Reverse engineering the Capcom Kabuki CPU

[ArcadeHacker]

Hi all,

As some of you know I recently announced the successful reverse engineering of the Kabuki CPU found in games such as Pang or Cadillacs & Dinosaurs.

As promised here is the next article in the series:
http://arcadehacker.blogspot.com/2014/1 ... art-1.html

You can also read the intro in case you missed it.
arcadehacker.blogspot.com/2014/11/capco ... intro.html

Regards.

[Braintrash]

You take too much time. Want my articles faster.

[ArcadeHacker]

You take too much time. Want my articles faster.

No worries, just two more to go, so two more weeks

[Braintrash]

Ouch. I hoped for something longer.

I love these technical articles and just can't get enough of them.

[geotrig]

good read dude

[Spectre]

Enjoying following this, great work.

Question #1
What happens after Kabuki has lost power and its memory contents gone? After all memory is memory and it must return to a known state. Do all decoding keys go back to 00? or perhaps FF?

If all keys become 00/FF, would it be possible to patch the security to expect this key? I think I'm right in saying this is exactly why the security on SF3.2i doesn't work (uses an all zero key, which is exactly what you get once the battery is dead anyway).

[ArcadeHacker]

Hi all, I just published the next article in the series, find it here:

http://arcadehacker.blogspot.com/2014/1 ... art-2.html

[Spectre]

Excellent progress, looking forward to the next part.

Would a standard z80 plus patched (zero key) code work? Or are their other differences with kabuki besides the protection?

[ArcadeHacker]

Good point but not zeroed keys since that would still be encrypted code and regular z80 cpus dont understand that. Read my next post on sunday and you will see something similar that works

Excellent progress, looking forward to the next part.

Would a standard z80 plus patched (zero key) code work? Or are their other differences with kabuki besides the protection?

[Spectre]

Cool, looking forward to it

[ArcadeHacker]

Dear all, I just published the next article in the series, find it here:

http://arcadehacker.blogspot.com/2014/1 ... art-3.html

[Braintrash]

It's quite interesting, thank you.

[Spectre]

Very clever

[geotrig]

excellent stuff

[Kretinou]

Nice work !

[ArcadeHacker]

Dear all, I just published the next article in the series, you can find it here:

http://arcadehacker.blogspot.com/2014/1 ... art-4.html

Happy holidays.

[CTN]

very impressive video
and ideal lunch break size

[trap15]

Incredible stuff. Finished watching the video and was sad the next part wasn't already up I was afraid going into the series you were just gonna do silly ROM patching but you're really getting in there. Inspiring

[ArcadeHacker]

Thanks guys, i'm very happy about the project outcome and the overall community response.

[Spectre]

This part largely went over my head, but still very interesting stuff. Thanks for sharing