New clones marked not working

-----------------------------
Zero Team (Japan?, earlier?, set 2) [nnap]

- midway/mcr3.cpp: dumped pls153 PLDs for sarge [Domenico Cervini]

- misc/cointek.cpp: possibly descrambled audio CPU ROM
This commit is contained in:
Ivan Vangelista 2023-08-29 17:22:47 +02:00
parent 46c56ddff8
commit d023693d65
4 changed files with 79 additions and 15 deletions

View file

@ -40429,6 +40429,7 @@ zeroteama // (c) 1993 Seibu Kaihatsu
zeroteamb // (c) 1993 Seibu Kaihatsu
zeroteamc // (c) 1993 Seibu Kaihatsu + Liang Hwa license
zeroteamd // (c) 1993 Seibu Kaihatsu + Dreamsoft license
zeroteame // (c) 1993 Seibu Kaihatsu
zeroteams // (c) 1993 Seibu Kaihatsu
zeroteamsr // (c) 1993 Seibu Kaihatsu

View file

@ -1271,14 +1271,14 @@ ROM_START( sarge )
ROM_LOAD( "spr_5e.bin", 0x10000, 0x8000, CRC(c832375c) SHA1(dfb7782b13e1e959e0ecd5da771cd38962f6952b) )
ROM_LOAD( "spr_4e.bin", 0x18000, 0x8000, CRC(c382267d) SHA1(6b459e9ec7948a529b5308357851a0bede085aef) )
ROM_REGION( 0x0007, "pals", 0) /* PAL's located on the Mono Board (91787) */
ROM_LOAD( "a59a26axlcxhd.13j.bin", 0x0000, 0x0001, NO_DUMP ) /* PLS153N */
ROM_LOAD( "a59a26axlbxhd.2j.bin", 0x0000, 0x0001, NO_DUMP ) /* PLS153N */
ROM_LOAD( "a59a26axlaxhd.3j.bin", 0x0000, 0x0001, NO_DUMP ) /* PLS153N */
ROM_LOAD( "0066-314bx-xxqx.6h.bin", 0x0000, 0x0001, NO_DUMP ) /* Unknown PAL Type */
ROM_LOAD( "0066-316bx-xxqx.5h.bin", 0x0000, 0x0001, NO_DUMP ) /* Unknown PAL Type */
ROM_LOAD( "0066-315bx-xxqx.5g.bin", 0x0000, 0x0001, NO_DUMP ) /* Unknown PAL Type */
ROM_LOAD( "0066-313bx-xxqx.4g.bin", 0x0000, 0x0001, NO_DUMP ) /* Unknown PAL Type */
ROM_REGION( 0x301, "pals", ROMREGION_ERASE00) /* PAL's located on the Mono Board (91787) */
ROM_LOAD( "a59a26axlcxhd.13j.bin", 0x0000, 0x00eb, CRC(d4203273) SHA1(59fde5850ad55e257f10db857dfb9a1e929fc1ec) ) /* PLS153N */
ROM_LOAD( "a59a26axlbxhd.2j.bin", 0x0100, 0x00eb, CRC(f857b484) SHA1(15e548deed33f3897bcf99bfb6f89e213993e0bc) ) /* PLS153N */
ROM_LOAD( "a59a26axlaxhd.3j.bin", 0x0200, 0x00eb, CRC(4f54e696) SHA1(dee1394368c0b19a10164db06e9c4215ffdc3be0) ) /* PLS153N */
ROM_LOAD( "0066-314bx-xxqx.6h.bin", 0x0300, 0x0001, NO_DUMP ) /* Unknown PAL Type */
ROM_LOAD( "0066-316bx-xxqx.5h.bin", 0x0300, 0x0001, NO_DUMP ) /* Unknown PAL Type */
ROM_LOAD( "0066-315bx-xxqx.5g.bin", 0x0300, 0x0001, NO_DUMP ) /* Unknown PAL Type */
ROM_LOAD( "0066-313bx-xxqx.4g.bin", 0x0300, 0x0001, NO_DUMP ) /* Unknown PAL Type */
ROM_END

View file

@ -23,14 +23,17 @@ The daughter card has a big box on it labelled as follows:
The daughter board is connected to the main board via 40 pin socket.
TODO:
- decryption is only preliminary (?). The game puts some strings at 0xc000 and at 0xf810. At 0xf810 it puts 'MICRO' and then it expects to read 'DRAGON', if it doesn't it loops endlessly;
- after decryption is completed, everything else.
- Decryption may be incomplete, though code flow looks sane both for the main CPU and the audio CPU.
- The game puts some strings at 0xc000 and at 0xf810. At 0xf810 it puts 'MICRO' in DPRAM and then it expects to read 'DRAGON' (put in DPRAM by the audio CPU),
if it doesn't it loops endlessly. For reasons to be investigated the audio CPU puts it at a slightly wrong offset.
- HD63310 seems to have more features than the DPRAM chips emulated in machine/mb8421.cpp. Maybe reason for the above problem?
*/
#include "emu.h"
#include "cpu/z80/z80.h"
#include "machine/i8255.h"
#include "machine/mb8421.h"
#include "sound/ymopl.h"
#include "emupal.h"
@ -43,7 +46,8 @@ class cointek_state : public driver_device
{
public:
cointek_state(const machine_config &mconfig, device_type type, const char *tag)
: driver_device(mconfig, type, tag)
: driver_device(mconfig, type, tag),
m_decrypted_opcodes(*this, "decrypted_opcodes")
{
}
@ -52,9 +56,12 @@ public:
void init_unkct();
private:
required_shared_ptr<uint8_t> m_decrypted_opcodes;
uint32_t screen_update(screen_device &screen, bitmap_ind16 &bitmap, const rectangle &cliprect);
void audio_io_map(address_map &map);
void audio_opcodes_map(address_map &map);
void audio_prg_map(address_map &map);
void io_map(address_map &map);
void prg_map(address_map &map);
@ -69,7 +76,8 @@ void cointek_state::prg_map(address_map &map)
{
map(0x0000, 0xbfff).rom(); // banking?
map(0xc000, 0xc7ff).ram();
map(0xf800, 0xffff).ram();
map(0xf800, 0xfbff).rw("dpram", FUNC(idt7130_device::right_r), FUNC(idt7130_device::right_w));
map(0xfc00, 0xffff).ram();
}
void cointek_state::io_map(address_map &map)
@ -79,10 +87,18 @@ void cointek_state::io_map(address_map &map)
void cointek_state::audio_prg_map(address_map &map)
{
map(0x0000, 0x7fff).rom();
map(0x8000, 0x87ff).ram();
}
void cointek_state::audio_opcodes_map(address_map &map)
{
map(0x0000, 0x7fff).rom().share(m_decrypted_opcodes);
}
void cointek_state::audio_io_map(address_map &map)
{
//map(0x0040, 0x0043).rw("ppi3", FUNC(i8255_device::read), FUNC(i8255_device::write));
//map(0x8000, 0x80ff).rw("dpram", FUNC(idt7130_device::left_r), FUNC(idt7130_device::left_w)); // TODO: seems to write the required DRAGON string here but in the wrong place. And why only 0x100?
}
@ -146,13 +162,17 @@ void cointek_state::cointek(machine_config &config)
z80_device &audiocpu(Z80(config, "audiocpu", 12_MHz_XTAL / 3)); // divisor guessed
audiocpu.set_addrmap(AS_PROGRAM, &cointek_state::audio_prg_map);
audiocpu.set_addrmap(AS_OPCODES, &cointek_state::audio_opcodes_map);
audiocpu.set_addrmap(AS_IO, &cointek_state::audio_io_map);
audiocpu.set_disable(); // TODO: disabled for now to avoid clogging the error log
I8255(config, "ppi1");
I8255(config, "ppi2");
I8255(config, "ppi3");
IDT7130(config, "dpram"); // actually HD63310P20
//dpram.intr_callback().set_inputline("audiocpu", 0);
//dpram.intl_callback().set_inputline("maincpu", 0);
// all wrong
screen_device &screen(SCREEN(config, "screen", SCREEN_TYPE_RASTER));
screen.set_refresh_hz(60);
@ -224,9 +244,14 @@ void cointek_state::init_unkct()
{
uint8_t *rom = memregion("maincpu")->base();
for (int i = 0; i < 0x10000; i++) // TODO: This is only enough to show some strings, but the encryption is conditional, possibly based on addresses. The second ROM is also conditionally scrambled.
for (int i = 0; i < 0x10000; i++) // TODO: seems good but needs verifying
if (!(i & 0x1000))
rom[i] = bitswap<8>(rom[i], 7, 6, 3, 4, 5, 2, 1, 0);
uint8_t *audiorom = memregion("audiocpu")->base();
for (int i = 0; i < 0x8000; i++) // TODO: seems good but needs verifying
m_decrypted_opcodes[i] = bitswap<8>(audiorom[i], 0, 6, 5, 4, 3, 2, 1, 7);
}
} // anonymous namespace

View file

@ -2873,6 +2873,43 @@ ROM_START( zeroteamd ) // Dream Soft, Korea licensee, no special word under logo
ROM_END
// A version of the above exists (which dr.kitty used to own) which DOES have 'Korea' under the logo on title, needs dumping
ROM_START( zeroteame ) // shares chars ROMs with zeroteama
ROM_REGION( 0x200000, "maincpu", 0 ) /* v30 main cpu */
ROM_LOAD32_BYTE("seibu_1_u024.5k", 0x000000, 0x40000, CRC(76e69af5) SHA1(c5a4b2491cee3f4f9694e454f3828fda33fff3ab) )
ROM_LOAD32_BYTE("seibu_3_u023.6k", 0x000002, 0x40000, CRC(4a904880) SHA1(4a85a62446ea11d57369dfd65f143475063abc31) )
ROM_LOAD32_BYTE("seibu_2_u025.6l", 0x000001, 0x40000, CRC(b97ab448) SHA1(82d9e7aa6b69c214ad82e5ff30a049cecab607c0) )
ROM_LOAD32_BYTE("seibu_4_u026.5l", 0x000003, 0x40000, CRC(1d43b9c1) SHA1(b1144d49f8fddf416fe2e3eae4040b369eb212cf) )
ROM_REGION( 0x40000, "user2", 0 ) /* COPX */
ROM_LOAD( "copx-d2.u0313.6n", 0x00000, 0x40000, CRC(a6732ff9) SHA1(c4856ec77869d9098da24b1bb3d7d58bb74b4cda) )
ROM_REGION( 0x20000, "audiocpu", ROMREGION_ERASEFF ) /* 64k code for sound Z80 */
ROM_LOAD( "seibu_5_u1110.5b", 0x000000, 0x08000, CRC(efc484ca) SHA1(c34b8e3e7f4c2967bc6414348993478ed637d338) )
ROM_CONTINUE(0x10000,0x8000)
ROM_COPY( "audiocpu", 0x000000, 0x018000, 0x08000 )
ROM_REGION( 0x020000, "gfx1", 0 ) /* chars */
ROM_LOAD16_BYTE( "seibu_7_u072.5s", 0x000000, 0x010000, CRC(eb10467f) SHA1(fc7d576dc41bc878ff20f0370e669e19d54fcefb) )
ROM_LOAD16_BYTE( "seibu_8_u077.5r", 0x000001, 0x010000, CRC(a0b2a09a) SHA1(9b1f6c732000b84b1ad635f332ebead5d65cc491) )
ROM_REGION( 0x400000, "gfx2", 0 ) /* background gfx */
ROM_LOAD( "musha_back-1.u075.4s", 0x000000, 0x100000, CRC(8b7f9219) SHA1(3412b6f8a4fe245e521ddcf185a53f2f4520eb57) )
ROM_LOAD( "musha_back-2.u0714.2s", 0x100000, 0x080000, CRC(ce61c952) SHA1(52a843c8ba428b121fab933dd3b313b2894d80ac) )
ROM_REGION32_LE( 0x800000, "gfx3", ROMREGION_ERASEFF ) /* sprite gfx (encrypted) (diff encrypt to raiden2? ) */
ROM_LOAD32_WORD( "musha_obj-1.u0811.6f", 0x000000, 0x200000, CRC(45be8029) SHA1(adc164f9dede9a86b96a4d709e9cba7d2ad0e564) )
ROM_LOAD32_WORD( "musha_obj-2.u082.5f", 0x000002, 0x200000, CRC(cb61c19d) SHA1(151a2ce9c32f3321a974819e9b165dddc31c8153) )
ROM_REGION( 0x100000, "oki", 0 ) /* ADPCM samples */
ROM_LOAD( "seibu_6_u105.4a", 0x00000, 0x40000, CRC(48be32b1) SHA1(969d2191a3c46871ee8bf93088b3cecce3eccf0c) ) // 6.bin
ROM_REGION( 0x10000, "pals", 0 ) /* PALS */
ROM_LOAD( "v3c001.pal.u0310", 0x0000, 0x288, NO_DUMP) // located UNDER v3c004x, unknown pal type
ROM_LOAD( "v3c002.tibpal16l8-25.u0322", 0x0000, 0x288, NO_DUMP)
ROM_LOAD( "v3c003.ami18cv8p-15.u0619", 0x0000, 0x288, NO_DUMP)
ROM_LOAD( "v3c004x.ami18cv8pc-25.u0310", 0x0000, 0x288, NO_DUMP) // located piggybacking on v3c001 and attached to some rework wires
ROM_END
ROM_START( zeroteams ) // No license, displays 'Selection' under logo
ROM_REGION( 0x200000, "maincpu", 0 ) /* v30 main cpu */
ROM_LOAD32_BYTE("1_sel.bin", 0x000000, 0x40000, CRC(d99d6273) SHA1(21dccd5d71c720b8364406835812b3c9defaff6c) )
@ -3220,10 +3257,11 @@ GAME( 1994, raidendxch, raidendx, raidendx, raidendx, raiden2_state, init_raiden
// Zero Team sets
GAME( 1993, zeroteam, 0, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu (Fabtek license)", "Zero Team USA (US)", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING )
GAME( 1993, zeroteama, zeroteam, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu", "Zero Team (Japan?, earlier?)", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING )
GAME( 1993, zeroteama, zeroteam, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu", "Zero Team (Japan?, earlier?, set 1)", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING )
GAME( 1993, zeroteamb, zeroteam, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu", "Zero Team (Japan?, later batteryless)", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING ) // reprograms the sprite decrypt data of the SEI251 on every boot, like raiden2 does. hack?
GAME( 1993, zeroteamc, zeroteam, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu (Liang Hwa license)", "Zero Team (Taiwan)", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING )
GAME( 1993, zeroteamd, zeroteam, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu (Dream Soft license)", "Zero Team (Korea)", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING )
GAME( 1993, zeroteame, zeroteam, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu", "Zero Team (Japan?, earlier?, set 2)", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING )
GAME( 1993, zeroteams, zeroteam, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu", "Zero Team Selection", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING )
GAME( 1993, zeroteamsr, zeroteam, zeroteam, zeroteam, raiden2_state, init_zeroteam, ROT0, "Seibu Kaihatsu", "Zero Team Suicide Revival Kit", MACHINE_SUPPORTS_SAVE | MACHINE_NOT_WORKING ) // reprograms the sprite decrypt data of the SEI251 only, no game code