Miroirs/mame
1
0
Fork 0
mirror of https://github.com/mamedev/mame.git synced 2024-11-16 07:48:32 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
mame/attic/fddebug.cpp

2439 lines
84 KiB
C++
Raw Permalink Blame History

// license:BSD-3-Clause
// copyright-holders:Aaron Giles
#include <functional>
#include "emu.h"
#include "machine/fddebug.h"
void fd1094_init_debugging(running_machine &machine, const char *cpureg, const char *keyreg, const char *statreg, void (*changed)(running_machine &))
{
}
#if 0
/***************************************************************************
fddebug.c
FD1094 decryption helper routines.
****************************************************************************
When searching for new keys, here are some common sequences in the
System 16B games that are useful.
IRQ4 handler entry points:
common sequence 1:
MOVE SR,(A7) 40D7
MOVE.B #$23,(A7) 1EBC 0023
MOVEM.L D0-D7/A0-A6,-(A7) 48E7 FFFE
common sequence 2:
MOVEM.L D0-D7/A0-A6,-(A7) 48E7 FFFE
common sequence 3:
BRA.W <previous sequence> 6000 xxxx
IRQ4 handler exit points:
common sequence (often appears twice nearby):
MOVE (A7)+,D0-D7/A0-A6 4CDF 7FFF
RTE 4E73
Entry points:
common sequence 1:
LEA <stack>.L,A7 4FF9 xxxx xxxx
MOVE #$2700,SR 46FC 2700
CMPI.L #$00xxffff,D0 0C80 00xx FFFF
MOVEQ #0,D0
MOVE.L D0,D1 2200
MOVE.L D0,D2 2400
MOVE.L D0,D3 2600
MOVE.L D0,D4 2800
MOVE.L D0,D5 2A00
MOVE.L D0,D6 2C00
MOVE.L D0,D7 2E00
common sequence 2:
LEA <stack>.W,A7 4FF8 xxxx
MOVE #$2700,SR 46FC 2700
CMPI.L #$00xxffff,D0 0C80 00xx FFFF
MOVEQ #0,D0
MOVE.L D0,D1 2200
MOVE.L D0,D2 2400
MOVE.L D0,D3 2600
MOVE.L D0,D4 2800
MOVE.L D0,D5 2A00
MOVE.L D0,D6 2C00
MOVE.L D0,D7 2E00
common sequence 3:
LEA <stack>.W,A7 4FF8 xxxx
MOVE #$2700,SR 46FC 2700
MOVEQ #0,D0
MOVE.L D0,D1 2200
MOVE.L D0,D2 2400
MOVE.L D0,D3 2600
MOVE.L D0,D4 2800
MOVE.L D0,D5 2A00
MOVE.L D0,D6 2C00
MOVE.L D0,D7 2E00
common sequence 4:
BRA.W <previous sequence> 6000 xxxx
****************************************************************************
These constraints worked for finding exctleag's seed:
fdcset 0410,4ff9
fdcset 0412,0000
fdcset 0414,0000
fdcset 0416,46fc
fdcset 0418,2700
fdcset 041a,0c80
fdcset 041c,0000,ff00
fdcset 041e,ffff
//fdcset 0f9e,40d7,ffff,irq
fdcset 0fa0,1ebc,ffff,irq
fdcset 0fa2,0023,ffff,irq
//fdcset 0fa4,48e7,ffff,irq
fdcset 0fa6,fffe,ffff,irq
fdcset 0fa8,13f8,ffff,irq
fdcset 0fac,00c4,ffff,irq
fdcset 0fae,0001,ffff,irq
//fdcset 1060,4cdf,ffff,irq
fdcset 1062,7fff,ffff,irq
//fdcset 1064,4e73,ffff,irq
//fdcset 1070,4cdf,ffff,irq
fdcset 1072,7fff,ffff,irq
//fdcset 1074,4e73,ffff,irq
****************************************************************************
Add something like this to debug_view_memory::write
// hack for FD1094 editing
#ifdef FD1094_HACK
if (source.m_base == machine().root_device().memregion("user2"))
{
extern void fd1094_regenerate_key(running_machine &machine);
fd1094_regenerate_key(machine());
}
#endif
***************************************************************************/
#include "emu.h"
#include "machine/fd1094.h"
#include "cpu/m68000/m68000.h"
#include "debug/debugcmd.h"
#include "debug/debugcon.h"
#include "debug/debugcpu.h"
#include "debug/debugvw.h"
#include "machine/fddebug.h"
/***************************************************************************
CONSTANTS
***************************************************************************/
#define KEY_SIZE 8192
#define MAX_CONSTRAINTS 100
#define MAX_SEARCH_DEPTH 10000
/* status byte breakdown */
#define STATE_MASK 0xff00
#define HIBITS_MASK 0x00c0
#define SEARCH_MASK 0x0020
#define STATUS_MASK 0x001f
/* possible status values */
#define STATUS_UNVISITED 0x00
#define STATUS_LOCKED 0x01
#define STATUS_NOCHANGE 0x02
#define STATUS_GUESS 0x03
/* sizes for the opcode table */
#define SIZE_BYTE 1 /* single byte */
#define SIZE_WORD 2 /* single word */
#define SIZE_LONG 3 /* single long */
#define SIZE_BIT 4 /* single byte, limited to bit sizes (0-7) */
#define SIZE_MASK 7
/* operand sizes */
#define OF_SIZEMASK (SIZE_MASK << 0)
#define OF_BYTE (SIZE_BYTE << 0) /* byte size operation */
#define OF_WORD (SIZE_WORD << 0) /* word size operation */
#define OF_LONG (SIZE_LONG << 0) /* long size operation */
/* immediate sizes */
#define OF_ISIZEMASK (SIZE_MASK << 3)
#define OF_IMMB (SIZE_BYTE << 3) /* immediate byte follows */
#define OF_IMMW (SIZE_WORD << 3) /* immediate word follows */
#define OF_IMML (SIZE_LONG << 3) /* immediate long follows */
#define OF_IMMBIT (SIZE_BIT << 3) /* immediate byte follows */
/* other opcode flags */
#define OF_EASRC 0x00000040 /* standard EA is source */
#define OF_EADST 0x00000080 /* standard EA is destination */
#define OF_EADREG 0x00000100 /* EA with data register is allowed */
#define OF_EAAREG 0x00000200 /* EA with address register is allowed */
#define OF_EAA 0x00000400 /* EA with (An) is allowed */
#define OF_EAPLUS 0x00000800 /* EA with (An)+ is allowed */
#define OF_EAMINUS 0x00001000 /* EA with -(An) is allowed */
#define OF_EADISP 0x00002000 /* EA with (D,An) displacement is allowed */
#define OF_EAABS 0x00004000 /* EA with absolute (both word and long) is allowed */
#define OF_EAIMM 0x00008000 /* EA with immediate is allowed */
#define OF_EAPCR 0x00010000 /* EA with PC-relative addressing is allowed */
#define OF_RARE 0x00080000 /* opcode is not commonly used */
#define OF_BRANCH 0x00100000 /* opcode represents a branch */
#define OF_JMP 0x00200000 /* opcode represents a jmp/jsr */
#define OF_MOVE 0x00400000 /* opcode has MOVE semantics */
#define OF_LENMASK 0xf0000000 /* opcode length mask */
#define OF_INVALID 0xffffffff /* invalid opcode */
/***************************************************************************
TYPE DEFINITIONS
***************************************************************************/
/* a single possible instruction decoding */
struct fd1094_possibility
{
offs_t basepc; /* starting PC of the possibility */
int length; /* number of words */
uint8_t instrbuffer[10]; /* instruction data for disassembler */
uint8_t keybuffer[10]; /* array of key values to produce the instruction data */
uint8_t iffy; /* is this an iffy possibility? */
char dasm[256]; /* disassembly */
};
/* an entry in the opcode table */
struct optable_entry
{
uint32_t flags; /* per-opcode flags */
const char * string; /* identifying string */
};
/***************************************************************************
GLOBAL VARIABLES
***************************************************************************/
/* array of PCs not to stop at */
static uint8_t * ignorepc;
static uint8_t ignore_all;
/* array of information about each opcode */
static std::unique_ptr<optable_entry[]> optable;
/* buffer for undoing operations */
static uint8_t * undobuff;
/* array of possible instruction decodings */
static fd1094_possibility posslist[4*4*4*4*4];
static int posscount;
/* array of possible seeds */
static uint32_t * possible_seed;
/* array of constraints */
static fd1094_constraint constraints[MAX_CONSTRAINTS];
static int constcount;
/* stack of search addresses */
static uint32_t searchstack[MAX_SEARCH_DEPTH];
static int searchsp;
/* current key generation parameters */
static uint32_t fd1094_global;
static uint32_t fd1094_seed;
static uint8_t keydirty;
/* pointers to our data */
static uint16_t * coderegion;
static uint32_t coderegion_words;
static uint8_t * keyregion;
static uint16_t * keystatus;
static uint32_t keystatus_words;
/* key changed callback */
static void (*key_changed)(running_machine &);
/***************************************************************************
FUNCTION PROTOTYPES
***************************************************************************/
static void set_default_key_params(running_machine &machine);
static void load_overlay_file(running_machine &machine);
static void save_overlay_file(running_machine &machine);
static int instruction_hook(device_t &device, offs_t curpc);
static void execute_fdsave(running_machine &machine, int ref, int params, const char **param);
static void execute_fdoutput(running_machine &machine, int ref, int params, const char **param);
static void execute_fdseed(running_machine &machine, int ref, int params, const char **param);
static void execute_fdlockguess(running_machine &machine, int ref, int params, const char **param);
static void execute_fdeliminate(running_machine &machine, int ref, int params, const char **param);
static void execute_fdunlock(running_machine &machine, int ref, int params, const char **param);
static void execute_fdignore(running_machine &machine, int ref, int params, const char **param);
static void execute_fdundo(running_machine &machine, int ref, int params, const char **param);
static void execute_fdstatus(running_machine &machine, int ref, int params, const char **param);
static void execute_fdstate(running_machine &machine, int ref, int params, const char **param);
static void execute_fdpc(running_machine &machine, int ref, int params, const char **param);
static void execute_fdsearch(running_machine &machine, int ref, int params, const char **param);
static void execute_fddasm(running_machine &machine, int ref, int params, const char **param);
static void execute_fdcset(running_machine &machine, int ref, int params, const char **param);
static void execute_fdclist(running_machine &machine, int ref, int params, const char **param);
static void execute_fdcsearch(running_machine &machine, int ref, int params, const char **param);
static fd1094_possibility *try_all_possibilities(address_space &space, int basepc, int offset, int length, uint8_t *instrbuffer, uint8_t *keybuffer, fd1094_possibility *possdata);
static void tag_possibility(running_machine &machine, fd1094_possibility *possdata, uint8_t status);
static void perform_constrained_search(running_machine &machine);
static uint32_t find_global_key_matches(uint32_t startwith, uint16_t *output);
static int find_constraint_sequence(uint32_t global, int quick);
static int does_key_work_for_constraints(const uint16_t *base, uint8_t *key);
static uint32_t reconstruct_base_seed(int keybaseaddr, uint32_t startseed);
static void build_optable(running_machine &machine);
static int validate_ea(address_space &space, uint32_t pc, uint8_t modereg, const uint8_t *parambase, uint32_t flags);
static int validate_opcode(address_space &space, uint32_t pc, const uint8_t *opdata, int maxwords);
/***************************************************************************
INLINE FUNCTIONS
***************************************************************************/
/*-----------------------------------------------
addr_to_keyaddr - given an address,
return the address in the key that will be
used to decrypt it
-----------------------------------------------*/
static inline int addr_to_keyaddr(offs_t address)
{
/* for address xx0000-xx0006 (but only if >= 000008), use key xx2000-xx2006 */
if ((address & 0x0ffc) == 0 && address >= 4)
return (address & 0x1fff) | 0x1000;
else
return address & 0x1fff;
}
/*-----------------------------------------------
mask_for_keyaddr - given a key address,
return a mask indicating which bits should
always be 1
-----------------------------------------------*/
static inline uint8_t mask_for_keyaddr(offs_t address)
{
/* the first half of the key always has bit 0x80 set; the second half 0x40 */
/* however, the values at 0000-0003 and 1000-1003 don't follow this rule */
if ((address & 0x0ffc) == 0)
return 0x00;
else if ((address & 0x1000) == 0)
return 0x80;
else
return 0x40;
}
/*-----------------------------------------------
advance_seed - advance the PRNG seed by
the specified number of steps
-----------------------------------------------*/
static inline uint32_t advance_seed(uint32_t seed, int count)
{
/* iterate over the seed for 'count' reps */
while (count--)
{
seed = seed * 0x29;
seed += seed << 16;
}
return seed;
}
/*-----------------------------------------------
key_value_from_seed - extract the key value
from a seed and apply the given mask
-----------------------------------------------*/
static inline uint8_t key_value_from_seed(uint32_t seed, uint8_t mask)
{
/* put bits 16-21 of the seed in the low 6 bits and OR with the mask */
return ((~seed >> 16) & 0x3f) | mask;
}
/*-----------------------------------------------
generate_key_bytes - generate a sequence of
consecutive key bytes, starting with the
given seed
-----------------------------------------------*/
static inline void generate_key_bytes(uint8_t *dest, uint32_t keyoffs, uint32_t count, uint32_t seed)
{
int bytenum;
/* generate 'count' bytes of a key */
for (bytenum = 0; bytenum < count; bytenum++)
{
uint32_t keyaddr = (keyoffs + bytenum) & 0x1fff;
uint8_t mask = mask_for_keyaddr(keyaddr);
/* advance the seed first, then store the derived value */
seed = advance_seed(seed, 1);
dest[keyaddr] = key_value_from_seed(seed, mask);
}
}
/*-----------------------------------------------
get_opcode_length - return the length of
an opcode based on the opcode
-----------------------------------------------*/
static inline uint8_t get_opcode_length(uint16_t opcode)
{
/* return the length from the table */
return optable[opcode].flags >> 28;
}
/*-----------------------------------------------
set_constraint - set the values of a
constraint
-----------------------------------------------*/
static inline void set_constraint(fd1094_constraint *constraint, uint32_t pc, uint16_t state, uint16_t value, uint16_t mask)
{
constraint->pc = pc;
constraint->state = state;
constraint->value = value & mask;
constraint->mask = mask;
}
/*-----------------------------------------------
print_possibilities - print possibilities
for a given address
-----------------------------------------------*/
static inline void print_possibilities(running_machine &machine)
{
machine.debugger().console().printf("Possibilities @ %06X:\n", posslist[0].basepc);
for (int i = 0; i < posscount; i++)
machine.debugger().console().printf(" %c%2x: %s\n", posslist[i].iffy ? ' ' : '*', i, posslist[i].dasm);
}
/*-----------------------------------------------
pc_is_valid - is a given PC value valid?
0=no, 1=yes, 2=unlikely
-----------------------------------------------*/
static inline int pc_is_valid(address_space &space, uint32_t pc, uint32_t flags)
{
/* if we're odd or out of range, fail */
if ((pc & 1) == 1)
return 0;
if (pc & 0xff000000)
return 0;
if (space.direct().read_ptr(pc) == nullptr)
return 0;
return 1;
}
/*-----------------------------------------------
addr_is_valid - is a given address value
valid? 0=no, 1=yes, 2=unlikely
-----------------------------------------------*/
static inline int addr_is_valid(address_space &space, uint32_t addr, uint32_t flags)
{
/* if this a JMP, the address is a PC */
if (flags & OF_JMP)
return pc_is_valid(space, addr, flags);
/* if we're odd or out of range, fail */
if ((flags & OF_SIZEMASK) != OF_BYTE && (addr & 1) == 1)
return 0;
if ((addr & 0xff000000) != 0 && (addr & 0xff000000) != 0xff000000)
return 0;
/* if we're invalid, fail */
if (strcmp(const_cast<address_space &>(space)->get_handler_string(read_or_write::READ, addr), "segaic16_memory_mapper_lsb_r") == 0)
return 2;
return 1;
}
/***************************************************************************
CORE IMPLEMENTATION
***************************************************************************/
/*-----------------------------------------------
fd1094_init_debugging - set up debugging
-----------------------------------------------*/
void fd1094_init_debugging(running_machine &machine, const char *cpureg, const char *keyreg, const char *statreg, void (*changed)(running_machine &))
{
/* set the key changed callback */
key_changed = changed;
/* set up the regions */
coderegion = (uint16_t *)machine.root_device().memregion(cpureg)->base();
coderegion_words = machine.root_device().memregion(cpureg)->bytes() / 2;
keyregion = (uint8_t *)machine.root_device().memregion(keyreg)->base();
keystatus = (uint16_t *)machine.root_device().memregion(statreg)->base();
keystatus_words = machine.root_device().memregion(statreg)->bytes() / 2;
assert(coderegion_words == keystatus_words);
/* allocate memory for the ignore table */
ignorepc = make_unique_clear<uint8_t>(1 << 23);
/* allocate memory for the undo buffer */
undobuff = std::make_unique<uint8_t[]>(keystatus_words * 2);
memcpy(undobuff, keystatus, keystatus_words * 2);
/* allocate memory for the possible seeds array */
possible_seed = std::make_unique<uint32_t[]>(65536);
/* build the opcode table */
build_optable(machine);
/* set up default constraints */
constcount = 0;
set_constraint(&constraints[constcount++], 0x000000, FD1094_STATE_RESET, 0x0000, 0xffff);
set_constraint(&constraints[constcount++], 0x000002, FD1094_STATE_RESET, 0x0000, 0xffff);
set_constraint(&constraints[constcount++], 0x000004, FD1094_STATE_RESET, 0x0000, 0xffff);
set_constraint(&constraints[constcount++], 0x000006, FD1094_STATE_RESET, 0x0000, 0xc001);
/* determine the key parameters */
set_default_key_params(machine);
/* read the key overlay file */
load_overlay_file(machine);
/* add some commands */
using namespace std::placeholder;
machine.debugger().console().register_command("fdsave", CMDFLAG_NONE, 0, 0, 0, std::bind(&execute_fdsave, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdoutput", CMDFLAG_NONE, 0, 1, 1, std::bind(&execute_fdoutput, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdseed", CMDFLAG_NONE, 0, 2, 2, std::bind(&execute_fdseed, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdguess", CMDFLAG_NONE, STATUS_GUESS, 1, 1, std::bind(&execute_fdlockguess, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdlock", CMDFLAG_NONE, STATUS_LOCKED, 1, 1, std::bind(&execute_fdlockguess, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdeliminate", CMDFLAG_NONE, 0, 1, 10, std::bind(&execute_fdeliminate, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdunlock", CMDFLAG_NONE, 0, 1, 1, std::bind(&execute_fdunlock, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdignore", CMDFLAG_NONE, 0, 0, 1, std::bind(&execute_fdignore, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdundo", CMDFLAG_NONE, 0, 0, 0, std::bind(&execute_fdundo, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdstatus", CMDFLAG_NONE, 0, 0, 0, std::bind(&execute_fdstatus, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdstate", CMDFLAG_NONE, 0, 0, 1, std::bind(&execute_fdstate, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdpc", CMDFLAG_NONE, 0, 0, 1, std::bind(&execute_fdpc, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdsearch", CMDFLAG_NONE, 0, 0, 0, std::bind(&execute_fdsearch, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fddasm", CMDFLAG_NONE, 0, 1, 1, std::bind(&execute_fddasm, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdcset", CMDFLAG_NONE, 0, 2, 4, std::bind(&execute_fdcset, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdclist", CMDFLAG_NONE, 0, 0, 0, std::bind(&execute_fdclist, std::ref(machine), _1, _2, _3));
machine.debugger().console().register_command("fdcsearch", CMDFLAG_NONE, 0, 0, 0, std::bind(&execute_fdcsearch, std::ref(machine), _1, _2, _3));
/* set up the instruction hook */
machine.device("maincpu")->debug()->set_instruction_hook(instruction_hook);
/* regenerate the key */
if (keydirty)
fd1094_regenerate_key(machine);
}
/*-----------------------------------------------
set_default_key_params - based on the game
name, set some defaults
-----------------------------------------------*/
static void set_default_key_params(running_machine &machine)
{
static const struct
{
const char * gamename;
uint32_t global;
uint32_t seed;
} default_keys[] =
{
{ "altbeastj1", 0xFCAFF9F9, 0x177AC6 },
{ "bullet", 0x12A8F9EC, 0x1B1FC3 },
};
int keynum;
/* look for a matching game and set the key appropriately */
for (keynum = 0; keynum < std::size(default_keys); keynum++)
if (strcmp(machine.system().name, default_keys[keynum].gamename) == 0)
{
fd1094_global = default_keys[keynum].global;
fd1094_seed = default_keys[keynum].seed;
keydirty = true;
break;
}
}
/*-----------------------------------------------
load_overlay_file - load the key overlay
file
-----------------------------------------------*/
static void load_overlay_file(running_machine &machine)
{
int pcaddr;
/* determine the filename and open the file */
emu_file file(OPEN_FLAG_READ);
osd_file::error filerr = file.open(machine.system().name, ".kov");
if (filerr == osd_file::error::NONE)
{
file.read(keystatus, keystatus_words * 2);
/* convert from big-endian */
for (pcaddr = 0; pcaddr < keystatus_words; pcaddr++)
keystatus[pcaddr] = big_endianize_int16(keystatus[pcaddr]) & ~SEARCH_MASK;
}
/* mark the key dirty */
keydirty = true;
}
/*-----------------------------------------------
save_overlay_file - save the key overlay
file
-----------------------------------------------*/
static void save_overlay_file(running_machine &machine)
{
int pcaddr;
/* determin the filename and open the file */
emu_file file(OPEN_FLAG_WRITE | OPEN_FLAG_CREATE);
osd_file::error filerr = file.open(machine.system().name, ".kov");
if (filerr == osd_file::error::NONE)
{
/* convert to big-endian */
for (pcaddr = 0; pcaddr < keystatus_words; pcaddr++)
keystatus[pcaddr] = big_endianize_int16(keystatus[pcaddr]);
/* write the data */
file.write(keystatus, keystatus_words * 2);
/* convert from big-endian */
for (pcaddr = 0; pcaddr < keystatus_words; pcaddr++)
keystatus[pcaddr] = big_endianize_int16(keystatus[pcaddr]);
}
}
/*-----------------------------------------------
fd1094_regenerate_key - regenerate the key
based on the raw parameters and the overlay
data
-----------------------------------------------*/
void fd1094_regenerate_key(running_machine &machine)
{
int reps = keystatus_words / KEY_SIZE;
int keyaddr, repnum;
/* store the global key in the first 4 bytes */
keyregion[0] = fd1094_global >> 24;
keyregion[1] = fd1094_global >> 16;
keyregion[2] = fd1094_global >> 8;
keyregion[3] = fd1094_global >> 0;
/* then generate the remaining 8188 bytes */
generate_key_bytes(keyregion, 4, 8192 - 4, fd1094_seed);
/* apply the overlay */
for (keyaddr = 4; keyaddr < KEY_SIZE; keyaddr++)
{
keyregion[keyaddr] |= keystatus[keyaddr] & HIBITS_MASK;
/* if we're locked, propogate that info to all our reps */
if ((keystatus[keyaddr] & STATUS_MASK) == STATUS_LOCKED)
for (repnum = 1; repnum < reps; repnum++)
{
keystatus[repnum * KEY_SIZE + keyaddr] = (keystatus[repnum * KEY_SIZE + keyaddr] & ~STATUS_MASK) | STATUS_LOCKED;
if ((keyaddr & 0x1ffc) == 0x1000)
keystatus[repnum * KEY_SIZE + keyaddr - 0x1000] = (keystatus[repnum * KEY_SIZE + keyaddr - 0x1000] & ~STATUS_MASK) | STATUS_LOCKED;
}
}
/* update the key with the current fd1094 manager */
if (key_changed != nullptr)
(*key_changed)(machine);
/* force all memory and disassembly views to update */
machine.debug_view().update_all(DVT_MEMORY);
machine.debug_view().update_all(DVT_DISASSEMBLY);
/* reset keydirty */
keydirty = false;
}
/*-----------------------------------------------
instruction_hook - per-instruction hook
-----------------------------------------------*/
static int instruction_hook(device_t &device, offs_t curpc)
{
int curfdstate = fd1094_set_state(keyregion, -1);
uint8_t instrbuffer[10], keybuffer[5];
int i, keystat;
/* quick exit if we're ignoring */
if (ignore_all || ignorepc[curpc/2])
return 0;
/* quick exit if we're already locked */
keystat = keystatus[curpc/2] & STATUS_MASK;
keystatus[curpc/2] = (keystatus[curpc/2] & ~STATE_MASK) | (curfdstate << 8);
if (keystat == STATUS_LOCKED || keystat == STATUS_NOCHANGE)
{
uint16_t opcode = fd1094_decode(curpc/2, coderegion[curpc/2], keyregion, 0);
int length = get_opcode_length(opcode);
for (i = 1; i < length; i++)
{
keystat = keystatus[curpc/2 + i] & STATUS_MASK;
if (keystat != STATUS_LOCKED && keystat != STATUS_NOCHANGE)
break;
}
if (i == length)
{
for (i = 1; i < length; i++)
keystatus[curpc/2 + i] = (keystatus[curpc/2 + i] & ~STATE_MASK) | (curfdstate << 8);
return 0;
}
}
/* try all possible decodings at the current pc */
posscount = try_all_possibilities(device.memory().space(AS_PROGRAM), curpc, 0, 0, instrbuffer, keybuffer, posslist) - posslist;
if (keydirty)
fd1094_regenerate_key(device.machine());
/* if we only ended up with one possibility, mark that one as good */
if (posscount == 1)
{
tag_possibility(device.machine(), &posslist[0], STATUS_LOCKED);
fd1094_regenerate_key(device.machine());
return 0;
}
/* print possibilities and break */
print_possibilities(device.machine());
return 1;
}
/*-----------------------------------------------
execute_fdsave - handle the 'fdsave' command
-----------------------------------------------*/
static void execute_fdsave(running_machine &machine, int ref, int params, const char **param)
{
save_overlay_file(machine);
machine.debugger().console().printf("File saved\n");
}
/*-----------------------------------------------
execute_fdoutput - output the current key
to a file
-----------------------------------------------*/
static void execute_fdoutput(running_machine &machine, int ref, int params, const char **param)
{
/* make sure we're up-to-date */
if (keydirty)
fd1094_regenerate_key(machine);
/* determin the filename and open the file */
emu_file file(OPEN_FLAG_WRITE | OPEN_FLAG_CREATE);
osd_file::error filerr = file.open(param[0]);
if (filerr == osd_file::error::NONE)
file.write(keyregion, KEY_SIZE);
machine.debugger().console().printf("File '%s' saved\n", param[0]);
}
/*-----------------------------------------------
execute_fdseed - handle the 'fdseed' command
-----------------------------------------------*/
static void execute_fdseed(running_machine &machine, int ref, int params, const char **param)
{
uint64_t num1, num2;
/* extract the parameters */
if (!machine.debugger().commands().validate_number_parameter(param[0], &num1))
return;
if (!machine.debugger().commands().validate_number_parameter(param[1], &num2))
return;
/* set the global and seed, and then regenerate the key */
fd1094_global = num1;
fd1094_seed = num2;
/* clear out our buffer */
memset(keystatus, 0, keystatus_words * sizeof(keystatus[0]));
/* regenerate the key and reset the 68000 */
fd1094_regenerate_key(machine);
}
/*-----------------------------------------------
execute_fdlockguess - handle the 'fdlock'
and 'fdguess' commands
-----------------------------------------------*/
static void execute_fdlockguess(running_machine &machine, int ref, int params, const char **param)
{
uint64_t num1;
/* extract the parameter */
if (!machine.debugger().commands().validate_number_parameter(param[0], &num1))
return;
/* make sure it is within range of our recent possibilities */
if (num1 >= posscount)
{
machine.debugger().console().printf("Possibility of out range (%x max)\n", posscount);
return;
}
/* create an undo buffer */
memcpy(undobuff, keystatus, keystatus_words * 2);
/* tag this possibility as indicated by the ref parameter, and then regenerate the key */
tag_possibility(machine, &posslist[num1], ref);
fd1094_regenerate_key(machine);
}
/*-----------------------------------------------
execute_fdeliminate - handle the
'fdeliminate' command
-----------------------------------------------*/
static void execute_fdeliminate(running_machine &machine, int ref, int params, const char **param)
{
int pnum, posssrc, possdst;
int plist[10];
/* extract parameters */
for (pnum = 0; pnum < params; pnum++)
{
uint64_t num1;
/* extract the parameters */
if (!machine.debugger().commands().validate_number_parameter(param[pnum], &num1))
return;
/* make sure it is within range of our recent possibilities */
if (num1 >= posscount)
{
machine.debugger().console().printf("Possibility %x of out range (%x max)\n", (int)num1, posscount);
return;
}
/* set the entry */
plist[pnum] = num1;
}
/* loop over parameters */
for (posssrc = possdst = 0; posssrc < posscount; posssrc++)
{
/* is the current pnum in our list to delete? */
for (pnum = 0; pnum < params; pnum++)
if (plist[pnum] == posssrc)
break;
/* if not, copy to the dest */
if (pnum == params)
posslist[possdst++] = posslist[posssrc];
}
/* set the final count */
posscount = possdst;
/* reprint the possibilities */
print_possibilities(machine);
}
/*-----------------------------------------------
execute_fdunlock - handle the 'fdunlock'
command
-----------------------------------------------*/
static void execute_fdunlock(running_machine &machine, int ref, int params, const char **param)
{
device_t *cpu = machine.debugger().console().get_visible_cpu();
/* support 0 or 1 parameters */
uint64_t offset;
if (params != 1 || !machine.debugger().commands().validate_number_parameter(param[0], &offset))
offset = cpu->state().pc();
int keyaddr = addr_to_keyaddr(offset / 2);
/* toggle the ignore PC status */
machine.debugger().console().printf("Unlocking PC %06X\n", (int)offset);
/* iterate over all reps and unlock them */
const int reps = keystatus_words / KEY_SIZE;
for (int repnum = 0; repnum < reps; repnum++)
{
uint16_t *dest = &keystatus[repnum * KEY_SIZE + keyaddr];
if ((*dest & STATUS_MASK) == STATUS_LOCKED)
*dest &= ~STATUS_MASK & ~HIBITS_MASK;
/* unlock the duplicate key bytes as well */
if ((keyaddr & 0x1ffc) == 0x1000)
{
dest = &keystatus[repnum * KEY_SIZE + keyaddr - 0x1000];
if ((*dest & STATUS_MASK) == STATUS_LOCKED)
*dest &= ~STATUS_MASK & ~HIBITS_MASK;
}
}
}
/*-----------------------------------------------
execute_fdignore - handle the 'fdignore'
command
-----------------------------------------------*/
static void execute_fdignore(running_machine &machine, int ref, int params, const char **param)
{
device_t *cpu = machine.debugger().console().get_visible_cpu();
/* support 0 or 1 parameters */
if (params == 1 && strcmp(param[0], "all") == 0)
{
ignore_all = true;
machine.debugger().console().printf("Ignoring all unknown opcodes\n");
return;
}
uint64_t offset;
if (params != 1 || !machine.debugger().commands().validate_number_parameter(param[0], &offset))
offset = cpu->state().pc();
offset /= 2;
/* toggle the ignore PC status */
ignorepc[offset] = !ignorepc[offset];
if (ignorepc[offset])
machine.debugger().console().printf("Ignoring address %06X\n", (int)offset * 2);
else
machine.debugger().console().printf("No longer ignoring address %06X\n", (int)offset * 2);
/* if no parameter given, implicitly run as well */
if (params == 0)
machine.debugger().console().get_visible_cpu()->debug()->go();
}
/*-----------------------------------------------
execute_fdundo - handle the 'fdundo'
command
-----------------------------------------------*/
static void execute_fdundo(running_machine &machine, int ref, int params, const char **param)
{
/* copy the undobuffer back and regenerate the key */
memcpy(keystatus, undobuff, keystatus_words * 2);
fd1094_regenerate_key(machine);
machine.debugger().console().printf("Undid last change\n");
}
/*-----------------------------------------------
execute_fdstatus - handle the 'fdstatus'
command
-----------------------------------------------*/
static void execute_fdstatus(running_machine &machine, int ref, int params, const char **param)
{
int numreps = keystatus_words / KEY_SIZE;
int locked = 4, nomatter = 0, guesses = 0;
int keyaddr;
/* count how many locked keys we have */
for (keyaddr = 4; keyaddr < KEY_SIZE; keyaddr++)
{
int count[STATUS_MASK + 1] = { 0 };
int repnum;
for (repnum = 0; repnum < numreps; repnum++)
count[keystatus[repnum * KEY_SIZE + keyaddr] & STATUS_MASK]++;
if (count[STATUS_LOCKED] > 0)
locked++;
else if (count[STATUS_GUESS] > 0)
guesses++;
else
nomatter++;
}
machine.debugger().console().printf("%4d/%4d keys locked (%d%%)\n", locked, KEY_SIZE, locked * 100 / KEY_SIZE);
machine.debugger().console().printf("%4d/%4d keys guessed (%d%%)\n", guesses, KEY_SIZE, guesses * 100 / KEY_SIZE);
machine.debugger().console().printf("%4d/%4d keys don't matter (%d%%)\n", nomatter, KEY_SIZE, nomatter * 100 / KEY_SIZE);
}
/*-----------------------------------------------
execute_fdstate - handle the 'fdstate'
command
-----------------------------------------------*/
static void execute_fdstate(running_machine &machine, int ref, int params, const char **param)
{
uint64_t newstate;
/* set the new state if we got a parameter */
if (params > 0)
{
if (!machine.debugger().commands().validate_number_parameter(param[0], &newstate))
return;
fd1094_set_state(keyregion, newstate);
fd1094_regenerate_key(machine);
machine.debug_view().update_all(DVT_MEMORY);
machine.debug_view().update_all(DVT_DISASSEMBLY);
}
/* 0 parameters displays the current state */
machine.debugger().console().printf("FD1094 state = %X\n", fd1094_set_state(keyregion, -1));
}
/*-----------------------------------------------
execute_fdpc - handle the 'fdpc'
command
-----------------------------------------------*/
static void execute_fdpc(running_machine &machine, int ref, int params, const char **param)
{
device_t *cpu = machine.debugger().console().get_visible_cpu();
/* support 0 or 1 parameters */
uint64_t newpc = 0;
if (!machine.debugger().commands().validate_number_parameter(param[0], &newpc))
newpc = cpu->state().pc();
/* set the new PC */
cpu->state().set_pc(newpc);
/* recompute around that */
instruction_hook(*cpu, newpc);
}
/*-----------------------------------------------
execute_fdsearch - handle the 'fdsearch'
command
-----------------------------------------------*/
static void execute_fdsearch(running_machine &machine, int ref, int params, const char **param)
{
address_space &space = machine->debugger().console().get_visible_cpu()->memory().space(AS_PROGRAM);
int pc = space.device().state().pc();
int length, first = true;
uint8_t instrdata[2];
uint16_t decoded;
/* if we don't match, reset the stack */
if (searchsp == 0 || searchstack[searchsp-1] != pc)
{
int pcaddr;
machine.debugger().console().printf("Starting new search at PC=%06X\n", pc);
searchsp = 0;
for (pcaddr = 0; pcaddr < coderegion_words; pcaddr++)
keystatus[pcaddr] &= ~SEARCH_MASK;
}
else
{
machine.debugger().console().printf("Resuming search at PC=%06X\n", pc);
searchsp--;
}
/* loop while we don't need to break */
while (1)
{
int newpc;
/* for each PC after the first, do some extra work */
if (!first)
{
/* if we've hit this PC already, stop and back off */
while ((keystatus[pc/2] & SEARCH_MASK) != 0 && searchsp > 0)
pc = searchstack[--searchsp];
if ((keystatus[pc/2] & SEARCH_MASK) != 0)
{
machine.debugger().console().printf("Search stack exhausted\n");
break;
}
/* set this as our current PC and run the instruction hook */
space.device().state().set_pc(pc);
if (instruction_hook(space.device(), pc))
break;
}
keystatus[pc/2] |= SEARCH_MASK;
first = false;
/* decode the first word */
decoded = fd1094_decode(pc/2, coderegion[pc/2], keyregion, 0);
instrdata[0] = decoded >> 8;
instrdata[1] = decoded;
/* get the opcode */
length = validate_opcode(space, pc, instrdata, 1);
if (length < 0)
length = -length;
if (length == 0)
{
machine.debugger().console().printf("Invalid opcode; unable to advance\n");
break;
}
/* advance to the new PC */
newpc = pc + length * 2;
/* handle branches */
if (optable[decoded].flags & OF_BRANCH)
{
int deltapc = (int8_t)decoded;
int targetpc;
/* extract the delta PC */
if ((optable[decoded].flags & OF_ISIZEMASK) == OF_IMMW)
deltapc = (int16_t)fd1094_decode((pc+2)/2, coderegion[(pc+2)/2], keyregion, 0);
else if ((optable[decoded].flags & OF_ISIZEMASK) == OF_IMML)
deltapc = (int32_t)(fd1094_decode((pc+2)/2, coderegion[(pc+2)/2], keyregion, 0) << 16) + fd1094_decode((pc+4)/2, coderegion[(pc+4)/2], keyregion, 0);
/* for everything but unconditional branches, push the target on the stack; else just go there */
targetpc = (pc + 2 + deltapc) & 0xffffff;
if ((decoded & 0xff00) != 0x6000)
searchstack[searchsp++] = targetpc;
else
newpc = targetpc;
}
/* handle jumps */
if (optable[decoded].flags & OF_JMP)
{
int targetpc;
/* if we're not an absolute address, skip it */
if ((decoded & 0x3e) != 0x38)
continue;
/* determine the target PC */
if ((decoded & 0x3f) == 0x38)
targetpc = (int16_t)fd1094_decode((pc+2)/2, coderegion[(pc+2)/2], keyregion, 0);
else
targetpc = (int32_t)(fd1094_decode((pc+2)/2, coderegion[(pc+2)/2], keyregion, 0) << 16) + fd1094_decode((pc+4)/2, coderegion[(pc+4)/2], keyregion, 0);
/* for jsr's, add a stack entry to explore the destination; else just go there */
if ((decoded & 0xffc0) == 0x4e80)
searchstack[searchsp++] = targetpc;
else
newpc = targetpc;
}
/* if we hit RTS/RTE, stop here */
if (decoded == 0x4e73 || decoded == 0x4e75)
continue;
/* set the new PC */
pc = newpc;
}
/* push the current PC on the stack */
searchstack[searchsp++] = pc;
}
/*-----------------------------------------------
execute_fddasm - handle the 'fddasm'
command
-----------------------------------------------*/
static void execute_fddasm(running_machine &machine, int ref, int params, const char **param)
{
address_space &space = machine->debugger().console().get_visible_cpu()->memory().space(AS_PROGRAM);
int origstate = fd1094_set_state(keyregion, -1);
const char *filename;
int skipped = false;
uint32_t pcaddr;
/* extract the parameters */
filename = param[0];
/* open the file */
emu_file file(OPEN_FLAG_WRITE | OPEN_FLAG_CREATE);
osd_file::error filerr = file.open(filename);
if (filerr != osd_file::error::NONE)
{
machine.debugger().console().printf("Unable to create file '%s'\n", filename);
return;
}
/* now do the disassembly */
for (pcaddr = 0; pcaddr < coderegion_words; )
{
uint8_t instrbuffer[10];
int unknowns = false;
int length, pcoffs;
char disasm[256];
uint16_t decoded;
int pnum;
/* if we haven't visited this word, go to the next */
if ((keystatus[pcaddr] & STATE_MASK) == 0)
{
pcaddr++;
skipped = true;
continue;
}
/* get the opcode */
fd1094_set_state(keyregion, FD1094_STATE_RESET | (keystatus[pcaddr] >> 8));
decoded = fd1094_decode(pcaddr, coderegion[pcaddr], keyregion, 0);
length = optable[decoded].flags >> 28;
if (optable[decoded].flags == OF_INVALID)
length = 1;
/* decode the remaining words */
instrbuffer[0] = decoded >> 8;
instrbuffer[1] = decoded;
for (pcoffs = 1; pcoffs < length; pcoffs++)
{
if ((keystatus[pcaddr + pcoffs] & STATUS_MASK) == STATUS_UNVISITED)
{
pcaddr++;
skipped = true;
continue;
}
decoded = fd1094_decode(pcaddr + pcoffs, coderegion[pcaddr + pcoffs], keyregion, 0);
instrbuffer[pcoffs*2+0] = decoded >> 8;
instrbuffer[pcoffs*2+1] = decoded;
}
/* disassemble the instruction */
m68k_disassemble_raw(disasm, pcaddr * 2, instrbuffer, instrbuffer, M68K_CPU_TYPE_68000);
/* print the line */
if (skipped)
file.printf("\n");
skipped = false;
file.printf(" %02X %06X:", keystatus[pcaddr] >> 8, pcaddr * 2);
for (pcoffs = 0; pcoffs < 5; pcoffs++)
{
if (pcoffs < length)
{
static const char statchar[] = "? =?";
int keystat = keystatus[pcaddr + pcoffs] & STATUS_MASK;
if (keystat != STATUS_LOCKED && keystat != STATUS_NOCHANGE)
unknowns = true;
file.printf(" %02X%02X%c", instrbuffer[pcoffs*2+0], instrbuffer[pcoffs*2+1], statchar[keystat]);
}
else
file.printf(" ");
}
file.printf("%s\n", disasm);
/* if we have unknowns, display them as well */
if (unknowns > 0)
{
uint8_t keybuffer[5];
int posscount = try_all_possibilities(space, pcaddr * 2, 0, 0, instrbuffer, keybuffer, posslist) - posslist;
for (pnum = 0; pnum < posscount; pnum++)
if (strcmp(disasm, posslist[pnum].dasm) != 0)
{
file.printf(" :");
for (pcoffs = 0; pcoffs < 5; pcoffs++)
if (pcoffs < posslist[pnum].length)
file.printf(" %02X%02X ", posslist[pnum].instrbuffer[pcoffs*2+0], posslist[pnum].instrbuffer[pcoffs*2+1]);
else
file.printf(" ");
file.printf("%s\n", posslist[pnum].dasm);
}
}
/* advance */
pcaddr += length;
}
/* close the file */
fd1094_set_state(keyregion, origstate);
}
/*-----------------------------------------------
execute_fdcset - handle the 'fdcset'
command
-----------------------------------------------*/
static void execute_fdcset(running_machine &machine, int ref, int params, const char **param)
{
uint64_t pc, value, mask = 0xffff, state = FD1094_STATE_RESET;
int cnum;
/* extract the parameters */
if (!machine.debugger().commands().validate_number_parameter(param[0], &pc))
return;
if (!machine.debugger().commands().validate_number_parameter(param[1], &value))
return;
if (params >= 3 && !machine.debugger().commands().validate_number_parameter(param[2], &mask))
return;
if (params >= 4)
{
if (strcmp(param[3], "irq") == 0)
state = FD1094_STATE_IRQ;
else if (!machine.debugger().commands().validate_number_parameter(param[3], &state))
return;
}
/* validate parameters */
if ((pc & 1) != 0 || pc > 0xffffff)
{
machine.debugger().console().printf("Invalid PC specified (%08X)\n", (uint32_t)pc);
return;
}
/* look for a match and remove any matching constraints */
for (cnum = 0; cnum < constcount; cnum++)
{
/* insert ahead of later constraints */
if (constraints[cnum].pc > pc)
{
memmove(&constraints[cnum + 1], &constraints[cnum], (constcount - cnum) * sizeof(constraints[0]));
break;
}
/* replace matching constraints */
else if (constraints[cnum].pc == pc)
break;
}
/* set the new constraint and increase the count */
if (cnum >= constcount || constraints[cnum].pc != pc)
constcount++;
set_constraint(&constraints[cnum], pc, state, value, mask);
/* explain what we did */
machine.debugger().console().printf("Set new constraint at PC=%06X, state=%03X: decrypted & %04X == %04X\n",
(int)pc, (int)state, (int)mask, (int)value);
}
/*-----------------------------------------------
execute_fdclist - handle the 'fdclist'
command
-----------------------------------------------*/
static void execute_fdclist(running_machine &machine, int ref, int params, const char **param)
{
int cnum;
/* loop over constraints and print them */
for (cnum = 0; cnum < constcount; cnum++)
{
fd1094_constraint *constraint = &constraints[cnum];
machine.debugger().console().printf(" PC=%06X, state=%03X: decrypted & %04X == %04X\n",
constraint->pc, constraint->state, constraint->mask, constraint->value);
}
}
/*-----------------------------------------------
execute_fdcsearch - handle the 'fdcsearch'
command
-----------------------------------------------*/
static void execute_fdcsearch(running_machine &machine, int ref, int params, const char **param)
{
// machine.debugger().console().printf("Searching for possible global keys....\n");
perform_constrained_search(machine);
}
/*-----------------------------------------------
try_all_possibilities - recursively try
all possible values of the high bits of the
key at the given address for the specified
length
-----------------------------------------------*/
static fd1094_possibility *try_all_possibilities(address_space &space, int basepc, int offset, int length, uint8_t *instrbuffer, uint8_t *keybuffer, fd1094_possibility *possdata)
{
uint8_t keymask, keystat;
uint16_t possvalue[4];
uint8_t posskey[4];
int numposs = 0;
int decoded;
int keyaddr;
int pcaddr;
int hibit;
int i;
/* get the key address and mask */
pcaddr = basepc/2 + offset;
keyaddr = addr_to_keyaddr(pcaddr);
keymask = mask_for_keyaddr(keyaddr);
keystat = keystatus[pcaddr] & STATUS_MASK;
/* if the status is 1 (locked) or 2 (doesn't matter), just take the current value */
if (keystat == STATUS_LOCKED || keystat == STATUS_NOCHANGE)
{
posskey[numposs] = keyregion[keyaddr];
possvalue[numposs++] = fd1094_decode(pcaddr, coderegion[pcaddr], keyregion, 0);
}
/* otherwise, iterate over high bits */
else
{
/* remember the original key and iterate over high bits */
uint8_t origkey = keyregion[keyaddr];
for (hibit = 0x00; hibit < 0x100; hibit += 0x40)
if ((hibit & keymask) == keymask)
{
/* set the key and decode this word */
keyregion[keyaddr] = (origkey & ~HIBITS_MASK) | hibit;
decoded = fd1094_decode(pcaddr, coderegion[pcaddr], keyregion, 0);
/* see if we already got that value */
for (i = 0; i < numposs; i++)
if ((uint16_t)decoded == possvalue[i])
break;
/* if not, add it to the list */
if (i == numposs)
{
posskey[numposs] = keyregion[keyaddr];
possvalue[numposs++] = decoded;
}
}
/* restore the original key */
keyregion[keyaddr] = origkey;
/* if there was only one possibility, then mark it as "doesn't matter" */
if (numposs == 1)
{
keystatus[pcaddr] = (keystatus[pcaddr] & ~STATUS_MASK) | STATUS_NOCHANGE;
keydirty = true;
}
}
/* now iterate over our possible values */
for (i = 0; i < numposs; i++)
{
/* set the instruction buffer */
instrbuffer[offset*2 + 0] = possvalue[i] >> 8;
instrbuffer[offset*2 + 1] = possvalue[i];
keybuffer[offset] = posskey[i];
/* if our length is 0, we need to do a quick dasm to see how long our length is */
if (offset == 0)
{
/* first make sure we are a valid instruction */
if ((possvalue[i] & 0xf000) == 0xa000 || (possvalue[i] & 0xf000) == 0xf000)
continue;
length = validate_opcode(space, basepc, instrbuffer, 1);
if (length == 0)
continue;
if (length < 0)
length = -length;
}
/* if we're not at our target length, recursively call ourselves */
if (offset < length - 1)
possdata = try_all_possibilities(space, basepc, offset + 1, length, instrbuffer, keybuffer, possdata);
/* otherwise, output what we have */
else
{
int tlen, inoffs;
/* do the disassembly, and make sure we don't get an invalid result */
m68k_disassemble_raw(possdata->dasm, basepc, instrbuffer, instrbuffer, M68K_CPU_TYPE_68000);
/* validate the opcode */
tlen = validate_opcode(space, basepc, instrbuffer, length);
if (tlen == 0)
{
printf("Eliminated: %s [", possdata->dasm);
for (inoffs = 0; inoffs < length; inoffs++)
printf("%04X ", (instrbuffer[inoffs*2+0] << 8) | instrbuffer[inoffs*2+1]);
printf("]\n");
continue;
}
/* copy the rest of the data and increment the pointer */
possdata->basepc = basepc;
possdata->length = (tlen < 0) ? -tlen : tlen;
possdata->iffy = (tlen < 0);
memcpy(possdata->instrbuffer, instrbuffer, sizeof(possdata->instrbuffer));
memcpy(possdata->keybuffer, keybuffer, sizeof(possdata->keybuffer));
possdata++;
}
}
return possdata;
}
/*-----------------------------------------------
tag_possibility - tag a given possibility
with the specified status
-----------------------------------------------*/
static void tag_possibility(running_machine &machine, fd1094_possibility *possdata, uint8_t status)
{
int curfdstate = fd1094_set_state(keyregion, -1);
int nomatter = 0, locked = 0, guessed = 0;
int reps = keystatus_words / KEY_SIZE;
uint8_t newstat[5];
int pcoffs;
/* determine the new status for each word */
for (pcoffs = 0; pcoffs < possdata->length; pcoffs++)
{
int pnum;
/* default to setting the requested status */
newstat[pcoffs] = status;
/* see if the current word was the same across all possibilities */
for (pnum = 0; pnum < posscount; pnum++)
if (posslist[pnum].instrbuffer[pcoffs*2+0] != possdata->instrbuffer[pcoffs*2+0] ||
posslist[pnum].instrbuffer[pcoffs*2+1] != possdata->instrbuffer[pcoffs*2+1])
break;
/* if so, lock, don't guess */
if (pnum == posscount)
newstat[pcoffs] = STATUS_LOCKED;
}
/* iterate over words in the opcode */
for (pcoffs = 0; pcoffs < possdata->length; pcoffs++)
{
int pcaddr = possdata->basepc/2 + pcoffs;
int keyaddr = addr_to_keyaddr(pcaddr);
int keystat = keystatus[pcaddr] & STATUS_MASK;
int repnum;
/* if the status doesn't match and isn't "no change", then set the status */
if (keystat != STATUS_NOCHANGE)
{
keystatus[keyaddr] = (keystatus[keyaddr] & ~HIBITS_MASK) | (possdata->keybuffer[pcoffs] & HIBITS_MASK);
keystatus[pcaddr] = (keystatus[pcaddr] & ~STATE_MASK & ~STATUS_MASK) | (curfdstate << 8) | newstat[pcoffs];
keydirty = true;
}
else
keystatus[pcaddr] = (keystatus[pcaddr] & ~STATE_MASK) | (curfdstate << 8);
/* if we're now locked, propogate across all reps */
keystat = keystatus[pcaddr] & STATUS_MASK;
if (keystat == STATUS_LOCKED)
for (repnum = 0; repnum < reps; repnum++)
{
keystatus[repnum * KEY_SIZE + keyaddr] = (keystatus[repnum * KEY_SIZE + keyaddr] & ~STATUS_MASK) | STATUS_LOCKED;
if ((keyaddr & 0x1ffc) == 0x1000)
keystatus[repnum * KEY_SIZE + keyaddr - 0x1000] = (keystatus[repnum * KEY_SIZE + keyaddr - 0x1000] & ~STATUS_MASK) | STATUS_LOCKED;
}
/* update the final key status */
if (keystat == STATUS_LOCKED)
locked++;
else if (keystat == STATUS_GUESS)
guessed++;
else if (keystat == STATUS_NOCHANGE)
nomatter++;
}
machine.debugger().console().printf("PC=%06X: locked %d, guessed %d, nochange %d\n", possdata->basepc, locked, guessed, nomatter);
}
/*-----------------------------------------------
perform_constrained_search - look for
the next global key that will match the
given sequence/mask pair
-----------------------------------------------*/
static void perform_constrained_search(running_machine &machine)
{
uint32_t global;
/* ensure our first 4 constraints are what we expect */
assert(constraints[0].pc == 0x000000);
assert(constraints[1].pc == 0x000002);
assert(constraints[2].pc == 0x000004);
assert(constraints[3].pc == 0x000006);
/* start with a 0 global key and brute force from there */
global = 0;
/* loop until we run out of possibilities */
while (1)
{
uint16_t output[4];
int numseeds;
/* look for the next global key match */
global = find_global_key_matches(global + 1, output);
if (global == 0)
break;
// machine.debugger().console().printf("Checking global key %08X (PC=%06X)....\n", global, (output[2] << 16) | output[3]);
/* use the IRQ handler to find more possibilities */
numseeds = find_constraint_sequence(global, false);
if (numseeds > 0)
{
int i;
for (i = 0; i < numseeds; i++)
machine.debugger().console().printf(" Possible: global=%08X seed=%06X pc=%04X\n", global, possible_seed[i], output[3]);
}
}
}
/*-----------------------------------------------
find_global_key_matches - look for
the next global key that will match the
given sequence/mask pair
-----------------------------------------------*/
static uint32_t find_global_key_matches(uint32_t startwith, uint16_t *output)
{
int key0, key1, key2, key3;
uint8_t key[4];
/* iterate over the first key byte, allowing all possible values */
for (key0 = (startwith >> 24) & 0xff; key0 < 256; key0++)
{
/* set the key and reset the fd1094 */
key[0] = key0;
startwith &= 0x00ffffff;
fd1094_set_state(key, FD1094_STATE_RESET);
/* if we match, iterate over the second key byte */
output[0] = fd1094_decode(0x000000, coderegion[0], key, true);
if ((output[0] & constraints[0].mask) == constraints[0].value)
/* iterate over the second key byte, limiting the scope to known valid keys */
for (key1 = (startwith >> 16) & 0xff; key1 < 256; key1++)
if ((key1 & 0xf8) == 0xa8 || (key1 & 0xf8) == 0xf8)
{
/* set the key and reset the fd1094 */
key[1] = key1;
startwith &= 0x0000ffff;
fd1094_set_state(key, FD1094_STATE_RESET);
/* if we match, iterate over the third key byte */
output[1] = fd1094_decode(0x000001, coderegion[1], key, true);
if ((output[1] & constraints[1].mask) == constraints[1].value)
/* iterate over the third key byte, limiting the scope to known valid keys */
for (key2 = (startwith >> 8) & 0xff; key2 < 256; key2++)
if ((key2 & 0xc0) == 0xc0)
{
/* set the key and reset the fd1094 */
key[2] = key2;
startwith &= 0x000000ff;
fd1094_set_state(key, FD1094_STATE_RESET);
/* if we match, iterate over the fourth key byte */
output[2] = fd1094_decode(0x000002, coderegion[2], key, true);
if ((output[2] & constraints[2].mask) == constraints[2].value)
/* iterate over the fourth key byte, limiting the scope to known valid keys */
for (key3 = (startwith >> 0) & 0xff; key3 < 256; key3++)
if ((key3 & 0xc0) == 0xc0)
{
/* set the key and reset the fd1094 */
key[3] = key3;
startwith = 0;
fd1094_set_state(key, FD1094_STATE_RESET);
/* if we match, return the value */
output[3] = fd1094_decode(0x000003, coderegion[3], key, true);
if ((output[3] & constraints[3].mask) == constraints[3].value)
return (key0 << 24) | (key1 << 16) | (key2 << 8) | key3;
}
}
}
}
return 0;
}
/*-----------------------------------------------
find_constraint_sequence - look for a
sequence of decoded words at the given
address, and optionally verify that there
are valid PRNG keys that could generate the
results
-----------------------------------------------*/
static int find_constraint_sequence(uint32_t global, int quick)
{
const fd1094_constraint *minkeyaddr = &constraints[4];
const fd1094_constraint *maxkeyaddr = &constraints[4];
const fd1094_constraint *curr;
int keyvalue, keyaddr, keysneeded;
int seedcount = 0;
uint16_t decrypted;
uint8_t key[8192];
uint8_t keymask;
offs_t pcaddr;
/* if we don't have any extra constraints, we're good */
if (constcount <= 4)
return -1;
/* set the global key */
key[0] = global >> 24;
key[1] = global >> 16;
key[2] = global >> 8;
key[3] = global >> 0;
fd1094_set_state(key, -1);
/* first see if it is even possible, regardless of PRNG */
for (curr = &constraints[4]; curr < &constraints[constcount]; curr++)
{
/* get the key address and value for this offset */
pcaddr = curr->pc / 2;
keyaddr = addr_to_keyaddr(pcaddr);
keymask = mask_for_keyaddr(keyaddr);
/* track the minumum and maximum key addresses, but only for interesting combinations */
if ((coderegion[pcaddr] & 0xe000) != 0x0000)
{
if (keyaddr < addr_to_keyaddr(minkeyaddr->pc / 2))
minkeyaddr = curr;
if (keyaddr > addr_to_keyaddr(maxkeyaddr->pc / 2))
maxkeyaddr = curr;
}
/* set the state */
fd1094_set_state(key, curr->state);
/* brute force search this byte */
for (keyvalue = 0; keyvalue < 256; keyvalue++)
if ((keyvalue & keymask) == keymask)
{
/* see if this works */
key[keyaddr] = keyvalue;
decrypted = fd1094_decode(pcaddr, coderegion[pcaddr], key, false);
/* if we got a match, stop; we're done */
if ((decrypted & curr->mask) == curr->value)
break;
}
/* if we failed, we're done */
if (keyvalue == 256)
return 0;
}
/* if we're quick, that's all the checking we do */
if (quick)
return -1;
/* determine how many keys we need to cover our whole range */
keysneeded = addr_to_keyaddr(maxkeyaddr->pc / 2) + 1 - addr_to_keyaddr(minkeyaddr->pc / 2);
/* now do the more thorough search */
pcaddr = minkeyaddr->pc / 2;
keyaddr = addr_to_keyaddr(pcaddr);
keymask = mask_for_keyaddr(keyaddr);
/* set the state */
fd1094_set_state(key, minkeyaddr->state);
/* brute force search the first byte key of the key */
for (keyvalue = 0; keyvalue < 256; keyvalue++)
if ((keyvalue & keymask) == keymask)
{
/* see if this works */
key[keyaddr] = keyvalue;
decrypted = fd1094_decode(pcaddr, coderegion[pcaddr], key, false);
/* if we got a match, then iterate over all possible PRNG sequences starting with this */
if ((decrypted & minkeyaddr->mask) == minkeyaddr->value)
{
uint32_t seedlow;
// machine.debugger().console().printf("Global %08X ... Looking for keys that generate a keyvalue of %02X at %04X\n",
// global, keyvalue, keyaddr);
/* iterate over seed possibilities */
for (seedlow = 0; seedlow < (1 << 16); seedlow++)
{
/* start with the known upper bits together with the 16 guessed lower bits */
uint32_t seedstart = (~keyvalue << 16) | seedlow;
/* generate data starting with this seed into the key */
generate_key_bytes(key, keyaddr + 1, keysneeded - 1, seedstart);
/* if the whole thing matched, record the match */
if (does_key_work_for_constraints(coderegion, key))
{
seedstart = reconstruct_base_seed(keyaddr, seedstart);
if ((seedstart & 0x3fffff) != 0)
possible_seed[seedcount++] = seedstart;
}
}
}
}
return seedcount;
}
/*-----------------------------------------------
does_key_work_for_constraints - return true
if the given key might work for a given set
of constraints
-----------------------------------------------*/
static int does_key_work_for_constraints(const uint16_t *base, uint8_t *key)
{
const fd1094_constraint *curr;
uint16_t decrypted;
/* iterate over the sequence */
for (curr = &constraints[4]; curr < &constraints[constcount]; curr++)
{
offs_t pcaddr = curr->pc / 2;
int keyaddr = addr_to_keyaddr(pcaddr);
uint8_t keymask = mask_for_keyaddr(keyaddr);
int hibits;
/* set the state */
fd1094_set_state(key, curr->state);
/* iterate over high bits (1 per byte) */
for (hibits = 0; hibits < 0x100; hibits += 0x40)
if ((hibits & keymask) == keymask)
{
/* update the key bits */
key[keyaddr] = (key[keyaddr] & ~0xc0) | hibits;
/* decrypt using this key; stop if we get a match */
decrypted = fd1094_decode(pcaddr, base[pcaddr], key, false);
if ((decrypted & curr->mask) == curr->value)
break;
}
/* if we failed to match, we're done */
if (hibits >= 0x100)
return false;
}
/* got a match on all entries */
return true;
}
/*-----------------------------------------------
reconstruct_base_seed - given the seed
value at a particular key address, return
the seed that would be used to generate the
first key value (at offset 4)
-----------------------------------------------*/
static uint32_t reconstruct_base_seed(int keybaseaddr, uint32_t startseed)
{
uint32_t seed = startseed;
uint32_t window[8192];
int index = 0;
/* keep generating, starting from the start seed until we re-generate the start seed */
/* note that some sequences are smaller than the window, so we also have to ensure */
/* that we generate at least one full window's worth of data */
do
{
seed = seed * 0x29;
seed += seed << 16;
window[index++ % std::size(window)] = seed;
} while (((startseed ^ seed) & 0x3fffff) != 0 || index < std::size(window));
/* when we break, we have overshot */
index--;
/* back up to where we would have been at address 3 */
index -= keybaseaddr - 3;
if (index < 0)
index += std::size(window);
/* return the value from the window at that location */
return window[index % std::size(window)] & 0x3fffff;
}
/*-----------------------------------------------
Table of opcode parameters
-----------------------------------------------*/
#define ENTRY(a,b,c,d) { #a, #b, c, d },
static const struct
{
const char * bitstring;
const char * eastring;
uint32_t flags;
const char * instring;
} instr_table[] =
{
ENTRY(1100...100000..., ........., OF_BYTE | OF_RARE, "ABCD Dn,Dm")
ENTRY(1100...100001..., ........., OF_BYTE | OF_RARE, "ABCD -(An),-(Am)")
ENTRY(1101...000......, d.A+-DBIP, OF_BYTE | OF_EASRC, "ADD.B <ea>,Dn")
ENTRY(1101...001......, daA+-DBIP, OF_WORD | OF_EASRC, "ADD.W <ea>,Dn")
ENTRY(1101...010......, daA+-DBIP, OF_LONG | OF_EASRC, "ADD.L <ea>,Dn")
ENTRY(1101...011......, daA+-DBIP, OF_WORD | OF_EASRC, "ADDA.W <ea>,An")
ENTRY(1101...100......, ..A+-DB.., OF_BYTE | OF_EADST, "ADD.B Dn,<ea>")
ENTRY(1101...101......, ..A+-DB.., OF_WORD | OF_EADST, "ADD.W Dn,<ea>")
ENTRY(1101...110......, ..A+-DB.., OF_LONG | OF_EADST, "ADD.L Dn,<ea>")
ENTRY(1101...111......, daA+-DBIP, OF_LONG | OF_EASRC, "ADDA.L <ea>,An")
ENTRY(0000011000......, d.A+-DB.., OF_BYTE | OF_EADST | OF_IMMB, "ADDI.B #x,<ea>")
ENTRY(0000011001......, d.A+-DB.., OF_WORD | OF_EADST | OF_IMMW, "ADDI.W #x,<ea>")
ENTRY(0000011010......, d.A+-DB.., OF_LONG | OF_EADST | OF_IMML, "ADDI.L #x,<ea>")
ENTRY(0101...000......, d.A+-DB.., OF_BYTE | OF_EADST, "ADDQ.B #x,<ea>")
ENTRY(0101...001......, daA+-DB.., OF_WORD | OF_EADST, "ADDQ.W #x,<ea>")
ENTRY(0101...010......, daA+-DB.., OF_LONG | OF_EADST, "ADDQ.L #x,<ea>")
ENTRY(1101...10000...., ........., OF_BYTE | OF_RARE, "ADDX.B")
ENTRY(1101...10100...., ........., OF_WORD | OF_RARE, "ADDX.W")
ENTRY(1101...11000...., ........., OF_LONG | OF_RARE, "ADDX.L")
ENTRY(1100...000......, d.A+-DBIP, OF_BYTE | OF_EASRC, "AND.B <ea>,Dn")
ENTRY(1100...001......, d.A+-DBIP, OF_WORD | OF_EASRC, "AND.W <ea>,Dn")
ENTRY(1100...010......, d.A+-DBIP, OF_LONG | OF_EASRC, "AND.L <ea>,Dn")
ENTRY(1100...100......, ..A+-DB.., OF_BYTE | OF_EADST, "AND.B Dn,<ea>")
ENTRY(1100...101......, ..A+-DB.., OF_WORD | OF_EADST, "AND.W Dn,<ea>")
ENTRY(1100...110......, ..A+-DB.., OF_LONG | OF_EADST, "AND.L Dn,<ea>")
ENTRY(0000001000111100, ........., OF_BYTE | OF_IMMB | OF_RARE, "ANDI #x,CCR")
ENTRY(0000001000......, d.A+-DB.., OF_BYTE | OF_EADST | OF_IMMB, "ANDI.B #x,<ea>")
ENTRY(0000001001......, d.A+-DB.., OF_WORD | OF_EADST | OF_IMMW, "ANDI.W #x,<ea>")
ENTRY(0000001010......, d.A+-DB.., OF_LONG | OF_EADST | OF_IMML, "ANDI.L #x,<ea>")
ENTRY(1110....00.00..., ........., OF_BYTE, "ASL/ASR.B")
ENTRY(1110....01.00..., ........., OF_WORD, "ASL/ASR.W")
ENTRY(1110....10.00..., ........., OF_LONG, "ASL/ASR.L")
ENTRY(1110000.11......, ..A+-DB.., OF_WORD | OF_EADST, "ASL/ASR.W <ea>")
ENTRY(0110000000000000, ........., OF_WORD | OF_IMMW | OF_BRANCH, "BRA.W <dst>")
ENTRY(01100000.......0, ........., OF_BYTE | OF_BRANCH, "BRA.B <dst>")
ENTRY(0110000100000000, ........., OF_WORD | OF_IMMW | OF_BRANCH, "BSR.W <dst>")
ENTRY(01100001.......0, ........., OF_BYTE | OF_BRANCH, "BSR.B <dst>")
ENTRY(0110....00000000, ........., OF_WORD | OF_IMMW | OF_BRANCH, "Bcc.W <dst>")
ENTRY(0110...........0, ........., OF_BYTE | OF_BRANCH, "Bcc.B <dst>")
ENTRY(0000...101......, d.A+-DB.., OF_BYTE | OF_EADST, "BCHG Dn,<ea>")
ENTRY(0000100001......, d.A+-DB.., OF_BYTE | OF_EADST | OF_IMMBIT, "BCHG #x,<ea>")
ENTRY(0000...110......, d.A+-DB.., OF_BYTE | OF_EADST, "BCLR Dn,<ea>")
ENTRY(0000100010......, d.A+-DB.., OF_BYTE | OF_EADST | OF_IMMBIT, "BCLR #x,<ea>")
ENTRY(0000...111......, d.A+-DB.., OF_BYTE | OF_EADST, "BSET Dn,<ea>")
ENTRY(0000100011......, d.A+-DB.., OF_BYTE | OF_EADST | OF_IMMBIT, "BSET #x,<ea>")
ENTRY(0000...100......, d.A+-DBIP, OF_BYTE | OF_EADST, "BTST Dn,<ea>")
ENTRY(0000100000......, d.A+-DB.P, OF_BYTE | OF_EADST | OF_IMMBIT, "BTST #x,<ea>")
ENTRY(0100...110......, d.A+-DBIP, OF_WORD | OF_EADST | OF_RARE, "CHK.W <ea>,Dn")
ENTRY(0100001000......, d.A+-DB.., OF_BYTE | OF_EADST, "CLR.B <ea>")
ENTRY(0100001001......, d.A+-DB.., OF_WORD | OF_EADST, "CLR.W <ea>")
ENTRY(0100001010......, d.A+-DB.., OF_LONG | OF_EADST, "CLR.L <ea>")
ENTRY(1011...000......, d.A+-DBIP, OF_BYTE | OF_EASRC, "CMP.B <ea>,Dn")
ENTRY(1011...001......, daA+-DBIP, OF_WORD | OF_EASRC, "CMP.W <ea>,Dn")
ENTRY(1011...010......, daA+-DBIP, OF_LONG | OF_EASRC, "CMP.L <ea>,Dn")
ENTRY(1011...011......, daA+-DBIP, OF_WORD | OF_EASRC, "CMPA.W <ea>,Dn")
ENTRY(1011...111......, daA+-DBIP, OF_LONG | OF_EASRC, "CMPA.L <ea>,Dn")
ENTRY(0000110000......, d.A+-DB.., OF_BYTE | OF_EASRC | OF_IMMB, "CMPI.B #x,<ea>")
ENTRY(0000110001......, d.A+-DB.., OF_WORD | OF_EASRC | OF_IMMW, "CMPI.W #x,<ea>")
ENTRY(0000110010......, d.A+-DB.., OF_LONG | OF_EASRC | OF_IMML, "CMPI.L #x,<ea>")
ENTRY(1011...100001..., ........., OF_BYTE | OF_RARE, "CMPM.B")
ENTRY(1011...101001..., ........., OF_WORD | OF_RARE, "CMPM.W")
ENTRY(1011...110001..., ........., OF_LONG | OF_RARE, "CMPM.L")
ENTRY(0101....11001..., ........., OF_WORD | OF_IMMW | OF_BRANCH, "DBcc.W <dst>")
ENTRY(1000...111......, d.A+-DBIP, OF_WORD | OF_EASRC, "DIVS.W <ea>,Dn")
ENTRY(1000...011......, d.A+-DBIP, OF_WORD | OF_EASRC, "DIVU.W <ea>,Dn")
ENTRY(1011...100......, d.A+-DB.., OF_BYTE | OF_EADST, "EOR.B Dn,<ea>")
ENTRY(1011...101......, d.A+-DB.., OF_WORD | OF_EADST, "EOR.W Dn,<ea>")
ENTRY(1011...110......, d.A+-DB.., OF_LONG | OF_EADST, "EOR.L Dn,<ea>")
ENTRY(0000101000111100, ........., OF_BYTE | OF_IMMB | OF_RARE, "EORI #x,CCR")
ENTRY(0000101000......, d.A+-DB.., OF_BYTE | OF_EADST | OF_IMMB, "EORI.B #x,<ea>")
ENTRY(0000101001......, d.A+-DB.., OF_WORD | OF_EADST | OF_IMMW, "EORI.W #x,<ea>")
ENTRY(0000101010......, d.A+-DB.., OF_LONG | OF_EADST | OF_IMML, "EORI.L #x,<ea>")
ENTRY(1100...101000..., ........., OF_LONG, "EXG Dn,Dn")
ENTRY(1100...101001..., ........., OF_LONG, "EXG An,An")
ENTRY(1100...110001..., ........., OF_LONG, "EXG Dn,An")
ENTRY(0100100010000..., ........., OF_WORD, "EXT.W Dn")
ENTRY(0100100011000..., ........., OF_WORD, "EXT.L Dn")
ENTRY(0100111011......, ..A..DB.P, OF_WORD | OF_EASRC | OF_JMP, "JMP <ea>")
ENTRY(0100111010......, ..A..DB.P, OF_WORD | OF_EASRC | OF_JMP, "JSR <ea>")
ENTRY(0100...111......, ..A..DB.P, OF_BYTE | OF_EASRC, "LEA <ea>,An")
ENTRY(0100111001010..., ........., OF_WORD | OF_IMMW | OF_RARE, "LINK An,#x")
ENTRY(1110....00.01..., ........., OF_BYTE, "LSL/LSR.B Dn")
ENTRY(1110....01.01..., ........., OF_WORD, "LSL/LSR.W Dn")
ENTRY(1110....10.01..., ........., OF_LONG, "LSL/LSR.L Dn")
ENTRY(1110001.11......, ..A+-DB.., OF_WORD | OF_EADST, "LSL/LSR.W <ea>")
ENTRY(0001............, d.A+-DBIP, OF_BYTE | OF_EASRC | OF_MOVE, "MOVE.B <ea>,<ea>")
ENTRY(0011............, daA+-DBIP, OF_WORD | OF_EASRC | OF_MOVE, "MOVE.W <ea>,<ea>")
ENTRY(0010............, daA+-DBIP, OF_LONG | OF_EASRC | OF_MOVE, "MOVE.L <ea>,<ea>")
ENTRY(0011...001......, daA+-DBIP, OF_WORD | OF_EASRC, "MOVEA.W <ea>,An")
ENTRY(0010...001......, daA+-DBIP, OF_LONG | OF_EASRC, "MOVEA.L <ea>,An")
ENTRY(0100010011......, d.A+-DBIP, OF_WORD | OF_EASRC | OF_RARE, "MOVE <ea>,CCR")
ENTRY(0100000011......, d.A+-DB.., OF_WORD | OF_EADST | OF_RARE, "MOVE SR,<ea>")
ENTRY(0100100010......, ..A.-DB.., OF_WORD | OF_EADST | OF_IMMW, "MOVEM.W <regs>,<ea>")
ENTRY(0100100011......, ..A.-DB.., OF_LONG | OF_EADST | OF_IMMW, "MOVEM.L <regs>,<ea>")
ENTRY(0100110010......, ..A+.DB.P, OF_WORD | OF_EASRC | OF_IMMW, "MOVEM.W <ea>,<regs>")
ENTRY(0100110011......, ..A+.DB.P, OF_LONG | OF_EASRC | OF_IMMW, "MOVEM.L <ea>,<regs>")
ENTRY(0000...100001..., ........., OF_WORD | OF_IMMW | OF_RARE, "MOVEP.W (d16,Ay),Dn")
ENTRY(0000...101001..., ........., OF_LONG | OF_IMMW | OF_RARE, "MOVEP.L (d16,Ay),Dn")
ENTRY(0000...110001..., ........., OF_WORD | OF_IMMW | OF_RARE, "MOVEP.W Dn,(d16,Ay)")
ENTRY(0000...111001..., ........., OF_LONG | OF_IMMW | OF_RARE, "MOVEP.L Dn,(d16,Ay)")
ENTRY(0111...0........, ........., OF_LONG, "MOVEQ #x,Dn")
ENTRY(1100...111......, d.A+-DBIP, OF_WORD | OF_EASRC, "MULS.W <ea>,Dn")
ENTRY(1100...011......, d.A+-DBIP, OF_WORD | OF_EASRC, "MULU.W <ea>,Dn")
ENTRY(0100100000......, d.A+-DB.., OF_BYTE | OF_EADST | OF_RARE, "NBCD <ea>")
ENTRY(0100010000......, d.A+-DB.., OF_BYTE | OF_EADST, "NEG.B <ea>")
ENTRY(0100010001......, d.A+-DB.., OF_WORD | OF_EADST, "NEG.W <ea>")
ENTRY(0100010010......, d.A+-DB.., OF_LONG | OF_EADST, "NEG.L <ea>")
ENTRY(0100000000......, d.A+-DB.., OF_BYTE | OF_EADST | OF_RARE, "NEGX.B <ea>")
ENTRY(0100000001......, d.A+-DB.., OF_WORD | OF_EADST | OF_RARE, "NEGX.W <ea>")
ENTRY(0100000010......, d.A+-DB.., OF_LONG | OF_EADST | OF_RARE, "NEGX.L <ea>")
ENTRY(0100111001110001, ........., 0, "NOP")
ENTRY(0100011000......, d.A+-DB.., OF_BYTE | OF_EADST, "NOT.B <ea>")
ENTRY(0100011001......, d.A+-DB.., OF_WORD | OF_EADST, "NOT.W <ea>")
ENTRY(0100011010......, d.A+-DB.., OF_LONG | OF_EADST, "NOT.L <ea>")
ENTRY(1000...000......, d.A+-DBIP, OF_BYTE | OF_EASRC, "OR.B <ea>,Dn")
ENTRY(1000...001......, d.A+-DBIP, OF_WORD | OF_EASRC, "OR.W <ea>,Dn")
ENTRY(1000...010......, d.A+-DBIP, OF_LONG | OF_EASRC, "OR.L <ea>,Dn")
ENTRY(1000...100......, ..A+-DB.., OF_BYTE | OF_EADST, "OR.B Dn,<ea>")
ENTRY(1000...101......, ..A+-DB.., OF_WORD | OF_EADST, "OR.W Dn,<ea>")
ENTRY(1000...110......, ..A+-DB.., OF_LONG | OF_EADST, "OR.L Dn,<ea>")
ENTRY(0000000000111100, ........., OF_BYTE | OF_IMMB | OF_RARE, "ORI #x,CCR")
ENTRY(0000000000......, d.A+-DB.., OF_BYTE | OF_EADST | OF_IMMB, "ORI.B #x,<ea>")
ENTRY(0000000001......, d.A+-DB.., OF_WORD | OF_EADST | OF_IMMW, "ORI.W #x,<ea>")
ENTRY(0000000010......, d.A+-DB.., OF_LONG | OF_EADST | OF_IMML, "ORI.L #x,<ea>")
ENTRY(0100100001......, ..A..DB.P, OF_BYTE | OF_EADST | OF_RARE, "PEA <ea>")
ENTRY(1110....00.11..., ........., OF_BYTE, "ROL/ROR.B Dn")
ENTRY(1110....01.11..., ........., OF_WORD, "ROL/ROR.W Dn")
ENTRY(1110....10.11..., ........., OF_LONG, "ROL/ROR.L Dn")
ENTRY(1110011.11......, ..A+-DB.., OF_WORD | OF_EADST, "ROL/ROR.W <ea>")
ENTRY(1110....00.10..., ........., OF_BYTE | OF_RARE, "ROXL/ROXR.B Dn")
ENTRY(1110....01.10..., ........., OF_WORD | OF_RARE, "ROXL/ROXR.W Dn")
ENTRY(1110....10.10..., ........., OF_LONG | OF_RARE, "ROXL/ROXR.L Dn")
ENTRY(1110010.11......, ..A+-DB.., OF_WORD | OF_EADST | OF_RARE, "ROXL/ROXR.W <ea>")
ENTRY(0100111001110111, ........., OF_RARE, "RTR")
ENTRY(0100111001110101, ........., OF_RARE, "RTS")
ENTRY(1000...100000..., ........., OF_BYTE | OF_RARE, "SBCD Dn,Dm")
ENTRY(1000...100001..., ........., OF_BYTE | OF_RARE, "SBCD -(An),-(Am)")
ENTRY(0101....11......, d.A+-DB.., OF_BYTE | OF_EADST | OF_RARE, "Scc <ea>")
ENTRY(1001...000......, d.A+-DBIP, OF_BYTE | OF_EASRC, "SUB.B <ea>,Dn")
ENTRY(1001...001......, daA+-DBIP, OF_WORD | OF_EASRC, "SUB.W <ea>,Dn")
ENTRY(1001...010......, daA+-DBIP, OF_LONG | OF_EASRC, "SUB.L <ea>,Dn")
ENTRY(1001...011......, daA+-DBIP, OF_WORD | OF_EASRC, "SUBA.W <ea>,An")
ENTRY(1001...100......, ..A+-DB.., OF_BYTE | OF_EADST, "SUB.B Dn,<ea>")
ENTRY(1001...101......, ..A+-DB.., OF_WORD | OF_EADST, "SUB.W Dn,<ea>")
ENTRY(1001...110......, ..A+-DB.., OF_LONG | OF_EADST, "SUB.L Dn,<ea>")
ENTRY(1001...111......, daA+-DBIP, OF_LONG | OF_EASRC, "SUBA.L <ea>,An")
ENTRY(0000010000......, d.A+-DB.., OF_BYTE | OF_EADST | OF_IMMB, "SUBI.B #x,<ea>")
ENTRY(0000010001......, d.A+-DB.., OF_WORD | OF_EADST | OF_IMMW, "SUBI.W #x,<ea>")
ENTRY(0000010010......, d.A+-DB.., OF_LONG | OF_EADST | OF_IMML, "SUBI.L #x,<ea>")
ENTRY(0101...100......, d.A+-DB.., OF_BYTE | OF_EADST, "SUBQ.B #x,<ea>")
ENTRY(0101...101......, daA+-DB.., OF_WORD | OF_EADST, "SUBQ.W #x,<ea>")
ENTRY(0101...110......, daA+-DB.., OF_LONG | OF_EADST, "SUBQ.L #x,<ea>")
ENTRY(1001...10000...., ........., OF_BYTE | OF_RARE, "SUBX.B")
ENTRY(1001...10100...., ........., OF_WORD | OF_RARE, "SUBX.W")
ENTRY(1001...11000...., ........., OF_LONG | OF_RARE, "SUBX.L")
ENTRY(0100100001000..., ........., OF_LONG | OF_RARE, "SWAP Dn")
ENTRY(0100101011......, d.A+-DB.., OF_BYTE | OF_EASRC | OF_RARE, "TAS <ea>")
ENTRY(010011100100...., ........., OF_RARE, "TRAP #x")
ENTRY(0100111001110110, ........., OF_RARE, "TRAPV")
ENTRY(0100101000......, d.A+-DB.., OF_BYTE | OF_EASRC, "TST.B <ea>")
ENTRY(0100101001......, d.A+-DB.., OF_WORD | OF_EASRC, "TST.W <ea>")
ENTRY(0100101010......, d.A+-DB.., OF_LONG | OF_EASRC, "TST.L <ea>")
ENTRY(0100111001011..., ........., OF_RARE, "UNLK")
ENTRY(0000001001111100, ........., OF_WORD | OF_IMMW | OF_RARE, "ANDI #x,SR")
ENTRY(0000101001111100, ........., OF_WORD | OF_IMMW | OF_RARE, "EORI #x,SR")
ENTRY(0100000011......, d.A+-DB.., OF_WORD | OF_EADST | OF_RARE, "MOVE SR,<ea>")
ENTRY(0100011011......, d.A+-DBIP, OF_WORD | OF_EASRC | OF_RARE, "MOVE <ea>,SR")
ENTRY(010011100110...., ........., OF_LONG | OF_RARE, "MOVE USP")
ENTRY(0000000001111100, ........., OF_WORD | OF_IMMW | OF_RARE, "ORI #x,SR")
ENTRY(0100111001110000, ........., OF_RARE, "RESET")
ENTRY(0100111001110011, ........., OF_RARE, "RTE")
ENTRY(0100111001110010, ........., OF_WORD | OF_IMMW | OF_RARE, "STOP #x")
};
/*-----------------------------------------------
build_optable - build up the opcode table
-----------------------------------------------*/
static void build_optable(running_machine &machine)
{
int opnum, inum;
/* allocate and initialize the opcode table */
optable = std::make_unique<optable_entry[]>(65536);
for (opnum = 0; opnum < 65536; opnum++)
{
optable[opnum].flags = OF_INVALID;
optable[opnum].string = nullptr;
}
/* now iterate over entries in our intruction table */
for (inum = 0; inum < std::size(instr_table); inum++)
{
const char *bitstring = instr_table[inum].bitstring;
const char *eastring = instr_table[inum].eastring;
const char *instring = instr_table[inum].instring;
uint32_t flags = instr_table[inum].flags;
uint8_t ea_allowed[64], ea2_allowed[64];
int bitnum, step, eanum, ea2num;
uint16_t mask = 0, value = 0;
/* build up the mask and value from the bitstring */
for (bitnum = 0; bitnum < 16; bitnum++)
{
assert(bitstring[bitnum] == '0' || bitstring[bitnum] == '1' || bitstring[bitnum] == '.');
mask <<= 1;
value <<= 1;
if (bitstring[bitnum] != '.')
{
mask |= 1;
value |= (bitstring[bitnum] == '1');
}
}
/* if we have an EA, fill in the EA bits */
memset(ea_allowed, 0, sizeof(ea_allowed));
if (flags & (OF_EASRC | OF_EADST))
{
assert((mask & 0x003f) == 0);
assert(eastring[0] == 'd' || eastring[0] == '.');
if (eastring[0] == 'd') memset(&ea_allowed[0x00], 1, 8);
assert(eastring[1] == 'a' || eastring[1] == '.');
if (eastring[1] == 'a') memset(&ea_allowed[0x08], 1, 8);
assert(eastring[2] == 'A' || eastring[2] == '.');
if (eastring[2] == 'A') memset(&ea_allowed[0x10], 1, 8);
assert(eastring[3] == '+' || eastring[3] == '.');
if (eastring[3] == '+') memset(&ea_allowed[0x18], 1, 8);
assert(eastring[4] == '-' || eastring[4] == '.');
if (eastring[4] == '-') memset(&ea_allowed[0x20], 1, 8);
assert(eastring[5] == 'D' || eastring[5] == '.');
if (eastring[5] == 'D') memset(&ea_allowed[0x28], 1, 16);
assert(eastring[6] == 'B' || eastring[6] == '.');
if (eastring[6] == 'B') memset(&ea_allowed[0x38], 1, 2);
assert(eastring[7] == 'I' || eastring[7] == '.');
if (eastring[7] == 'I') ea_allowed[0x3c] = 1;
assert(eastring[8] == 'P' || eastring[8] == '.');
if (eastring[8] == 'P') memset(&ea_allowed[0x3a], 1, 2);
step = 0x40;
}
else
{
assert(strcmp(eastring, ".........") == 0);
ea_allowed[0] = 1;
step = 1;
}
/* if we're a move instruction, fill in the EA2 bits */
memset(ea2_allowed, 0, sizeof(ea2_allowed));
if (flags & OF_MOVE)
{
assert((mask & 0x0fc0) == 0);
memset(&ea2_allowed[0x00], 1, 8);
memset(&ea2_allowed[0x10], 1, 42);
step = 0x1000;
}
else
ea2_allowed[0] = 1;
/* iterate over allowed EAs and fill in the opcode entries */
for (ea2num = 0; ea2num < 64; ea2num++)
if (ea2_allowed[ea2num])
for (eanum = 0; eanum < 64; eanum++)
if (ea_allowed[eanum])
{
uint16_t eabits = ((ea2num & 0x38) << 3) | ((ea2num & 0x07) << 9) | eanum;
/* iterate over opcode entries */
for (opnum = 0; opnum <= mask; opnum += step)
if ((opnum & mask) == value)
{
int length = 1;
/* skip if we've already populated */
if (optable[opnum | eabits].flags != OF_INVALID)
continue;
/* determine the length of the opcode */
if (flags & OF_ISIZEMASK)
length += ((flags & OF_ISIZEMASK) == OF_IMML) ? 2 : 1;
if ((eanum >= 0x28 && eanum <= 0x38) || eanum == 0x3a || eanum == 0x3b)
length += 1;
else if (eanum == 0x39)
length += 2;
else if (eanum == 0x3c)
length += ((flags & OF_SIZEMASK) == OF_LONG) ? 2 : 1;
if ((ea2num >= 0x28 && ea2num <= 0x38) || ea2num == 0x3a || ea2num == 0x3b)
length += 1;
else if (ea2num == 0x39)
length += 2;
else if (ea2num == 0x3c)
length += ((flags & OF_SIZEMASK) == OF_LONG) ? 2 : 1;
/* make sure we match the disassembler */
#ifdef MAME_DEBUG
{
char dummybuffer[40];
uint8_t instrbuffer[10];
instrbuffer[0] = (opnum | eabits) >> 8;
instrbuffer[1] = (opnum | eabits);
dummybuffer[0] = 0;
assert(length == (m68k_disassemble_raw(dummybuffer, 0, instrbuffer, instrbuffer, M68K_CPU_TYPE_68000) & 0xff) / 2);
}
#endif
/* set the value of the entry in the table */
optable[opnum | eabits].flags = flags | (length << 28);
optable[opnum | eabits].string = instring;
}
}
}
}
/*-----------------------------------------------
validate_ea - determine whether an EA is
valid or not, and return the length
-----------------------------------------------*/
static int validate_ea(address_space &space, uint32_t pc, uint8_t modereg, const uint8_t *parambase, uint32_t flags)
{
uint32_t addr;
int valid;
/* switch off of the mode */
switch ((modereg >> 3) & 7)
{
case 0: /* Dn -- always good */
case 1: /* An -- always good */
case 2: /* (An) -- always good */
case 3: /* (An)+ -- always good */
case 4: /* -(An) -- always good */
return 0;
case 5: /* (d16,An) -- always good, but odd displacements are a warning for word/long */
if ((flags & OF_SIZEMASK) != OF_BYTE && (parambase[1] & 1) == 1)
return -1;
return 1;
case 6: /* (d8,An,Xn) -- always good, but odd displacements are a warning for word/long */
/* also look for invalid extension words */
if ((parambase[0] & 7) != 0)
return 1000;
if ((flags & OF_SIZEMASK) != OF_BYTE && (parambase[1] & 1) == 1)
return -1;
return 1;
case 7:
switch (modereg & 7)
{
case 0: /* (xxx).W -- make sure it is not odd for word/long */
addr = (int16_t)((parambase[0] << 8) | parambase[1]);
valid = addr_is_valid(space, addr & 0xffffff, flags);
return (valid == 0) ? 1000 : (valid == 2) ? -1 : 1;
case 1: /* (xxx).L -- make sure it is not odd for word/long, and make sure upper byte of addr is 0 */
valid = addr_is_valid(space, (parambase[0] << 24) | (parambase[1] << 16) | (parambase[2] << 8) | parambase[3], flags);
return (valid == 0) ? 1000 : (valid == 2) ? -2 : 2;
case 2: /* (d16,PC) -- make sure it is not odd for word/long */
valid = addr_is_valid(space, pc + (int16_t)((parambase[0] << 8) | parambase[1]), flags);
return (valid == 0) ? 1000 : (valid == 2) ? -1 : 1;
case 3: /* (d8,PC,Xn) -- odd displacements are a warning for word/long */
if ((parambase[0] & 7) != 0)
return 1000;
if ((flags & OF_SIZEMASK) != OF_BYTE && (parambase[1] & 1) == 1)
return -1;
return 1;
case 4: /* immediate -- check high byte if byte-sized */
if ((flags & OF_SIZEMASK) == OF_BYTE && parambase[0] != 0)
return 1000;
return ((flags & OF_SIZEMASK) == SIZE_LONG) ? 2 : 1;
}
break;
}
/* should never get here */
assert(false);
return 0;
}
/*-----------------------------------------------
validate_opcode - validate an opcode up to
the length specified
-----------------------------------------------*/
static int validate_opcode(address_space &space, uint32_t pc, const uint8_t *opdata, int maxwords)
{
uint32_t immvalue = 0;
int iffy = false;
int offset = 0;
uint16_t opcode;
uint32_t flags;
int oplength;
assert(maxwords >= 1);
/* extract the opcode and look it up in our table */
opcode = (opdata[offset*2+0] << 8) | opdata[offset*2+1];
flags = optable[opcode].flags;
oplength = flags >> 28;
/* weed out invalid opcodes immediately */
offset++;
if (flags == OF_INVALID)
return 0;
iffy = ((flags & OF_RARE) != 0);
/* if we're done, or if we don't have enough words, stop now */
if (offset == oplength || maxwords < oplength)
return iffy ? -oplength : oplength;
/* if the opcode has an immediate, process that */
if (flags & OF_ISIZEMASK)
{
int neededwords = ((flags & OF_ISIZEMASK) == OF_IMML) ? 2 : 1;
/* extract the immediate value */
immvalue = (opdata[offset*2+0] << 8) | opdata[offset*2+1];
if ((flags & OF_ISIZEMASK) == OF_IMML)
immvalue = (immvalue << 16) | (opdata[offset*2+2] << 8) | opdata[offset*2+3];
/* if it's a byte immediate, ensure the upper bits are 0 (except for -1) */
if ((flags & OF_ISIZEMASK) == OF_IMMB && immvalue > 0xff && immvalue != 0xffff)
return 0;
/* if it's a bit immediate, ensure all but the lower 3 bits are 0 */
if ((flags & OF_ISIZEMASK) == OF_IMMBIT)
{
/* registers can do up to 32 bits */
if ((opcode & 0x3f) < 8)
{
if (immvalue > 31)
return 0;
}
/* memory operands can do up to 8 bits */
else
{
if (immvalue > 7)
return 0;
}
}
/* advance past the immedate */
offset += neededwords;
}
/* if we're a branch, validate the immediate value */
if (flags & OF_BRANCH)
{
int valid;
/* first adjust the PC based on the size of the branch */
pc += 2;
if ((flags & OF_SIZEMASK) == OF_BYTE)
pc += (int8_t)opcode;
else if ((flags & OF_SIZEMASK) == OF_WORD)
pc += (int16_t)immvalue;
else
pc += immvalue;
/* if we're odd or out of range, fail */
valid = pc_is_valid(space, pc, flags);
if (valid == 0)
return 0;
if (valid == 2)
iffy = true;
}
/* process the EA, if present */
if (flags & (OF_EASRC | OF_EADST))
{
int modereg = opcode & 0x003f;
int ealen = validate_ea(space, pc + offset*2, modereg, &opdata[offset*2], flags);
/* if the ea was invalid, forward that result */
if (ealen == 1000)
return 0;
/* if the ea was iffy, indicate that */
if (ealen < 0)
{
ealen = -ealen;
iffy = true;
}
/* advance past the ea */
offset += ealen;
}
/* process the move EA, if present */
if (flags & OF_MOVE)
{
int modereg = ((opcode & 0x01c0) >> 3) | ((opcode & 0x0e00) >> 9);
int ealen = validate_ea(space, pc + offset*2, modereg, &opdata[offset*2], flags);
/* if the ea was invalid, forward that result */
if (ealen == 1000)
return 0;
/* if the ea was iffy, indicate that */
if (ealen < 0)
{
ealen = -ealen;
iffy = true;
}
/* advance past the ea */
offset += ealen;
}
/* at this point we should be at the end */
assert(offset == oplength);
return iffy ? -oplength : oplength;
}
#endif
Reference in a new issue View git blame Copy permalink