cd5196e3907eebcf1234f44a3d7dba) )
	1883	ROM_LOAD16_BYTE( "n-11.a2", 0x00001, 0x10000, CRC(3887eb92) SHA1(a8650ce128927955497540d7c6fbd23516afdb24) )
1884	1884	ROM_LOAD16_BYTE( "eg06.6c", 0x40000, 0x10000, CRC(2b81faf7) SHA1(6d10c29f5ee06856843d83e77ba24c2b6e00a9cb) )
1885	1885	ROM_LOAD16_BYTE( "eg03.6a", 0x40001, 0x10000, CRC(c52c2e9d) SHA1(399f2b7df9d558c8f33bf1a7c8048c62e0f54cec) )
1886	1886

src/mame/drivers/8080bw.c
r14798	r14799
2643	2643	ROM_REGION( 0x10000, "maincpu", 0 )
2644	2644	ROM_LOAD( "pv01", 0x0000, 0x0800, CRC(7288a511) SHA1(ff617872784c28ed03591aefa9f0519e5651701f) )
2645	2645	/* pv01 had weird encryption applied to it, very likely to have been done post-dump. */
2646		// for (offs = 0x4fc; offs < 0x5fc; offs++)
2647		// rom[offs] ^= 0x6c;
	2646	// for (offs = 0x4fc; offs < 0x5fc; offs++)
	2647	// rom[offs] ^= 0x6c;
2648	2648
2649	2649	// 0x4fc + 1 * 0x56
2650		// for (offs = 0x54e; offs < 0x552; offs++)
2651		// rom[offs] ^= 0x03;
	2650	// for (offs = 0x54e; offs < 0x552; offs++)
	2651	// rom[offs] ^= 0x03;
2652	2652
2653	2653	// 0x4fc + 2 * 0x56
2654		// for (offs = 0x5a4; offs < 0x5a8; offs++)
2655		// rom[offs] ^= 0x01;
	2654	// for (offs = 0x5a4; offs < 0x5a8; offs++)
	2655	// rom[offs] ^= 0x01;
2656	2656
2657	2657	// 0x4fc + 3 * 0x56
2658		// for (offs = 0x5fa; offs < 0x5fc; offs++)
2659		// rom[offs] ^= 0x02;
	2658	// for (offs = 0x5fa; offs < 0x5fc; offs++)
	2659	// rom[offs] ^= 0x02;
2660	2660
2661	2661	ROM_LOAD( "br_pv02", 0x0800, 0x0800, CRC(420c7c35) SHA1(b51265f4d9e5a8cf9d53099a97cadd25ea0b34ce) )
2662	2662	ROM_LOAD( "br_pv03", 0x1000, 0x0800, CRC(dffd04b9) SHA1(d51a0f27e90b0a49cf2d57ec82a863dcae9f3ea4) )

src/mame/drivers/rastan.c
r14798	r14799
493	493	/* this is an official Taito PCB and mostly matches rastanu, but the copyright message is TAITO JAPAN so I assume it's a World version */
494	494	ROM_START( rastan2 )
495	495	ROM_REGION( 0x60000, "maincpu", 0 ) /* 664k for 68000 code /
496		ROM_LOAD16_BYTE( "b04-38.19", 0x00000, 0x10000, CRC(1c91dbb1) SHA1(17fc55e8546cc0b847aebd67fb4570a1e9f128f3) )
497		ROM_LOAD16_BYTE( "b04-37.7", 0x00001, 0x10000, CRC(ecf20bdd) SHA1(92e46b1edef40a19be17091c09daba598d77bca8) )
498		ROM_LOAD16_BYTE( "b04-40.20", 0x20000, 0x10000, CRC(0930d4b3) SHA1(c269b3856040ed9409de99cca48f22a2f355fc4c) )
499		ROM_LOAD16_BYTE( "b04-39.8", 0x20001, 0x10000, CRC(d95ade5e) SHA1(f47557dcfa9d3137e2a3838e45858fc21471cc91) )
500		ROM_LOAD16_BYTE( "b04-42.21", 0x40000, 0x10000, CRC(1857a7cb) SHA1(7d967d04ade648c6ddb19aad9e184b6e272856da) )
501		ROM_LOAD16_BYTE( "b04-43-1.9", 0x40001, 0x10000, CRC(ca4702ff) SHA1(0f8c2d7d332c4e35884c48d87ba9fd26924d1692) )
	496	ROM_LOAD16_BYTE( "b04-38.19", 0x00000, 0x10000, CRC(1c91dbb1) SHA1(17fc55e8546cc0b847aebd67fb4570a1e9f128f3) )
	497	ROM_LOAD16_BYTE( "b04-37.7", 0x00001, 0x10000, CRC(ecf20bdd) SHA1(92e46b1edef40a19be17091c09daba598d77bca8) )
	498	ROM_LOAD16_BYTE( "b04-40.20", 0x20000, 0x10000, CRC(0930d4b3) SHA1(c269b3856040ed9409de99cca48f22a2f355fc4c) )
	499	ROM_LOAD16_BYTE( "b04-39.8", 0x20001, 0x10000, CRC(d95ade5e) SHA1(f47557dcfa9d3137e2a3838e45858fc21471cc91) )
	500	ROM_LOAD16_BYTE( "b04-42.21", 0x40000, 0x10000, CRC(1857a7cb) SHA1(7d967d04ade648c6ddb19aad9e184b6e272856da) )
	501	ROM_LOAD16_BYTE( "b04-43-1.9", 0x40001, 0x10000, CRC(ca4702ff) SHA1(0f8c2d7d332c4e35884c48d87ba9fd26924d1692) )
502	502
503	503	ROM_REGION( 0x1c000, "audiocpu", 0 )
504	504	ROM_LOAD( "b04-19.49", 0x00000, 0x4000, CRC(ee81fdd8) SHA1(fa59dac2583a7d2979550dffc6f9c6c2bd67bfd5) )

src/mame/drivers/bigstrkb.c
r14798	r14799
260	260	// same as bigstrkb, but less buggy/better presentation, and teams are Italian league instead of international
261	261	ROM_START( bigstrkba )
262	262	ROM_REGION( 0x80000, "maincpu", 0 ) /* 68000 Code */
263		ROM_LOAD16_BYTE( "15.cpu16", 0x000000, 0x040000, CRC(204551b5) SHA1(bfc8d284801a2c11677431287bc2e5b8ba7737db) )
264		ROM_LOAD16_BYTE( "16.cpu17", 0x000001, 0x040000, CRC(3ba6997b) SHA1(86c0318a48b42b4622f3397c55584e0779e4f626) )
	263	ROM_LOAD16_BYTE( "15.cpu16", 0x000000, 0x040000, CRC(204551b5) SHA1(bfc8d284801a2c11677431287bc2e5b8ba7737db) )
	264	ROM_LOAD16_BYTE( "16.cpu17", 0x000001, 0x040000, CRC(3ba6997b) SHA1(86c0318a48b42b4622f3397c55584e0779e4f626) )
265	265
266	266	ROM_REGION( 0x40000, "gfx1", 0 ) /* 8x8x4 FG Tiles */
267		ROM_LOAD( "5.bin", 0x000000, 0x010000, CRC(f51ea151) SHA1(fd80280fa99cd08b9f458a4d4078ce59a926b4bc) )
268		ROM_LOAD( "6.bin", 0x010000, 0x010000, CRC(754d750e) SHA1(d0a6be6d373e95404733c125126bbeeed03e370e) )
269		ROM_LOAD( "7.bin", 0x020000, 0x010000, CRC(fbc52546) SHA1(daae9451629b67d532dfd4825b552944e1c585d8) )
270		ROM_LOAD( "8.bin", 0x030000, 0x010000, CRC(62c63eaa) SHA1(4a408703a3d70159d78b0c213ff52a95a8a07884) )
	267	ROM_LOAD( "5.bin", 0x000000, 0x010000, CRC(f51ea151) SHA1(fd80280fa99cd08b9f458a4d4078ce59a926b4bc) )
	268	ROM_LOAD( "6.bin", 0x010000, 0x010000, CRC(754d750e) SHA1(d0a6be6d373e95404733c125126bbeeed03e370e) )
	269	ROM_LOAD( "7.bin", 0x020000, 0x010000, CRC(fbc52546) SHA1(daae9451629b67d532dfd4825b552944e1c585d8) )
	270	ROM_LOAD( "8.bin", 0x030000, 0x010000, CRC(62c63eaa) SHA1(4a408703a3d70159d78b0c213ff52a95a8a07884) )
271	271
272	272	ROM_REGION( 0x200000, "gfx2", ROMREGION_INVERT ) /* 16x16x4 BG Tiles */
273		ROM_LOAD( "1.bin", 0x000000, 0x080000, CRC(c4eb9746) SHA1(ed4436e79abdb043349ee20d22c5454590ab5837) )
274		ROM_LOAD( "2.bin", 0x080000, 0x080000, CRC(aa0beb78) SHA1(42cde54203cab4169099172cfce090725102e44c) )
275		ROM_LOAD( "3.bin", 0x100000, 0x080000, CRC(d02298c5) SHA1(d3da72cc4edc8a6c9c8ec76bb566ded6d0b7b453) )
276		ROM_LOAD( "4.bin", 0x180000, 0x080000, CRC(069ac008) SHA1(30b90d80177de744624e9d9618eebe5471042afd) )
	273	ROM_LOAD( "1.bin", 0x000000, 0x080000, CRC(c4eb9746) SHA1(ed4436e79abdb043349ee20d22c5454590ab5837) )
	274	ROM_LOAD( "2.bin", 0x080000, 0x080000, CRC(aa0beb78) SHA1(42cde54203cab4169099172cfce090725102e44c) )
	275	ROM_LOAD( "3.bin", 0x100000, 0x080000, CRC(d02298c5) SHA1(d3da72cc4edc8a6c9c8ec76bb566ded6d0b7b453) )
	276	ROM_LOAD( "4.bin", 0x180000, 0x080000, CRC(069ac008) SHA1(30b90d80177de744624e9d9618eebe5471042afd) )
277	277
278	278	ROM_REGION( 0x080000, "gfx3", ROMREGION_INVERT ) /* 16x16x4 Sprites */
279	279	ROM_LOAD( "footgaa.011", 0x000000, 0x20000, CRC(c3924fea) SHA1(85b6775b5aa8c518a1e169b97379a210e25e67c9) )
280		ROM_LOAD( "12.bin", 0x020000, 0x20000, CRC(8e15ea09) SHA1(e591811bb5ecb1782a77883b3ee27212fb703f22) )
	280	ROM_LOAD( "12.bin", 0x020000, 0x20000, CRC(8e15ea09) SHA1(e591811bb5ecb1782a77883b3ee27212fb703f22) )
281	281	ROM_LOAD( "footgaa.013", 0x040000, 0x20000, CRC(26ce4b7f) SHA1(4bfd1de6d73dc5e720972bba477081dba0b05ab3) )
282	282	ROM_LOAD( "footgaa.014", 0x060000, 0x20000, CRC(c3cfc500) SHA1(5dc5780b9977b0544601471004c656c2fd738bcd) )
283	283

src/tools/unidasm.c
r14798	r14799
326	326	{ "tms32051", _16le, -1, CPU_DISASSEMBLE_NAME(tms32051) },
327	327	{ "tms34010", _8bit, 3, CPU_DISASSEMBLE_NAME(tms34010) },
328	328	{ "tms34020", _8bit, 3, CPU_DISASSEMBLE_NAME(tms34020) },
329		// { "tms57002", _32le, -2, CPU_DISASSEMBLE_NAME(tms57002) },
	329	// { "tms57002", _32le, -2, CPU_DISASSEMBLE_NAME(tms57002) },
330	330	{ "tms7000", _8bit, 0, CPU_DISASSEMBLE_NAME(tms7000) },
331	331	{ "upd7810", _8bit, 0, CPU_DISASSEMBLE_NAME(upd7810) },
332	332	{ "upd7807", _8bit, 0, CPU_DISASSEMBLE_NAME(upd7807) },

src/emu/cpu/powerpc/ppcdrc.c
r14798	r14799
3140	3140
3141	3141	UML_LABEL(block, compiler->labelnum++); // 2:
3142	3142	UML_DIVS(block, R32(G_RD(op)), R32(G_RD(op)), R32(G_RA(op)), R32(G_RB(op))); // divs rd,rd,ra,rb
3143		generate_compute_flags(ppc, block, desc, op & M_RC, ((op & M_OE) ? XER_OV : 0), FALSE);// <update flags>
	3143	generate_compute_flags(ppc, block, desc, op & M_RC, ((op & M_OE) ? XER_OV : 0), FALSE);// <update flags>
3144	3144
3145	3145	UML_LABEL(block, compiler->labelnum++); // 3:
3146	3146	return TRUE;

src/emu/machine/6526cia.c
r14798	r14799
13	13
14	14
15	15	//**************************************************************************
16		// MACROS / CONSTANTS
	16	// MACROS / CONSTANTS
17	17	//**************************************************************************
18	18
19	19	/* CIA registers */

src/version.c
r14798	r14799
38	38	***************************************************************************/
39	39
40	40	extern const char build_version[];
41		const char build_version[] = "0.145u4 ("__DATE__")";
	41	const char build_version[] = "0.145u5 ("__DATE__")";

15994 Revisions