| info |
0.92 [Charles MacDonald, Nicola Salmoria]
0.74u2 [Andrew Prime]
0.36b2 [Andrew Prime]
TODO:
- Wanted: 317-183/185/188/189 FD1094 CPUs
Bugs:
- Vertical line glitch during intro. This bug does not occur on v0.90. only after 90+. ddcrew095u2gre sjyune (ID 00997)
WIP:
- 0.118u1: Fixed rom names.
- 0.99: Nicola Salmoria and Chris Hardy fixed 1-bit errors in decryption keys for Crack Down and one for D.D.Crew (set 4, FD1094 317-0190) - Game now playable.
- 0.95u2: Chack'n added clone D. D. Crew (set 5, Japan, 2 Player, FD1094 317-0182). Chris Hardy added FD1094 317-0190 key to D. D. Crew (set 4, World, 3 Player). Hangs when you select character, needs investigation.
- 0.93: David Haywood fixed cpu2 rom loading.
- 0.92: Renamed (ddcrew) to clone (ddcrewu), (ddcrewc) to (ddcrew), (ddcrewa) to (ddcrew1) and (ddcrewb) to (ddcrew2).
- 0.90u4: Andreas Thorsen and Thierry added FD1094 317-0184 key to clone D.D.Crew (World, 2 Player, FD1094 317-0184).
- 0.89u1: Thierry Lescot added 317-unknown.key to D.D. Crew (World, 4 Player). Aaron Giles fixed column scroll (attract mode scrolls properly now) and cleaned up inputs in D.D. Crew. Added dipswitches 'Credits needed', 'Switch To Start', 'Coin Chute', 'Demo Sounds', 'Player Start/Continue' and 'Difficulty' - Game now playable.
- 24th November 2004: Thierry Lescot - Dumped the cpus from D.D.Crew (Europe, 4 Player), Ryukyu and Bloxeed (system18, japan).
- 0.89: David Haywood improved inputs in DDCrew, all 4 players can now be used, although only the service coin works.
- 0.88u7: Aaron Giles makes D.D. Crew fully playable, but it requires inputs to be fixed (currently only service coin and controls for 1 player work). Fixed gfx1/2 rom loading.
- 0.88u3: Added new 317-0186.key
- 0.88u2: Added FD1094 317-0186.key
- 0.88u1: Fixed D. D. Crew - Game now playable [Charles MacDonald, Nicola Salmoria, David Haywood]. Incomplete sound emulation, still some serious gfx problems in places. Changed region gfx1/2 to gfx3/4.
- 28th October 2004: David Haywood - I've added some crude banking support to D.D. Crew and Clutch Hitter, improves some (but not all) gfx.
- 0.88: Charles MacDonald and Nicola Salmoria added clones D. D. Crew (Europe, 2 Player, 317-0184), (Europe, 3 Player, 317-0187) and (Europe, 4 Player, 317-?). Some issues with system18 emulation. Changed description to 'D. D. Crew (US, 4 Player, 317-0186)'.
- 30th September 2004: Charles MacDonald - Here's D.D. Crew (System 18, 317-0186) decrypted and running. This game has a custom chip on the ROM board that adds a layer of abstraction to the regular sprite and tile banking controls. It may also be used for accessing program ROM contents with data shuffled around as a form of protection. The VDP seems to be heavily used, getting that hooked up will probably make for more interesting screenshots. I think this is why the bootleg D.D. Crew board had such a poor looking title screen, because the bootleggers just left out the VDP chip rather than copy it which would be a fairly difficult task. I'd bet the bootleg version of Alien Storm has no background graphics in the first person shooting stages for the same reason, even though the VDP setup code is still present. D.D. Crew pipes nearly all of the video data through the protection chip, so the game looks terrible even though it's running correctly. It also gets the address of some tables through the chip, which come out wrong and cause problems. The protection chip is programmable and has 16 registers that are updated during V-Blank, so it's not exactly simple. I tackled this game in a completely different way compared to what was done with Tetris. Instead of putting fragments of encrypted code together, I decrypted the entire ROM in each state that the game used. The 68000 emulator was modified to keep track of the decryption state and switch decrypted ROM images as needed. If a state is ever selected that has no corresponding table, the emulator exits gracefully and tells me what to dump next. Because the game actually works, this shows that current assumptions about how the decryption state is managed are correct. The upshot of this method is that you no longer have to identify all of the executable code in a game, just the states that are used. This can be determined by running the game in an emulator in the reset state, and dumping more data each time an unknown state comes up. D.D. Crew only uses 6 or so states, so analyzing disassemblies was all that was needed. I'll try to get the graphics fixed soon. The banking/protection chip will hopefully not be a problem, I have several System 18 boards with the same part and can run tests on it.
- 18th September 2004: Charles MacDonald - Great news, I've been able to sucessfully decrypt any 16K block from D.D. Crew. It should be possible to decrypt the entire game at this point. Because D.D. Crew is so large, I'm going to work on Tetris first. The decryption state can be changed by the programmer at almost any point in the game's code, you have to trace through the code which is a tedious process. D.D. Crew changes the state a lot but only uses the same few arguments, so one solution would be to decrypt the entire ROM multiple times with different compares being used, and then patch together the correct parts. Tetris only changes the state four times in the startup code and doesn't do anything afterwards, making it a better choice to work with.
- 16th September 2004: Charles MacDonald - Today I dumped about 512MB worth of tables for D.D Crew and was able to decrypt a reasonable portion of the startup code using a much smaller subset of that data. Also, comparisons between the Tetris CPU tests and D.D. Crew CPU show all the usual similarities; the direct opcodes are the same, PC relative instructions are missing, decryption repeats every 16K, etc. No surprises which is a good thing, I'd assume all other FD1094 CPUs work in the same way. A new finding is that within a 16K block, certain addresses (no relation to each other, seems random) have the same table output. So you don't get completely unique tables for every address within a 16K block. In theory this means a smaller set of tables would be needed per block, but there doesn't seem to be any apparent way to tell which addresses will decrypt identically. The D.D. Crew decryption was done using tables from $10000-$12000. The initial PC and SP don't come out correctly, even though they should work with table data from offsets $10000-$10007. At least determining the entry point is pretty easy to do, not being able to decrypt it (so far) will not be a problem for other games.
- 18th March 2004: Charles MacDonald fixed Z80 clock (8.192 Mhz -> 8.00 MHz).
- 0.74u2: Added DD Crew (Sega 1991).
- 0.36b2: Andrew Prime added DD Crew (Testdriver).
LEVELS: 7
Recommended Games (Street Fighter):
Knuckle Joe
My Hero
Renegade
Trojan
Trojan (PlayChoice-10)
Avengers
Double Dragon
Double Dragon II
Double Dragon 3
Double Dragon (PlayChoice-10)
Double Dragon (Neo-Geo)
Ginga NinkyouDen
Kyros
Shinobi
Shinobi (Mega-Tech)
The Revenge of Shinobi (Mega-Tech)
Shinobi III (Mega Play)
Bad Dudes vs. Dragonninja
Shadow Warriors
Vigilante
Crime Fighters
DownTown
Final Fight
Gang Wars
Last Battle (Mega-Tech)
Ninja Gaiden (PlayChoice-10)
Ninja Gaiden Episode II (PlayChoice-10)
Ninja Gaiden Episode III (PlayChoice-10)
Shadow Dancer
Tough Turf
The Combatribes
Crude Buster
Growl
Mug Smashers
64th. Street
Brute Force
Captain Commando
D. D. Crew
Karate Blazers
Riot City
Vendetta
Big Fight
Guardians of the Hood
Silent Dragon
Undercover Cops
Cadillacs and Dinosaurs
Knuckle Bash
Knuckle Bash 2
Ninja Baseball Batman
The Punisher
Streets of Rage II (Mega Play)
Violent Storm
Pretty Soldier Sailor Moon
Final Fight 2
Osman
Sonic Blast Man 2 Special Turbo
Spikeout
Spikeout Final Edition
Vamp 1/2
Thunder Heroes
Romset: 7560 kb / 20 files / 920 zip
|
