driver
| driver | cps2.c |
| source | cps2.c (cps2.c on mamedev.org) |
| games | 1944: The Loop Master (Japan 000620) 1944: The Loop Master (USA 000620) 19XX: The War Against Destiny (Asia 951207) 19XX: The War Against Destiny (Brazil 951218) 19XX: The War Against Destiny (Hispanic 951218) 19XX: The War Against Destiny (Japan 951207) 19XX: The War Against Destiny (Japan 951225) 19XX: The War Against Destiny (USA 951207) Alien vs. Predator (Asia 940520) Alien vs. Predator (Euro 940520) Alien vs. Predator (Hispanic 940520) Alien vs. Predator (Japan 940520) Alien vs. Predator (USA 940520) Armored Warriors (Asia 940920) Armored Warriors (Euro 941011) Armored Warriors (Euro 941024) Armored Warriors (USA 941024) Battle Circuit (Asia 970319) Battle Circuit (Euro 970319) Battle Circuit (Japan 970319) Capcom Sports Club (Asia 970722) Capcom Sports Club (Euro 970722) Capcom Sports Club (Hispanic 970722) Capcom Sports Club (Japan 970722) Cyberbots: Fullmetal Madness (Euro 950424) Cyberbots: Fullmetal Madness (Japan 950420) Cyberbots: Fullmetal Madness (USA 950424) Darkstalkers: The Night Warriors (Asia 940705) Darkstalkers: The Night Warriors (Euro 940705) Darkstalkers: The Night Warriors (USA 940705) Darkstalkers: The Night Warriors (USA 940818) Dimahoo (Euro 000121) Dimahoo (USA 000121) Dungeons & Dragons: Shadow over Mystara (Asia 960619) Dungeons & Dragons: Shadow over Mystara (Brazil 960223) Dungeons & Dragons: Shadow over Mystara (Euro 960208) Dungeons & Dragons: Shadow over Mystara (Euro 960209) Dungeons & Dragons: Shadow over Mystara (Euro 960223) Dungeons & Dragons: Shadow over Mystara (Euro 960619) Dungeons & Dragons: Shadow over Mystara (Japan 960206) Dungeons & Dragons: Shadow over Mystara (Japan 960619) Dungeons & Dragons: Shadow over Mystara (USA 960209) Dungeons & Dragons: Shadow over Mystara (USA 960619) Dungeons & Dragons: Tower of Doom (Asia 940113) Dungeons & Dragons: Tower of Doom (Euro 940113) Dungeons & Dragons: Tower of Doom (Euro 940412) Dungeons & Dragons: Tower of Doom (Hispanic 940125) Dungeons & Dragons: Tower of Doom (Japan 940113) Dungeons & Dragons: Tower of Doom (Japan 940125) Dungeons & Dragons: Tower of Doom (Japan 940412) Dungeons & Dragons: Tower of Doom (USA 940113) Dungeons & Dragons: Tower of Doom (USA 940125) Eco Fighters (Asia 931203) Eco Fighters (USA 931203) Eco Fighters (USA 940215) Eco Fighters (World 931203) Giga Wing (Asia 990222) Giga Wing (Japan 990223) Giga Wing (USA 990222) Great Mahou Daisakusen (Japan 000121) Hyper Street Fighter 2: The Anniversary Edition (Asia 040202) Hyper Street Fighter 2: The Anniversary Edition (Japan 031222) Janpai Puzzle Choukou (Japan 010820) Jyangokushi: Haoh no Saihai (Japan 990527) Mars Matrix: Hyper Solid Shooting (Japan 000412) Mars Matrix: Hyper Solid Shooting (USA 000412) Marvel Super Heroes (Asia 951024) Marvel Super Heroes (Brazil 951117) Marvel Super Heroes (Euro 951024) Marvel Super Heroes (Hispanic 951117) Marvel Super Heroes (Japan 951024) Marvel Super Heroes (Japan 951117) Marvel Super Heroes (USA 951024) Marvel Super Heroes Vs. Street Fighter (Asia 970620) Marvel Super Heroes Vs. Street Fighter (Asia 970625) Marvel Super Heroes Vs. Street Fighter (Brazil 970625) Marvel Super Heroes Vs. Street Fighter (Brazil 970827) Marvel Super Heroes Vs. Street Fighter (Euro 970625) Marvel Super Heroes Vs. Street Fighter (Hispanic 970625) Marvel Super Heroes Vs. Street Fighter (Japan 970625) Marvel Super Heroes Vs. Street Fighter (Japan 970702) Marvel Super Heroes Vs. Street Fighter (Japan 970707) Marvel Super Heroes Vs. Street Fighter (USA 970625) Marvel Super Heroes Vs. Street Fighter (USA 970827) Marvel Vs. Capcom: Clash of Super Heroes (Asia 980112) Marvel Vs. Capcom: Clash of Super Heroes (Asia 980123) Marvel Vs. Capcom: Clash of Super Heroes (Brazil 980123) Marvel Vs. Capcom: Clash of Super Heroes (Euro 980112) Marvel Vs. Capcom: Clash of Super Heroes (Hispanic 980123) Marvel Vs. Capcom: Clash of Super Heroes (Japan 980112) Marvel Vs. Capcom: Clash of Super Heroes (Japan 980123) Marvel Vs. Capcom: Clash of Super Heroes (USA 980123) Mega Man - The Power Battle (CPS2, USA 951006, SAMPLE Version) Mega Man 2: The Power Fighters (Asia 960708) Mega Man 2: The Power Fighters (USA 960708) Mighty! Pang (Euro 001010) Mighty! Pang (Japan 001011) Mighty! Pang (USA 001010) Night Warriors: Darkstalkers' Revenge (Brazil 950403) Night Warriors: Darkstalkers' Revenge (Euro 950316) Night Warriors: Darkstalkers' Revenge (Hispanic 950403) Night Warriors: Darkstalkers' Revenge (USA 950406) Pocket Fighter (Japan 970904) Powered Gear: Strategic Variant Armor Equipment (Japan 940916) Powered Gear: Strategic Variant Armor Equipment (Japan 941024) Progear (Asia 010117) Progear (USA 010117) Progear no Arashi (Japan 010117) Puzz Loop 2 (Euro 010302) Puzz Loop 2 (Japan 010205) Quiz Nanairo Dreams: Nijiirochou no Kiseki (Japan 960826) Ring of Destruction: Slammasters II (Euro 940902) Rockman 2: The Power Fighters (Japan 960708) Rockman: The Power Battle (CPS2, Japan 950922) Street Fighter Alpha 2 (Euro 960229) Street Fighter Alpha 2 (USA 960306) Street Fighter Alpha 3 (Brazil 980629) Street Fighter Alpha 3 (Euro 980904) Street Fighter Alpha 3 (USA 980629) Street Fighter Alpha 3 (USA 980904) Street Fighter Alpha: Warriors' Dreams (Euro 950605) Street Fighter Alpha: Warriors' Dreams (Euro 950627) Street Fighter Alpha: Warriors' Dreams (Euro 950718) Street Fighter Alpha: Warriors' Dreams (Euro 950727) Street Fighter Alpha: Warriors' Dreams (USA 950627) Street Fighter Zero (Asia 950627) Street Fighter Zero (Brazil 950727) Street Fighter Zero (Brazil 951109) Street Fighter Zero (Hispanic 950627) Street Fighter Zero (Japan 950605) Street Fighter Zero (Japan 950627) Street Fighter Zero (Japan 950727) Street Fighter Zero 2 (Asia 960227) Street Fighter Zero 2 (Brazil 960304) Street Fighter Zero 2 (Brazil 960531) Street Fighter Zero 2 (Hispanic 960304) Street Fighter Zero 2 (Japan 960227) Street Fighter Zero 2 (Oceania 960229) Street Fighter Zero 2 Alpha (Asia 960826) Street Fighter Zero 2 Alpha (Brazil 960813) Street Fighter Zero 2 Alpha (Hispanic 960813) Street Fighter Zero 2 Alpha (Japan 960805) Street Fighter Zero 3 (Asia 980701) Street Fighter Zero 3 (Asia 980904) Street Fighter Zero 3 (Japan 980629) Street Fighter Zero 3 (Japan 980727) Street Fighter Zero 3 (Japan 980904) Super Gem Fighter Mini Mix (USA 970904) Super Gem Fighter: Mini Mix (Asia 970904) Super Gem Fighter: Mini Mix (Hispanic 970904) Super Muscle Bomber: The International Blowout (Japan 940808) Super Muscle Bomber: The International Blowout (Japan 940831) Super Puzzle Fighter II Turbo (Asia 960529) Super Puzzle Fighter II Turbo (USA 960620) Super Puzzle Fighter II X (Japan 960531) Super Street Fighter II Turbo (Asia 940223) Super Street Fighter II Turbo (USA 940223) Super Street Fighter II Turbo (USA 940323) Super Street Fighter II Turbo (World 940223) Super Street Fighter II X: Grand Master Challenge (Japan 940223) Super Street Fighter II: The New Challengers (Asia 930914) Super Street Fighter II: The New Challengers (Asia 931005) Super Street Fighter II: The New Challengers (Japan 930910) Super Street Fighter II: The New Challengers (Japan 930911) Super Street Fighter II: The New Challengers (Japan 931005) Super Street Fighter II: The New Challengers (USA 930911) Super Street Fighter II: The New Challengers (World 930911) Super Street Fighter II: The Tournament Battle (Japan 930911) Super Street Fighter II: The Tournament Battle (World 930911) Super Street Fighter II: The Tournament Battle (World 931119) Ultimate Ecology (Japan 931203) Vampire Hunter 2: Darkstalkers Revenge (Japan 970913) Vampire Hunter 2: Darkstalkers Revenge (Japan 970929) Vampire Hunter: Darkstalkers' Revenge (Japan 950302) Vampire Hunter: Darkstalkers' Revenge (Japan 950307) Vampire Hunter: Darkstalkers' Revenge (Japan 950316) Vampire Savior 2: The Lord of Vampire (Japan 970913) Vampire Savior: The Lord of Vampire (Asia 970519) Vampire Savior: The Lord of Vampire (Euro 970519) Vampire Savior: The Lord of Vampire (Hispanic 970519) Vampire Savior: The Lord of Vampire (Japan 970519) Vampire Savior: The Lord of Vampire (USA 970519) Vampire: The Night Warriors (Japan 940630) Vampire: The Night Warriors (Japan 940705 alt) Vampire: The Night Warriors (Japan 940705) X-Men Vs. Street Fighter (Asia 960919) X-Men Vs. Street Fighter (Asia 961023) X-Men Vs. Street Fighter (Brazil 961023) X-Men Vs. Street Fighter (Euro 960910) X-Men Vs. Street Fighter (Euro 961004) X-Men Vs. Street Fighter (Hispanic 961004) X-Men Vs. Street Fighter (Japan 960909) X-Men Vs. Street Fighter (Japan 960910) X-Men Vs. Street Fighter (Japan 961004) X-Men Vs. Street Fighter (USA 961004) X-Men Vs. Street Fighter (USA 961023) X-Men: Children of the Atom (Asia 941217) X-Men: Children of the Atom (Euro 950105) X-Men: Children of the Atom (Hispanic 950331) X-Men: Children of the Atom (Japan 941208 rent version) X-Men: Children of the Atom (Japan 941217) X-Men: Children of the Atom (Japan 941219) X-Men: Children of the Atom (Japan 941222) X-Men: Children of the Atom (USA 950105) |
| information | 0.36b3 [Paul Leaman] TODO: - Rasters are not correctly emulated in places where more than one split happens per frame. A known place where this problem happens is during Shuma-Gorath's Chaos Dimension super move in both MSH and MSHVSF. The screen should split into around 6 or more strips and then scroll the gfx inside those strips up and down alternatly (as one stip moves gfx up the next strip moves the gfx down). - The network adapter used in Super Street Fighter II: The Tournament Battle is not currently emulated though the ports it uses are setup in the memory map. - Giga Wing's attract mode seems to loose sync with music. The problem seems to happen due to gfx drawing slowing to much when screen colors fade out. This problem could be due to the 68k being clocked at 11.8mhz when the hardware has a 16mhz crystal on it. Various timing loops show 11.8 being the average speed of the cpu and this does run true when comparing emulation and real hardware when timing is not based on VSync (ssf2 and ssf2t for example). It is possible that what is slowing the cpu is read/write wait states when accessing RAM areas. This would mean that in places where lots of opcodes are being used in connetion with data registers only the code would end up running to slow. - Giga Wing's sprites are 1 frame out when compared to background scrolling. See the explanation above for the most likley cause of this problem. - Progear slows down more than it should when compared to real hardware. See the explanation above for the most likely cause of this problem. - Any new region sets will need full encryption tables dumped to extract the proper keys or they will need to be brute forced. XORs are no longer supported nor wanted. - All games: All inputs have been mapped according to the "test mode" (even if some buttons don't physically exist on the machine). Joysticks and buttons can be fully tested. COINn sometimes don't show anything but are OK ingame. Unless I notify something below for some games, there is no extra button ! - mmancp2u: BUTTON3 doesn't physically exist on the machine and has no effect ingame. - megaman2: BUTTON3 doesn't physically exist on the machine and has no effect ingame. - mpang: BUTTON2 doesn't physically exist on the machine and can't be seen in the "test mode". However, if you map it where it should be, it has the same effect as BUTTON1. - pzloop2: Whatever your settings are, the paddle can't be tested in the "test mode"! I can't tell at the moment if it's an emulation or an ingame bug :( - dimahoo: BUTTON3 doesn't physically exist on the machine. However, it acts like a rapid fire (keep button pressed). - progear: BUTTON3 acts like a rapid fire (keep button pressed). It has to be enabled in the game settings as it is OFF by default. NOTES: - Driver: Thanks to Raz, Crashtest and the CPS2 decryption team for their initial work on extracting decrypted code. Thanks to Andreas Naive and Nicola Salmoria for understanding the encryption mechanism. Bugs: - In the test menu for msh, mshvsf, xmvsf, xmcota, nwarr for sound and voice, the bar for volume disappers. Tafoid: There is odd behavior in only MSH, XMVSF, XMCOTA sets in my testing. The volume bar seems to flux on it's own up and down. In some cases, as you change the sound code to play, there is flickering of the bar. (ID 01488). WIP: - 0.126u3: Firewave fixed 'Abort' in all CPS2 parent sets. - 0.124u3: Nicola Salmoria merged CPS1, CPS2 memory maps and some tweaks from schematics, though to get perfect memory maps dumps of the A-board PALs would be needed. - 0.124u1: Changed palettesize to 3072 colors. - 0.123u1: Changed the GAME definitions in the cps2 driver to reflect how many players and how many buttons there are for each game. Rewrote the INPUT_PORTS definitions to use PORT_INCLUDE, PORT_MODIFY and PORT_CUSTOM macros. Added a few notes about the inputs when I thought they were needed to avoid wrong bug reports. Started to clean the driver [Stephane Humbert]. - 0.122u8: Changed 68000 CPU1 clock speed to 16MHz. - 9th September 2007: David Haywood - CPS2 Generation: For a long time two CPS2 sets, the CPS2 versions of MegaMan and RockMan, have been left without a decryption key and thus been non-functional. The CPS1 versions have been supported for many years, but finding the keys for the CPS2 versions was proving to be very difficult as the CPS2 and CPS1 sets were not identical underneath the encryption due to hardware differences between the platforms. It had been assumed that the two versions were simply too different, to the point of giving up with the usual line of key finding attacks Nicola has used to find the keys for the other sets. However, after studying the sets myself I realised that a large amount of the code probably WAS the same, just offset in the rom. Many code functions were surrounded by similar data, and were of the same size in both versions. By assuming that these functions were the same, and realigning the code we ended up with a much closer match between the CPS1 and CPS2 sets, allowing the standard attack Nicola devised to work. As a result, keys have now been found for the CPS2 versions of the game. This means every currently supported CPS2 set has been decrypted. The Megaman CPS2 set is actually a limited release 'SAMPLE' version, as the game was (to my knowledge) never fully released in the US. The main differences in the CPS2 versions are the use of Qsound hardware for the sound, and an Eeprom to save game settings (as opposed to dipswitches). As a bonus (thanks to Chris Hardy) 2 new Euro parent sets are now supported and decrypted too: Dimahoo (Euro) and Street Fighter Alpha 3 (Euro). - 0.116u1: Nicola Salmoria updated CPS2 decryption bit order to match what is likely the original order. - 0.114u2: Couriersud fixed crash if you attempt to view graphics page 4. - 0.114: Aaron Giles fixed a MAME crash if you do a hardware reset. - 0.113u2: Changed VSync to 59.633333 Hz. - 0.112u2: Many more CPS2 keys added. Removed all XORs and support for them from MAME [Nicola Salmoria, Andreas Naive]. - 0.111u5: Nicola Salmoria removed XORs from almost all CPS2 games in place of proper emulation of the encryption. - 23rd January 2007: Guru - Here's a few pics of the very first custom chip that I sent to a professional Japanese IC decapping company that we (Mamedev) are using to help us with some MAME-related things. Hopefully if this is successful, more will follow and also hopefully talented hardware devs like JROK will be able to make replacements for it to repair real PCBs. You may also be wondering why we're doing this instead of using some other people who frequent the 'boards' who have offered to do this kind of thing for free? The answer is fairly simple.... apart from the amount of time it takes to get this done, the level of communication is somewhat 'sporadic' and so far offers to supply other chips to them have been ignored. We requested pics of some CPS2 ICs that were said to have been decapped and so far nothing has surfaced (over a month has passed since then). Doing it this way gives us more control over what we achieve and ensures the work is done in a timely manner. Apart from that, the plan to get this IC decapped has been in the works for several months, so we might as well use the professional IC decapping company whenever possible because the amount of ICs we need to decap is possibly too much work for someone to do in their spare time for free. - 0.111u3: Andreas Naive and Nicola Salmoria replaced CPS2 CHDs with preliminary decryption function. - 8th January 2007: Razoola - Nicola Salmoria of MAME Dev seems to have worked out the rest of the CPS2 algo (though there is still some s-boxes to complete), to quote his blog... * Take the 16-bit address and a 96-bit key and run them through the first Feistel network, to produce a 16-bit subkey. * Take the 16-bit ciphertext, 16-bit subkey, and another 96-bit key and run them through the second Feistel network, to produce the 16-bit plaintext. Our congratulations go out to him, again to Andreas Naive and also Charles MacDonald who all played a role to get to this point today. Looking back at the way things have gone from the first XOR release some six years ago (after the discovery of the main weakness in the system), we know some people were quite unhappy at our unwillingness to have this algo known for emulation (Statement of 7th Janurary 2001). It was always our intention to hold back information to help achieve this until the system was commercially dead (our view was 3 years after the last game released). It is very satisfying to know we achieved this as believe it or not Janurary 2007 is just past that three year mark (Hyper Street Fighter II was released in December 22nd 2003). I will update the encryption page with the details once Nicola has fully documented the Algo within MAME. - 0.110u4: CPS2 updates [David Haywood]: Added table for Jyangokushi (from Guru). Note that GFX/Sound roms aren't dumped on this one. Removed old 'handcrafted' XORs for games which we have CHDs for and replaced them with XORs generated from MAME using the CHD. This means anyone with the CHD can easily generate the XORs (using the code I've left in there) if they need to be able to run the games with a shorter startup time. Disabled the loading of the XORs by default for all sets with a CHD. Now only the CHD is loaded, unless the #define is changed at the top in which case only the XORs generated from the CHD are loaded. - 0.110u3: David Haywood added raw decryption table to choko. Enabled the use of the large CHD-based tables by default. - 0.110u2: David Haywood added support for using CHDs to decrypt CPS2 games. This code is disabled for the moment, but will be enabled in the future. Only a handful of games have complete tables so far. These tables are huge (~4GB) and uncompressable until the encryption algorithm is understood. - 19th September 2006: Charles MacDonald - With the success of the Choko dump from a while ago, I'm working to get the CPS-2 dumping tools and instructions updated. Changes were made from the last version, mostly bugfixes and speed-ups to decrease the amount of time it takes to dump a full table set. There's also a minor modification that needs to be done to the PCB, to ensure stability, though now that it's known which features are absolutely needed, I might redesign it. Admittedly not many people have been interested in getting more of the games dumped, probably because all the popular ones we wasted tons of quarters on are already emulated! - 0.105u3: Aaron Giles uncommented/added missing undumped ROMs/XORs in the CPS2 games. - 0.105u1: David Haywood updated CPS driver to more accurately draw tilemaps, based on evidence from a board with mixed ROMs. - 14th February 2006: Guru - A CPS2 USB adapter arrived, thanks to Charles MacDonald. The adapter plugs into the 64-pin CN7 on the B board. The chips on the bench are the original ROMs and PALs. ROM3 is changed and ROM10 is added. Plus 1 PAL on the A board is changed and 2 PALs on the B board are changed. Unfortunately, none of the PALs were socketed and this particular B board didn't have a CN7 connector! So I had to desolder a CN7 connector from another dead CPS2 board and solder it to this board and desolder and socket the 3 PALs as well! Luckily she still works! It's not that exciting to look at though. - 15th January 2006: Razoola - Nicola Salmoria has reported on his blog some progress in understanding the CPS2 algo. He has managed to shrink the current 8gig table of SFZ down to 4gig. This is the first breakthrough in understanding the encryption used. For more information visit his blog. - 11th January 2006: Charles MacDonald - I've tried to package and clean up all the CPS-2 related development stuff I have that was used for table dumping. This can be used for writing CPS-2 software, running tests on the system, and dumping table data so we can hopefully figure out the encryption at some point. I will definitely include more sample programs, documentation, and hardware information in future updates to the package, but I wanted to get this off my to-do list. - 5th January 2006: Razoola - While playing around coding on a dead CPS-2 board I have today I found that the encryption algo is still fully in place even after the CPS-2 board has suicided. That said, on examining values the number do not match those of the expected game. This almost certainly confirms that their is only _one_ algo over all CPS-2 games with the only difference being key data (like Kabuki on CPS-1). I passed some test code onto Charles MacDonald so that he can check the values he gets there (on his dead SFA3 board). Those should match what I see here and to be honest it looks just a formality. When you consider the watchdog on a suicide board is 0xFFFF,0xFFFF,0xFFFF (example opcode, CMPI.L #$FFFFFFFF,$FFFF0000) everything starts to make sence. There was a big debate over this going back to when we first broke past the protection. The worry voiced by some DEVs was that all boards would be needed again to get the algo for each game. This new discovery certainly confirms that once the algo is known for one game all the others can be brute forced using the XOR tables. As for figuring out the algo itsself whats needed now is a complete dump of tables (8gig) of the algo executing in this default state. Using this the algo should be easier to understand because any key data used for math should be 0xFFFF. I have quickly dumped a complete table for a couple of addresses and while it still looks a mess there are certinally more patterns compared to a normal game. Update: I've got word back from Charles and after some work (over irc) he has managed to get the same data I was seeing. This basically confirms what I mentioned above. There were some initial problems with his transfer system (which is far superior to mine) giving different results. It turned out that at some point during the process the protected RAM was being reprogrammed!!! The exact way this is happening is not yet known but it opens up some large posibilities if the cause can be found and understood. This situation did not happen when he was dumping games that were non suicide. It currently looks like there is no way to get a full 8gig table because the protected region in a suicide state seems to be only 0x10000 bytes where a complete table covers 0x20000 bytes. Hopefully we can get around this. - 4th January 2006: Razoola - I have written a small tool that can be programmed onto EPROM and used to test if a CPS2 board has suicided. - 19th November 2005: Charles MacDonald - Thanks to a generous donation from Razoola and the CPS2Shock team, I've been given B-boards for the following games: sfzj, csclubj and sfz3. I have dumped complete table sets from the first two and am doing tests on the latter. It has no battery, so I can see how the hardware works when the battery-backed SRAM is erased. With a much larger data set (32 GB) spanning four games, hopefully some patterns will be discovered. I'm still interested in dumping a regional variant for one of the currently dumped games to see what kinds of similarities might exist between the two. Most likely I will revise and release the tools and specifications for my CPS-2 development setup in the future. Then other people could dump table sets from their games and contribute to this project. There are so many CPS-2 games out there that I couldn't possibly do it all myself, nor would I want to. - 12th October 2005: Charles MacDonald - Getting a bunch of PCBs to work with in the next few weeks: three CPS-2 'B' boards (more on those next update), Shanghai for HD63484 tests, and a Quartet 2 board. I'll continue my CPS-2 research once the other games arrive. One of them has no battery so I can skip the annoying encryption and run tests directly, which will be a huge convenience. I think right now all the useful data that can be extracted from xmcota and pzloop2j has been obtained. - 30th September 2005: Charles MacDonald - I've been doing some research on the CPS-2 hardware in the last few months, starting as soon as the System 32 work was put on hold. I'll give a basic overview of the encryption, however I should point out I'm just elaborating on the findings that Razoola originally made, which are at CPS-2 Shock. As you can imagine the results of his prior experiments have been absolutely essential to this project. The CPS-2 hardware uses a custom 68000 CPU running at 16MHz, though the effective speed is lower due to video DMA. Out of the 16MB address range, the lower 4MB is allocated for ROMs storing program code and data. The first 1MB of this area is where decryption is enabled, though the exact boundary under the 4MB point may change from game to game. In addition to the address range check, there is a timer that expires after a certain amount of time has passed. When this happens, decryption is turned off and the 68K will execute code exactly as it is read from memory. A sequence of one or more specific instructions, changing on a per-game basis, will reset the timer and enable encryption again. The timer can be restarted after any duration from when it has expired. The decryption logic uses bits A16 through A1 of the 68K address bus, meaning the encryption wraps every 128K. For each encrypted word at a given address there is exactly one unique output; in contrast to the FD1094 there are no disabled opcodes or 'blanked' data that resolve to the same decrypted value. Data read from the supervisor or user code space is decrypted (e.g. opcodes and operands) and data from the supervisor or user data space is not. The size of a complete set of decrypted data for one game quite large, totalling 8GB - it takes forever to dump. There are no duplicate tables within a game's table set or between sets for different games, though I've only examined tables dumped from the two 'B' boards I have. I've discussed analysis of the table data with a few other people and so far the encryption seems to be pretty tough to solve. As a result, I think progress will depend on additional help. If you have skill in this type of thing (strong mathematics background and familiarity with encryption) and would like to lend a hand, then please get in contact with me. Working with the CPS-2 hardware has been challenging due to the large amount of custom parts involved. I designed a communications board with a USB adapter, DTACK generator, and interface to the CPS-2 video and peripheral bus to run software on it, as well as several adapters to replace the 16V8 GALs with more capable 22V10 GALs that have their own shared I/O bus. Small update for some common questions: The two games I've dumped are xmcota and pzloop2j, which are both already emulated in MAME. The ETA for a complete table dump (65,536 files) is 9 hours, and it's fully automated. Sometimes the system locks up randomly and has to be reset which slows things down, this occured quite a lot for pzloop2j and not at all for xmcota. They have different types of B boards, perhaps that has something to do with it. Many people are suggesting to look at Street Fighter Zero and it's variants, as well as Rockman which had a less common CPS-2 release but is very similar to the CPS-1 version. The only thing that would be really useful is to find two games that are encrypted with the same or similar keys, so unless Rockman has an identical key as another game it's not that useful. I would be interested in getting data out of another variant of xmcota. - 0.94u2: Aaron Giles fixed CPS2 QSound routing. - 27th October 2004: Razoola - There seems to be someone making quick hacks of XOR files we have released in the past to get games running which don't currently have XORs. While this sounds a good thing it's actually no different than using the region switch option in kawaks for example. The big problem is that these new XOR's contain incorrect information in relation to what the real encryption would return for many addresses when compared to real hardware. It also makes it less likely for these games to be donated in the future so good XOR's can be created as people will think they already have good XOR's. The reality is these new hacked XOR's are prone to all the bugs that come with using region switching in CPS2 games. It's for these reasons that I want it known I have nothing to do with these hacks and I would advise against them being used officially in any emulator as they cannot guarantee an accurate game. - 0.71u2: Shiriru fixed CPS2 raster effect. - 19th January 2003: Shiriru's updates to the CPS-2 driver fixing raster effects. - 8th December 2002: Barry Rodewald submitted a bug fix for resetting the Z80 in the CPS-2 driver, and smf improved the fix. - 19th November 2002: Shiriru's updates containing fixed sprite masking in the CPS-2 driver and fixed sprite delay in Battle Bakraid were also forwarded. - 13th September 2002: Barry Rodewald submitted a fix for the CPS-2 driver to reset the Z80 properly after exiting service mode. - 6th September 2002: Barry Rodewald submitted an improvement to the CPS-2 driver raster effects' emulation, improving many cases, however it still causes flicker from time to time. - 11th August 2002: Two of Shiriru's old updates were forwarded, which fix background colors and BG/sprite sync in the Cave driver and sprite masking in the CPS-2 driver. - 12th May 2002: Barry Rodewald submitted an update to the CPS-2 driver supporting raster effects, but it unfortunately causes the background / sprite sync to be broken. - 25th August 2001: Aaron Giles fixed a decryption problem which caused CPS-2 not to work. - 0.54: Major changes to the CPU interface. As a result of this, some games are temporarily broken, most notably CPS2 [Aaron Giles]. - 0.37b16: Removed vidhrdwcps2.c. Shiriru fixed sprite priorities in CPS2 games. Fixed user1 roms addresses. - 16th June 2001: Shiriru fixed sprite priority and added sprite transparency in the CPS-2 games. - 1st June 2001: Nicola Salmoria fixed CPS-2 games from crashing when resetting them. - 0.37b14: Changed 68000 CPU1 clock speed to 11.8MHz and VSync to 59.633331 Hz. - 0.37b13: Changed 68000 CPU1 clock speed to 12MHz. - 16th February 2001: Nicola Salmoria fixed the input ports for third and fourth player in the CPS-2 games. - 10th January 2001: Paul Leaman added the necessary modifications to the CPS-1 driver to allow CPS-2 emulation, and he added support for Street Fighter Zero. - 27th January 2001: Paul Leaman added Vampire: The Night Warriors to the CPS-2 driver, and like Vampire Savior, it will not work before some important 68k core changes are made. - 26th January 2001: Paul Leaman added Vampire Savior to the CPS-2 driver, but it needs some 68k core changes to get it working properly. - 0.36b3: Added cps2.c driver and vidhrdwcps2.c. |
PCB information
| batcir | Battle Circuit (Euro 970319)[Jul/14/99] Battle Circuit (Japan) CPS2 B-Board Green QSound Version 1.16B / CPS2 / APRIL 1996 - |
| dimahoo | Dimahoo (Euro 000121)[Apr/20/2001] Great Mahou Daisakusen (JPN Ver.) (c)2000 Capcom / Raizing CP-SYTEM II Board No. 93646B-7 Ver. 000121 GMD_01.BIN [3f9bc985] 131,072 GMD_02.BIN [3fd39dde] 131,072 GMDJ_03.BIN [cd6979e3] 524,288 GMDJ_04.BIN [37485567] 524,288 GMDJ_05.BIN [da269ffb] 524,288 GMDJ_06.BIN [55b483c9] 524,288 GMD-11M.BIN [06a65542] 4,194,304 GMD-12M.BIN [50bc7a31] 4,194,304 GMD-13M.BIN [80dd19f0] 4,194,304 GMD-15M.BIN [dfd93a78] 4,194,304 GMD-17M.BIN [16356520] 4,194,304 GMD-19M.BIN [dfc33031] 4,194,304 Dumped 20/Apr/2001 - |
| ddtod | Dungeons & Dragons: Tower of Doom (Euro 940412)[Jan/24/98] Dungeons & Dragons¨ Tower of Doom ©1993 SSI All rights reserved ©1993 TSR, Inc. All rights reserved ©1993 Capcom Co., Ltd. All rights reserved DAD-01.BIN -- 27C010 DAD-11M.BIN -- 27C160 DAD-12M.BIN -- 27C160 DAD-13M.BIN -- 27C160 DAD-14M.BIN -- 27C160 DAD-15M.BIN -- 27C160 DAD-16M.BIN -- 27C160 DAD-17M.BIN -- 27C160 DAD-18M.BIN -- 27C160 DAD-19M.BIN -- 27C160 DAD-20M.BIN -- 27C160 DADU-03B.BIN -- 27C4096 DADU-04B.BIN -- 27C4096 DADU-05B.BIN -- 27C4096 DADU-06.BIN -- 27C4096 DADU-07.BIN -- 27C4096 |
| gigawing | Giga Wing (USA 990222)[Apr/13/2001] Giga Wing (JPN Ver.) (c)1999 Capcom / Takumi CP-SYTEM II Board No. 93646B-7 Ver. 990223 GGW_01.BIN [4c6351d5] 131,072 GGWJ_03A.BIN [fdd23b91] 524,288 GGWJ_04A.BIN [8c6e093c] 524,288 GGWJ_05A.BIN [43811454] 524,288 GGW-11M.BIN [e172acf5] 4,194,304 GGW-12M.BIN [4bee4e8f] 4,194,304 GGW-13M.BIN [105530a4] 4,194,304 GGW-15M.BIN [9e774ab9] 4,194,304 GGW-17M.BIN [466e0ba4] 4,194,304 GGW-19M.BIN [840c8dea] 4,194,304 Dumped 13/Apr/2001 |
| jyangoku | Jyangokushi: Haoh no Saihai (Japan 990527)[Jul/14/2002] JYANGOKUSHI -HAOH NO SAIHAI-(JAPAN 990527) (c)1999 Capcom maj.01 131072 1fe8c213 majj.03 524288 4614a3b2 maj.1 ? Coming Soon maj.3 ? Coming Soon maj.s5 4194304 DF2AC481 Dumped 03/23/2002 07/14/2002 - |
| mmatrix | Mars Matrix: Hyper Solid Shooting (USA 000412)[Apr/13/2001] Mars Matrix (JPN Ver.) (c)1999 Capcom / Takumi CP-SYTEM II Board No. 93646B-7 Ver. 000412 MMX_01.BIN [c57e8171] 131,072 MMXJ_03.BIN [1d5de213] 524,288 MMXJ_04.BIN [d943a339] 524,288 MMXJ_05.BIN [0c8b4abb] 524,288 MMX-11M.BIN [4180b39f] 4,194,304 MMX-12M.BIN [95e22a59] 4,194,304 MMX-13M.BIN [04748718] 4,194,304 MMX-14M.BIN [d52bf491] 4,194,304 MMX-15M.BIN [38074f44] 4,194,304 MMX-16M.BIN [23f70780] 4,194,304 MMX-17M.BIN [e4635e35] 4,194,304 MMX-18M.BIN [2562c9d5] 4,194,304 MMX-19M.BIN [4400a3f2] 4,194,304 MMX-20M.BIN [583a9687] 4,194,304 Dumped 13/Apr/2001 |
| msh | Marvel Super Heroes (Euro 951024)[Jun/12/98] Marvel Super Heroes by Capcom CPS2 6/11/1998 - |
| mshvsf | Marvel Super Heroes Vs. Street Fighter (Euro 970625)[Nov/23/1999] ------------------------------------------ Marvel S Heroes Vs. Street Fighter (USA) ------------------------------------------ Filename: mshvsfu.zip Revision: 970625 mshvsf.01 131072 68252324 z80 mshvsf.02 131072 b34e773d z80 mshvsf_u.c03 524288 ae60a66a Code mshvsf_u.c04 524288 91f67d8a Code mshvsf_u.c05 524288 1a5de0cb Code mshvsf_u.c06 524288 959f3030 Code mshvsf_u.c07 524288 7f915bdb Code mshvsf_u.c08 524288 c2813884 Code mshvsf_u.c09 524288 3ba08818 Code mshvsf_u.c10 524288 cf0dba98 Code mshvsf.s11 4194304 86219770 Samples mshvsf.s12 4194304 f2fd7f68 Samples mshvsf.g13 4194304 29b05fd9 Gfx mshvsf.g14 4194304 b3b1972d Gfx mshvsf.g15 4194304 faddccf1 Gfx mshvsf.g16 4194304 08aadb5d Gfx mshvsf.g17 4194304 97aaf4c7 Gfx mshvsf.g18 4194304 c1228b35 Gfx mshvsf.g19 4194304 cb70e915 Gfx mshvsf.g20 4194304 366cc6c2 Gfx - [Jan/11/2000] Marvel vs Street Fighter Japan Dumped ... - |
| mpang | Mighty! Pang (Euro 001010)[Oct/28/2001] MIGHTY PANG (JAPAN 001011) (c)2000 Mitchell/Capcom mpn.01 131072 90C7ADB6 mpnj.03a 524288 BF597B1C mpnj.04a 524288 F4A3AB0F 10/27/2001 - |
| nwarr | Night Warriors: Darkstalkers' Revenge (Euro 950316)[Mar/27/2001]
------------------------------------------
Night Warriors (USA)
Capcom CPS-2
------------------------------------------
Revision: 950406
vph.01 131072 5045dcac z80
vph.02 131072 86b60e59 z80
vphu.03f 524288 85d6a359 Code
vphu.04c 524288 cb7fce77 Code
vphu.05e 524288 e08f2bba Code
vphu.06c 524288 08c04cdb Code
vphu.07b 524288 b5a5ab19 Code
vphu.08b 524288 51bb20fb Code
vphu.09b 524288 41a64205 Code
vphu.10b 524288 2b1d43ae Code
vph.11 2097152 e1837d33 Samples
vph.12 2097152 fbd3cd90 Samples
vph.13 4194304 c51baf99 Gfx
vph.14 4194304 7a0e1add Gfx
vph.15 4194304 3ce83c77 Gfx
vph.16 4194304 2f41ca75 Gfx
vph.17 4194304 4f2408e0 Gfx
vph.18 4194304 64498eed Gfx
vph.19 4194304 9ff60250 Gfx
vph.20 4194304 17f2433f Gfx
- |
| progear | Progear (USA 010117)[Dec/03/2001] PROGEAR No ARASHI (JAPAN 010117) (c)2001 Cave/Capcom pga.01 131072 BDBFA992 pgaj.03 524288 06DBBA54 pgaj.04 524288 A1F1F1BC pga.1 ? ?(SIMM. Can't dump) pga.3 ? ?(SIMM. Can't dump) pga.5 ? ?(SIMM. Can't dump) pga.6 ? ?(SIMM. Can't dump) Dumped 11/25/2001 - |
| pzloop2 | Puzz Loop 2 (Euro 010302)[Jul/14/2002] PUZZ LOOP 2 (JAPAN 20010205) (c)2001 Mitchell/Capcom pl2.01 131072 35697569 pl2j.03a 524288 0A751BD0 pl2j.04a 524288 C3F72AFE pl2j.05a 524288 6EA9DBFC pl2j.06a 524288 0F14848D pl2.1 ? Coming soon pl2.3 ? Coming soon pl2.s5 4194304 43C5FF97 Dumped 08/25/2001 07/14/2002 - |
| sfa | Street Fighter Alpha: Warriors' Dreams (Euro 950727)[Nov/21/2000] Street Fighter Zero (Old 1 Ver.) (c)1995 Capcom CP-SYTEM II Board No. 93646B-7 Ver. 950627 SFZ_01.BIN [545a0e37] 131,072 SFZ_02.BIN [45f46a08] 131,072 SFZJ_03B.BIN [844220c2] 524,288 SFZJ_04A.BIN [5f99e9a5] 524,288 SFZJ_05A.BIN [0810544d] 524,288 SFZJ_06.BIN [806e8f38] 524,288 SFZ-11M.BIN [c4b093cd] 2,097,152 SFZ-12M.BIN [8bdbc4b4] 2,097,152 SFZ-14M.BIN [90fefdb3] 2,097,152 SFZ-16M.BIN [5354c948] 2,097,152 SFZ-18M.BIN [41a1e790] 2,097,152 SFZ-20M.BIN [a549df98] 2,097,152 Dumped 11/21/2000 - |
| sgemf | Super Gem Fighter Mini Mix (USA 970904)[Mar/27/2001]
------------------------------------------
Super Gem Fighter Mini Mix (USA)
------------------------------------------
Filename: sgemf.zip Revision: 970904
pcf.01 131072 254e5f33 z80
pcf.02 131072 6902f4f9 z80
pcfu.03 524288 ac2e8566 Code
pcf.04 524288 f4314c96 Code
pcf.05 524288 215655f6 Code
pcf.06 524288 ea6f13ea Code
pcf.07 524288 5ac6d5ea Code
pcf.11 4194304 a5dea005 Samples
pcf.12 4194304 4ce235fe Samples
pcf.13 4194304 22d72ab9 Gfx
pcf.14 1048576 0383897c Gfx
pcf.15 4194304 16a4813c Gfx
pcf.16 1048576 76f91084 Gfx
pcf.17 4194304 1097e035 Gfx
pcf.18 1048576 756c3754 Gfx
pcf.19 4194304 d362d874 Gfx
pcf.20 1048576 9ec9277d Gfx
- |
| ssf2 | Super Street Fighter II: The New Challengers (World 930911)[Jan/17/2000] SSF.Q1 Soldered on daughterboard SSF.Q2 Soldered on daughterboard SSF.Q3 Soldered on daughterboard SSF.Q4 Soldered on daughterboard SSF.Q5 Soldered on daughterboard SSF.Q6 Soldered on daughterboard SSF.Q7 Soldered on daughterboard SSF.Q8 Soldered on daughterboard Ref number daughterboard 93646E-2 get these files from the existing dumps. - [Nov/9/2006] Street Fighter II' Turbo hack Ultimo aggiornamento 9/11/2006 Anno Produttore N.revisione CPU Main cpu 68000 Sound cpu Z80 Sound ics: ym2151 + ym3012, OKI6295 Osc: 16,12 and 3,58 Mhz ROMs sf2th-4 to sf2th-7 main program sf2th-8 to sf2th-12 graphics Sound rom files aren't present because they are identical of SF2 set (sf2_9.bin prg, sf2_18 and sf2_19 ADPCM data) The rest of gfx roms are x12 16bit mask roms (identified by pinouts as 27c400 equivalent) and aren't present yet because they are soldered on board,but i suppose that they are identical to existing set. Eproms are 27c040,27c010,27c512 and 27c1024 16bit (sf27h-9 to sf2th-12) Note This romset comes from a bootleg/hacked SF2 pcb.I cannot know differences because pcb is faulty. Funzionamento Non Funzionante In vendita No Dumped 08/11/2006 - |
| vhunt2 | Vampire Hunter 2: Darkstalkers Revenge (Japan 970929)[Mar/31/2001]
------------------------------------------
Vampire Hunter 2 (Jap)
Capcom CPS-2
------------------------------------------
Filename: vhunt2.zip Revision: 970913
vh2.01 131072 67b9f779 z80
vh2.02 131072 aaf15fcb z80
vh2j.03 524288 1a5feb13 Code
vh2j.04 524288 434611a5 Code
vh2j.05 524288 de34f624 Code
vh2j.06 524288 6a3b9897 Code
vh2j.07 524288 b021c029 Code
vh2j.08 524288 ac873dff Code
vh2j.09 524288 eaefce9c Code
vh2j.10 524288 11730952 Code
vh2.11 4194304 38922efd Samples
vh2.12 4194304 6e2430af Samples
vh2.13 4194304 3b02ddaa Gfx
vh2.14 4194304 cd09bd63 Gfx
vh2.15 4194304 4e40de66 Gfx
vh2.16 4194304 e0182c15 Gfx
vh2.17 4194304 b31d00c9 Gfx
vh2.18 4194304 778dc4f6 Gfx
vh2.19 4194304 149be3ab Gfx
vh2.20 4194304 605d9d1d Gfx
- |
| xmvsf | X-Men Vs. Street Fighter (Euro 961004)[Mar/23/2002] X-Men Vs. Street Fighter (JAPAN 960909) (c)1996 Capcom xvsj.03c 524288 180656a1 xvsj.04c 524288 5832811c xvsj.05 524288 030e0e1e xvsj.06 524288 5d04a8ff Dumped 03/23/2002 |
2004-2008 MAWS all copyrights belong to their respective owners