leonardoliveira & Idc's clean decrypted roms

PCB problems and fixes
User avatar
idc
Ralf Little impersonator
Posts: 1311
Joined: October 16th, 2008, 9:17 pm
Location: Tamworth, Staffordshire
eBay: iancourt
Initials: IAN

Re: leonardoliveira & Idc's clean decrypted roms

Post by idc »

enricnes wrote:Well, I have a suicided blue AvP, Europe version I guess, but no idea of revision, how can I find out the revision date on a suicided one? I also have SSFII, green region, again no idea of revision date either... I know I could buy the phoenix version for those ...
AvP is going to be 940520. I don't think there is another revision. You can tell by comparing the ROM labels against cps2.c in the MAME source.
ImageImageImageImage
Image
User avatar
Spectre
By Spectre
Posts: 1694
Joined: January 22nd, 2009, 5:42 pm
Location: Suffolk, UK
eBay: spectre-uk
Initials: JIM

Re: leonardoliveira & Idc's clean decrypted roms

Post by Spectre »

Would love to see an asian street fighter zero set (for zero in english, rather than alpha), but I guess that can be xor clashed once the sfa set is confirmed working. Will try to burn that new version soon 8-)
enricnes
Please Continue...
Posts: 34
Joined: November 7th, 2012, 11:39 am
Location: Spain
eBay: qnadal

Re: leonardoliveira & Idc's clean decrypted roms

Post by enricnes »

Hi again,
it's been a long time since my computer science studies, but maybe if some of you made an instructional video, we could give a hand... So far I understand that the heavy work is interpreting what is code and what is data.
enricnes
Please Continue...
Posts: 34
Joined: November 7th, 2012, 11:39 am
Location: Spain
eBay: qnadal

Re: leonardoliveira & Idc's clean decrypted roms

Post by enricnes »

idc wrote:AvP is going to be 940520. I don't think there is another revision. You can tell by comparing the ROM labels against cps2.c in the MAME source.
I had read the comments at the beginning of cps2.c but I didn't go further. Are the CRCs from the ROM definitions for the encrypted ROMs then?
User avatar
leonardoliveira
Please Continue...
Posts: 692
Joined: August 30th, 2012, 5:53 am
Location: Brazil
Initials: leo

Re: leonardoliveira & Idc's clean decrypted roms

Post by leonardoliveira »

enricnes wrote:Hi again,
it's been a long time since my computer science studies, but maybe if some of you made an instructional video, we could give a hand... So far I understand that the heavy work is interpreting what is code and what is data.
Exactly and for that to work there's two ways:

Xor clash
Analyze decrypted dump (with garbaged data from decryption process in it) in IDA and search for data references.

I am fairly satisfied with the result of reverse-engineering the roms in IDA, but honestly it's HEAVY work. While something like Choko took me measly eight hours of work something very complex like D&D takes like a month of work with a daily work load of 4 to 5 hours.

One of the most complex games I did was Ultimate Ecology. When I was halfway through it's code I found an intentionally added displacement which I was able to manipulate in order of making the game suitable for XOR clash attack. Once I did that, I got the game fully working in a matter of hours in mame. Fast forward some frustrated attempts of making it run on real hardware due to some funky RAM clear code and it was up and running.

Fail free.

So in the end it's something which is very unique for each game. :roll:
Making a guide on how to decrypt the games is something quite unpractical because each game need a slightly different approach.
Image
User avatar
Spectre
By Spectre
Posts: 1694
Joined: January 22nd, 2009, 5:42 pm
Location: Suffolk, UK
eBay: spectre-uk
Initials: JIM

Re: leonardoliveira & Idc's clean decrypted roms

Post by Spectre »

I'm having trouble burning rom 03 of the sfz2a asian decrypted set put together by you fine fellows. I keep getting;

>>Device Address:00000131H Device Data:0081H Buffer Address:00000262H Buffer Data:0001H
>>Program fail!


Have tried three times, blank check successful each time... is my m27c problematic or is there something wrong with the rom image? Re-downloading made no difference.

Sorry if this is something a bit noobish. I have no idea how to more thoroughly erase the bugger... :shifty:
User avatar
Spectre
By Spectre
Posts: 1694
Joined: January 22nd, 2009, 5:42 pm
Location: Suffolk, UK
eBay: spectre-uk
Initials: JIM

Re: leonardoliveira & Idc's clean decrypted roms

Post by Spectre »

Slightly better news is the updated sfa beta now appears to work fine on my board :awe:
User avatar
Rossyra
Supermod
Posts: 7905
Joined: February 12th, 2009, 1:24 am
Location: UK

Re: leonardoliveira & Idc's clean decrypted roms

Post by Rossyra »

Occasionally you just get a bad rom.

Is it a Hitachi 4096? Those are a real pain to erase properly.
Image
User avatar
idc
Ralf Little impersonator
Posts: 1311
Joined: October 16th, 2008, 9:17 pm
Location: Tamworth, Staffordshire
eBay: iancourt
Initials: IAN

Re: leonardoliveira & Idc's clean decrypted roms

Post by idc »

Spectre wrote:I'm having trouble burning rom 03 of the sfz2a asian decrypted set put together by you fine fellows. I keep getting;

>>Device Address:00000131H Device Data:0081H Buffer Address:00000262H Buffer Data:0001H
>>Program fail!


Have tried three times, blank check successful each time... is my m27c problematic or is there something wrong with the rom image? Re-downloading made no difference.

Sorry if this is something a bit noobish. I have no idea how to more thoroughly erase the bugger... :shifty:
This is with a GQ-4X and 16-bit adapter, right? I encountered this a lot with Hitachi HN27C2096 chips. Try de-soldering the capacitor (10uf) from the adapter PCB. It's part of a noise filter circuit, but it seems to cause more problems than it solves. Removing it will have no ill effects and the Hitachi ROMs should program without issue.
Spectre wrote:Slightly better news is the updated sfa beta now appears to work fine on my board :awe:
:awe:
ImageImageImageImage
Image
User avatar
Rossyra
Supermod
Posts: 7905
Joined: February 12th, 2009, 1:24 am
Location: UK

Re: leonardoliveira & Idc's clean decrypted roms

Post by Rossyra »

Your 16-bit adapter might have a jumper to bypass the cap, save desoldering it.
Image
User avatar
idc
Ralf Little impersonator
Posts: 1311
Joined: October 16th, 2008, 9:17 pm
Location: Tamworth, Staffordshire
eBay: iancourt
Initials: IAN

Re: leonardoliveira & Idc's clean decrypted roms

Post by idc »

Rossyra wrote:Your 16-bit adapter might have a jumper to bypass the cap, save desoldering it.
That would be a newer revision, indeed. Even better if it has, eh? :awe:
ImageImageImageImage
Image
User avatar
Spectre
By Spectre
Posts: 1694
Joined: January 22nd, 2009, 5:42 pm
Location: Suffolk, UK
eBay: spectre-uk
Initials: JIM

Re: leonardoliveira & Idc's clean decrypted roms

Post by Spectre »

Wellon VP280 and ST M27C4002. I put the little **** in the nuker for an hour before I went to bed, so will see if that's made any difference. :problem:

Update; no, still the same. Is there anything I can try to fix this or do I need to source another chip? :roll:
User avatar
davewellington
The Librarian
Posts: 1389
Joined: July 7th, 2010, 1:42 am
Location: Wellington, New Zealand
Initials: DAV

Re: leonardoliveira & Idc's clean decrypted roms

Post by davewellington »

Every third or so board I flash seems to have 1 EPROM that will error like that, luckily i've got some scrap CPS2 games to source parts from.
all your wiki pages belong to me
User avatar
Spectre
By Spectre
Posts: 1694
Joined: January 22nd, 2009, 5:42 pm
Location: Suffolk, UK
eBay: spectre-uk
Initials: JIM

Re: leonardoliveira & Idc's clean decrypted roms

Post by Spectre »

Guess I'll have to source a replacement then, can anybody suggest an idiot proof ebay search term for a compatible part? They're all just chips to me and "m27c4002" brought up zero results :oops:
User avatar
andygeezer
Blue Skies Ahead
Posts: 2427
Joined: August 24th, 2008, 12:25 pm
Location: Cambridge, UK
Initials: AGS

Re: leonardoliveira & Idc's clean decrypted roms

Post by andygeezer »

Spectre wrote:Guess I'll have to source a replacement then, can anybody suggest an idiot proof ebay search term for a compatible part? They're all just chips to me and "m27c4002" brought up zero results :oops:
I have loads of 4002s I am sure
Say hello to my little friend...
Image
VectorGlow
Posts: 502
Joined: November 8th, 2008, 11:40 pm
Location: Wales, UK
eBay: realflight

Re: leonardoliveira & Idc's clean decrypted roms

Post by VectorGlow »

Spectre wrote:Guess I'll have to source a replacement then, can anybody suggest an idiot proof ebay search term for a compatible part? They're all just chips to me and "m27c4002" brought up zero results :oops:
A handy reference from AO:

http://wiki.arcadeotaku.com/w/EPROM#4_m ... _or_16_bit"

:)
Arcade game board repairer
User avatar
Spectre
By Spectre
Posts: 1694
Joined: January 22nd, 2009, 5:42 pm
Location: Suffolk, UK
eBay: spectre-uk
Initials: JIM

Re: leonardoliveira & Idc's clean decrypted roms

Post by Spectre »

VectorGlow wrote: A handy reference from AO:

http://wiki.arcadeotaku.com/w/EPROM#4_m ... _or_16_bit"

:)
Grassyarse, so are all 5 variants fit for purpose?
Phexe
Please Continue...
Posts: 118
Joined: June 22nd, 2012, 4:13 pm
Location: LAve

Re: leonardoliveira & Idc's clean decrypted roms

Post by Phexe »

hey guys, i made up a video for running Third strike on a Battery free cart. Hopefully its simple enough for everyone to follow;

User avatar
bringbackyun
Please Continue...
Posts: 24
Joined: October 26th, 2012, 7:30 pm
Location: Cambridge, UK
eBay: summersid
Initials: MDS

Re: leonardoliveira & Idc's clean decrypted roms

Post by bringbackyun »

Phexe wrote:hey guys, i made up a video for running Third strike on a Battery free cart. Hopefully its simple enough for everyone to follow;
Nice video Phexe. Probably worth noting that you can swap the disks while in the rewrite menu, this should save you two power cycles.
User avatar
richy13
Ming the Merciless
Posts: 792
Joined: July 25th, 2009, 12:38 am
Location: UK
eBay: ...

Re: leonardoliveira & Idc's clean decrypted roms

Post by richy13 »

bringbackyun wrote:
Phexe wrote:hey guys, i made up a video for running Third strike on a Battery free cart. Hopefully its simple enough for everyone to follow;
Nice video Phexe. Probably worth noting that you can swap the disks while in the rewrite menu, this should save you two power cycles.
you mean swapping simms on a "live" board :think: