New systems marked not working

------------------------------
Ming Xing San Que Yi (China) [dyq, little0, Guru]

- igs/igs_m027.cpp: trojaned internal ROMs for cjddzlf, lhzb3unk, lhzb3unk2 [Guru]
This commit is contained in:
Ivan Vangelista 2024-10-15 18:08:54 +02:00
parent 92c7df4114
commit 4868456890
5 changed files with 336 additions and 11 deletions

View file

@ -29,10 +29,8 @@
TODO:
* I/O for remaining games
* Coin lockout (zhongguo displays a coin error on unexpected coins)
* Verify I/O hasn't changed between versions of cjddz (current based on V215CN)
* Verify I/O hasn't changed between versions of lhzb3 (current based on V400CN).
(once the other versions work)
* Verify I/O hasn't changed between versions of lhzb4 (current based on V104CN)
*/
#include "emu.h"
@ -129,6 +127,7 @@ public:
void init_tripslot() ATTR_COLD;
void init_extradrw() ATTR_COLD;
void init_chessc2() ATTR_COLD;
void init_cjddzlf() ATTR_COLD;
protected:
virtual void machine_start() override ATTR_COLD;
@ -2365,8 +2364,7 @@ ROM_END
ROM_START( lhzb3unk )
ROM_REGION( 0x04000, "maincpu", 0 )
// Internal ROM of IGS027A type G ARM based MCU
// stickered u10. Doesn't seem to be compatible with the lhzb3 dump. Needs trojan.
ROM_LOAD( "u10_027a.bin", 0x00000, 0x4000, NO_DUMP )
ROM_LOAD( "u10_027a.bin", 0x00000, 0x4000, CRC(19df9d4f) SHA1(d7e5be300220674ea6244242e06fb1929cbbb54f) ) // u10 is the sticker, not the location
ROM_REGION32_LE( 0x200000, "user1", 0 ) // external ARM data / prg
ROM_LOAD( "106c5n.u27", 0x000000, 0x200000, CRC(86031487) SHA1(d7bfe102ef4248e692d653edd479392ed7e20c28) ) // 11xxxxxxxxxxxxxxxxxxx = 0xFF
@ -2381,14 +2379,15 @@ ROM_START( lhzb3unk )
ROM_LOAD( "igs_s2402.u26", 0x000000, 0x200000, CRC(84bc2f3e) SHA1(49dcf5eaa39accd5c6bf01782fd4221298cb43ed) ) // 1ST AND 2ND HALF IDENTICAL
ROM_END
// This board is a bit different to the others. Main osc is 22.1184MHz
// This board is a bit different to the others. Main OSC is 22.1184MHz.
// Everything is the same except no IGS027A. Instead there is a QFP128 chip in the place where the 027A would be.
// It's clear this is a 027A replacement. The PCB still has the silk-screening for the pin numbers on the 027A but no QFP pads for it.
// Only the QFP128 chip is there. With external program ROM removed and powered on, it only shows garbage.
// In general the PCB seems a bit cheaply done if compared to other, almost bootleg-ish.
ROM_START( lhzb3unk2 ) // sent as Long Hu Zheng Ba 3 Upgrade Version
ROM_REGION( 0x04000, "maincpu", 0 )
// Internal ROM of IGS027A sub (if there is one)
ROM_LOAD( "lhzb3unk2_igs027a", 0x00000, 0x4000, NO_DUMP )
// Internal ROM of IGS027A sub
ROM_LOAD( "lhzb3unk2_igs027a", 0x00000, 0x4000, CRC(c713e8c6) SHA1(b0c57173b693ae54bd820a24fede1d008f90dd28) )
ROM_REGION32_LE( 0x200000, "user1", 0 ) // external ARM data / prg
ROM_LOAD( "igs_p2401.u10", 0x000000, 0x80000, CRC(47d26b39) SHA1(85016799ee9cd2ccb905262a9ec7f0dee0d6537e) ) // 11xxxxxxxxxxxxxxxxxxx = 0xFF
@ -2901,7 +2900,7 @@ ROM_END
ROM_START( cjddzlf )
ROM_REGION( 0x04000, "maincpu", 0 )
// Internal ROM of IGS027A ARM based MCU
ROM_LOAD( "cjddz215cn_igs027a", 0x00000, 0x4000, CRC(124f4bee) SHA1(bf9785516ef36290c2a7bac307bb2d849f2045ae) ) // unknown sticker
ROM_LOAD( "j1_igs027a", 0x00000, 0x4000, CRC(9f6e0207) SHA1(8c3dd1fdb847353060b55108431b8ef1649ed266) )
ROM_REGION32_LE( 0x80000, "user1", 0 ) // external ARM data / prg
ROM_LOAD( "igs_l2405.u17", 0x000000, 0x80000, CRC(ec310408) SHA1(acf7998017b86fff8b515f239459fff0c1eb43b6) )
@ -3209,6 +3208,14 @@ void igs_m027_state::init_chessc2()
ROM2[(0x168/4)] ^= 0x10000000;
}
void igs_m027_state::init_cjddzlf()
{
cjddzlf_decrypt(machine());
m_igs017_igs031->sdwx_gfx_decrypt();
m_igs017_igs031->tarzan_decrypt_sprites(0x400000, 0x400000);
}
} // anonymous namespace
@ -3224,6 +3231,8 @@ GAME( 1999, qlgs, 0, qlgs, qlgs, igs_m027_stat
GAME( 1999, lhdmg, 0, lhdmg, lhdmg, igs_m027_state, init_lhdmg, ROT0, "IGS", "Long Hu Da Manguan (V102C3M)", 0 )
GAME( 1999, lhdmgp, 0, lhdmg, lhdmg, igs_m027_state, init_lhdmg, ROT0, "IGS", "Long Hu Da Manguan Duizhan Jiaqiang Ban (V400C3M)", 0 )
GAME( 1999, lhzb3, 0, lhdmg, lhzb3, igs_m027_state, init_lhdmg, ROT0, "IGS", "Long Hu Zhengba III (V400CN)", 0 )
GAME( 1999, lhzb3unk, lhzb3, lhdmg, lhzb3, igs_m027_state, init_slqz3, ROT0, "IGS", "Long Hu Zhengba III (unknown version, set 1)", MACHINE_NOT_WORKING ) // decryption masks not totally correct?
GAME( 1999, lhzb3unk2, lhzb3, lhdmg, lhzb3, igs_m027_state, init_slqz3, ROT0, "IGS", "Long Hu Zhengba III (unknown version, set 2)", MACHINE_NOT_WORKING ) // decryption masks not totally correct?
GAME( 2004, lhzb4, 0, lhzb4, lhzb4, igs_m027_state, init_lhzb4, ROT0, "IGS", "Long Hu Zhengba 4 (V104CN)", 0 )
GAME( 2004, lhzb4dhb, 0, lhzb4, lhzb4, igs_m027_state, init_lhzb4, ROT0, "IGS", "Long Hu Zhengba 4 Dui Hua Ban (V203CN)", 0 )
GAME( 1999, lthyp, 0, lthyp, lthyp, igs_m027_state, init_lthyp, ROT0, "IGS", "Long Teng Hu Yao Duizhan Jiaqiang Ban (S104CN)", MACHINE_NODEVICE_LAN )
@ -3240,6 +3249,7 @@ GAME( 200?, cjddz, 0, cjddz, cjddz, igs_m027_stat
GAME( 200?, cjddz217cn, cjddz, cjddz, cjddz, igs_m027_state, init_cjddz, ROT0, "IGS", "Chaoji Dou Dizhu (V217CN)", 0 )
GAME( 200?, cjddz215cn, cjddz, cjddz, cjddz, igs_m027_state, init_cjddz, ROT0, "IGS", "Chaoji Dou Dizhu (V215CN)", 0 )
GAME( 200?, cjddzp, 0, cjddz, cjddzp, igs_m027_state, init_cjddzp, ROT0, "IGS", "Chaoji Dou Dizhu Jiaqiang Ban (S300CN)", MACHINE_NODEVICE_LAN )
GAME( 200?, cjddzlf, 0, cjddz, cjddz, igs_m027_state, init_cjddzlf, ROT0, "IGS", "Chaoji Dou Dizhu Liang Fu Pai (V109CN)", MACHINE_NOT_WORKING ) // needs I/O correcting
GAMEL( 2007, tripslot, 0, tripslot, tripslot, igs_m027_state, init_tripslot, ROT0, "IGS", "Triple Slot (V200VE)", 0, layout_tripslot ) // 2007 date in internal ROM at least, could be later, default settings password is all 'start 1'
// this has a 2nd 8255
GAME( 2001, extradrw, 0, extradrw, base, igs_m027_state, init_extradrw, ROT0, "IGS", "Extra Draw (V100VE)", MACHINE_NOT_WORKING )
@ -3255,8 +3265,5 @@ GAME( 200?, luckycrs, 0, m027_1ppi<false>, base, igs_m027_state
GAME( 2003, amazoni2, 0, m027_1ppi<false>, base, igs_m027_state, init_amazoni2, ROT0, "IGS", "Amazonia King II (V202BR)", MACHINE_NOT_WORKING )
GAME( 2002, sdwx, 0, m027_1ppi<false>, base, igs_m027_state, init_sdwx, ROT0, "IGS", "Sheng Dan Wu Xian", MACHINE_NOT_WORKING ) // aka Christmas 5 Line? (or Amazonia King II, shares roms at least?)
GAME( 200?, klxyj, 0, m027_1ppi<false>, base, igs_m027_state, init_klxyj, ROT0, "IGS", "Kuai Le Xi You Ji", MACHINE_NOT_WORKING )
GAME( 1999, lhzb3unk, lhzb3, m027_1ppi<false>, base, igs_m027_state, empty_init, ROT0, "IGS", "Long Hu Zhengba III (unknown version, set 1)", MACHINE_NOT_WORKING )
GAME( 1999, lhzb3unk2, lhzb3, m027_1ppi<false>, base, igs_m027_state, empty_init, ROT0, "IGS", "Long Hu Zhengba III (unknown version, set 2)", MACHINE_NOT_WORKING )
GAME( 200?, cjddzlf, 0, m027_1ppi<false>, base, igs_m027_state, empty_init, ROT0, "IGS", "Chaoji Dou Dizhu Liang Fu Pai", MACHINE_NOT_WORKING )
// these have an IGS025 protection device instead of the 8255
GAME( 200?, gonefsh2, 0, m027_noppi<false>,base, igs_m027_state, init_gonefsh2, ROT0, "IGS", "Gone Fishing 2", MACHINE_NOT_WORKING )

View file

@ -0,0 +1,291 @@
// license:BSD-3-Clause
// copyright-holders:
/*
IGS ARM7 (IGS027A) based mahjong / gambling platform(s),
with IGS customs normally used on PGM hardware.
Contrary to proper PGM hardware, these don't have a M68K.
Main components for the PCB-0457-03-GS are:
- IGS 027A (ARM7-based MCU)
- 33 MHz XTAL
- IGS 023 graphics chip
- ICS2115V Wavefront sound chip
- IGS 026B I/O chip
- 3 banks of 8 DIP switches
*/
#include "emu.h"
#include "igs027a.h"
#include "mahjong.h"
#include "pgmcrypt.h"
#include "machine/i8255.h"
#include "machine/nvram.h"
#include "machine/ticket.h"
#include "machine/timer.h"
#include "sound/ics2115.h"
#include "emupal.h"
#include "screen.h"
#include "speaker.h"
#include "endianness.h"
#include <algorithm>
namespace {
class igs_m027_023vid_state : public driver_device
{
public:
igs_m027_023vid_state(const machine_config &mconfig, device_type type, const char *tag) :
driver_device(mconfig, type, tag),
m_external_rom(*this, "user1"),
m_nvram(*this, "nvram"),
m_maincpu(*this, "maincpu"),
m_screen(*this, "screen")
{ }
void m027_023vid(machine_config &config) ATTR_COLD;
void init_mxsqy() ATTR_COLD;
protected:
virtual void machine_start() override ATTR_COLD;
private:
required_region_ptr<u32> m_external_rom;
required_shared_ptr<u32> m_nvram;
required_device<igs027a_cpu_device> m_maincpu;
required_device<screen_device> m_screen;
u32 m_xor_table[0x100];
u32 external_rom_r(offs_t offset);
void xor_table_w(offs_t offset, u8 data);
u32 screen_update(screen_device &screen, bitmap_ind16 &bitmap, const rectangle &cliprect);
void m027_map(address_map &map) ATTR_COLD;
};
void igs_m027_023vid_state::machine_start()
{
std::fill(std::begin(m_xor_table), std::end(m_xor_table), 0);
save_item(NAME(m_xor_table));
}
u32 igs_m027_023vid_state::screen_update(screen_device &screen, bitmap_ind16 &bitmap, const rectangle &cliprect)
{
return 0;
}
/***************************************************************************
Memory Maps
***************************************************************************/
void igs_m027_023vid_state::m027_map(address_map &map)
{
map(0x0800'0000, 0x0807'ffff).r(FUNC(igs_m027_023vid_state::external_rom_r)); // Game ROM
map(0x1800'0000, 0x1800'7fff).ram().mirror(0x0000f'8000).share(m_nvram);
map(0x5000'0000, 0x5000'03ff).umask32(0x0000'00ff).w(FUNC(igs_m027_023vid_state::xor_table_w)); // uploads XOR table to external ROM here
}
/***************************************************************************
Input Ports
***************************************************************************/
INPUT_PORTS_START( base )
PORT_START("CLEARMEM")
PORT_BIT( 0x01, IP_ACTIVE_LOW, IPT_MEMORY_RESET ) PORT_TOGGLE
PORT_START("DSW1")
PORT_DIPUNKNOWN_DIPLOC( 0x01, 0x01, "SW1:1" )
PORT_DIPUNKNOWN_DIPLOC( 0x02, 0x02, "SW1:2" )
PORT_DIPUNKNOWN_DIPLOC( 0x04, 0x04, "SW1:3" )
PORT_DIPUNKNOWN_DIPLOC( 0x08, 0x08, "SW1:4" )
PORT_DIPUNKNOWN_DIPLOC( 0x10, 0x10, "SW1:5" )
PORT_DIPUNKNOWN_DIPLOC( 0x20, 0x20, "SW1:6" )
PORT_DIPUNKNOWN_DIPLOC( 0x40, 0x40, "SW1:7" )
PORT_DIPUNKNOWN_DIPLOC( 0x80, 0x80, "SW1:8" )
PORT_START("DSW2")
PORT_DIPUNKNOWN_DIPLOC( 0x01, 0x01, "SW2:1" )
PORT_DIPUNKNOWN_DIPLOC( 0x02, 0x02, "SW2:2" )
PORT_DIPUNKNOWN_DIPLOC( 0x04, 0x04, "SW2:3" )
PORT_DIPUNKNOWN_DIPLOC( 0x08, 0x08, "SW2:4" )
PORT_DIPUNKNOWN_DIPLOC( 0x10, 0x10, "SW2:5" )
PORT_DIPUNKNOWN_DIPLOC( 0x20, 0x20, "SW2:6" )
PORT_DIPUNKNOWN_DIPLOC( 0x40, 0x40, "SW2:7" )
PORT_DIPUNKNOWN_DIPLOC( 0x80, 0x80, "SW2:8" )
PORT_START("DSW3")
PORT_DIPUNKNOWN_DIPLOC( 0x01, 0x01, "SW3:1" )
PORT_DIPUNKNOWN_DIPLOC( 0x02, 0x02, "SW3:2" )
PORT_DIPUNKNOWN_DIPLOC( 0x04, 0x04, "SW3:3" )
PORT_DIPUNKNOWN_DIPLOC( 0x08, 0x08, "SW3:4" )
PORT_DIPUNKNOWN_DIPLOC( 0x10, 0x10, "SW3:5" )
PORT_DIPUNKNOWN_DIPLOC( 0x20, 0x20, "SW3:6" )
PORT_DIPUNKNOWN_DIPLOC( 0x40, 0x40, "SW3:7" )
PORT_DIPUNKNOWN_DIPLOC( 0x80, 0x80, "SW3:8" )
PORT_START("PORTB") // buttons?
PORT_DIPNAME( 0x01, 0x01, "PORTB")
PORT_DIPSETTING( 0x01, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x02, 0x02, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x02, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x04, 0x04, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x04, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x08, 0x08, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x08, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x10, 0x10, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x10, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x20, 0x20, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x20, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x40, 0x40, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x40, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x80, 0x80, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x80, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_START("PORTC") // buttons?
PORT_DIPNAME( 0x01, 0x01, "PORTC")
PORT_DIPSETTING( 0x01, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x02, 0x02, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x02, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x04, 0x04, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x04, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x08, 0x08, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x08, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x10, 0x10, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x10, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x20, 0x20, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x20, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x40, 0x40, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x40, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
PORT_DIPNAME( 0x80, 0x80, DEF_STR( Unknown ) )
PORT_DIPSETTING( 0x80, DEF_STR( Off ) )
PORT_DIPSETTING( 0x00, DEF_STR( On ) )
INPUT_PORTS_END
/***************************************************************************
Machine Drivers
***************************************************************************/
u32 igs_m027_023vid_state::external_rom_r(offs_t offset)
{
return m_external_rom[offset] ^ m_xor_table[offset & 0x00ff];
}
void igs_m027_023vid_state::xor_table_w(offs_t offset, u8 data)
{
m_xor_table[offset] = (u32(data) << 24) | (u32(data) << 8);
}
void igs_m027_023vid_state::m027_023vid(machine_config &config)
{
IGS027A(config, m_maincpu, 33_MHz_XTAL);
m_maincpu->set_addrmap(AS_PROGRAM, &igs_m027_023vid_state::m027_map);
NVRAM(config, "nvram", nvram_device::DEFAULT_ALL_0);
SCREEN(config, m_screen, SCREEN_TYPE_RASTER);
m_screen->set_refresh_hz(60);
m_screen->set_vblank_time(ATTOSECONDS_IN_USEC(0));
m_screen->set_size(512, 256);
m_screen->set_visarea(0, 512-1, 0, 240-1);
m_screen->set_screen_update(FUNC(igs_m027_023vid_state::screen_update));
m_screen->set_palette("palette");
PALETTE(config, "palette", palette_device::BLACK).set_format(palette_device::xRGB_555, 0x1200/2);
// PGM video
// sound hardware
SPEAKER(config, "mono").front_center();
ICS2115(config, "ics", 33_MHz_XTAL);
}
/***************************************************************************
ROMs Loading
***************************************************************************/
ROM_START( mxsqy )
ROM_REGION( 0x04000, "maincpu", 0 )
// Internal ROM of IGS027A type G ARM based MCU
ROM_LOAD( "a8_027a.u41", 0x00000, 0x4000, CRC(f9ada8c4) SHA1(0715fdc3d15ae2d1af4e9c7d25f6410ae7c22d42) )
ROM_REGION32_LE( 0x80000, "user1", 0 ) // external ARM data / prg
ROM_LOAD( "igs_m2401.u39", 0x000000, 0x80000, CRC(32e69540) SHA1(e5bc44700ba965fae433c3b39afa95bc753e3f2a) )
ROM_REGION( 0x80000, "tiles", 0 )
ROM_LOAD( "igs_l2405.u38", 0x00000, 0x80000, CRC(2f20eade) SHA1(aa11d26cb51483af5fdd4b181dff0f222baeaaff) )
ROM_REGION16_LE( 0x400000, "sprcol", 0 )
ROM_LOAD( "igs_l2404.u23", 0x000000, 0x400000, CRC(dc8ff7ae) SHA1(4609b5543d8bea7a8dea4e744f81c407688a96ee) ) // FIXED BITS (xxxxxxxx0xxxxxxx)
ROM_REGION16_LE( 0x400000, "sprmask", 0 )
ROM_LOAD( "igs_m2403.u22", 0x000000, 0x400000, CRC(53940332) SHA1(3c703cbdc51dfb100f3ce10452a81091305dee01) )
ROM_REGION( 0x400000, "ics", 0 )
ROM_LOAD( "igs_s2402.u21", 0x000000, 0x400000, CRC(a3e3b2e0) SHA1(906e5839ab62e570d9716e01b49e5b067e041269) )
ROM_END
void igs_m027_023vid_state::init_mxsqy()
{
luckycrs_decrypt(machine());
}
} // anonymous namespace
/***************************************************************************
Game Drivers
***************************************************************************/
GAME( 200?, mxsqy, 0, m027_023vid, base, igs_m027_023vid_state, init_mxsqy, ROT0, "IGS", "Ming Xing San Que Yi (China)", MACHINE_IS_SKELETON )

View file

@ -1897,3 +1897,26 @@ void extradrw_decrypt(running_machine &machine)
src[i] ^= x;
}
}
void cjddzlf_decrypt(running_machine &machine)
{
memory_region *const region = machine.root_device().memregion("user1");
auto const src = util::little_endian_cast<u16>(reinterpret_cast<u32 *>(region->base()));
auto const rom_size = region->bytes();
for (int i = 0; i < rom_size / 2; i++)
{
uint16_t x = 0;
IGS27_CRYPT1_ALT
IGS27_CRYPT2
IGS27_CRYPT3_ALT2
IGS27_CRYPT4
IGS27_CRYPT5_ALT
IGS27_CRYPT6
IGS27_CRYPT7
IGS27_CRYPT8
src[i] ^= x;
}
}

View file

@ -60,5 +60,6 @@ void lthyp_decrypt(running_machine &machine);
void lhdmg_decrypt(running_machine &machine);
void tripslot_decrypt(running_machine &machine);
void extradrw_decrypt(running_machine &machine);
void cjddzlf_decrypt(running_machine &machine);
#endif // MAME_IGS_PGMCRYPT_H

View file

@ -20357,6 +20357,9 @@ sdwx // (c) 2002
slqz3 // (c) 1999
zhongguo // (c) 2000
@source:igs/igs_m027_023vid.cpp
mxsqy // (c) 200?
@source:igs/igs_m027_link.cpp
cjslh
cjsll