What's new
By:

Model 2 /3 Security hacks

nem said:
Anything else?
Click to expand...
I think there are only 4 games:

//0229 Protection
Dead or Alive

//5881 Protection
Dynamite Cop/Dynamite Deka 2
Pilot Kids
Zero Gunner

If you look at the "machine state" listed in MAME these are the only ones that include any kind of crypt.
 
Well, Daytona USA TTM kit comes with a separate security board that has a PIC, so that definitely has protection. However, it's not an official game. Looking around there's also Daytona GTX 2004 Edition, which is a similar hack.

Sega Ski Super G is listed under MACHINE_UNEMULATED_PROTECTION in Mame.

I guess it's just those then.
 
hmm, yeah I guess if they're not running in MAME there's no guarantee that the driver has the security implemented.

I recently picked up an original Zero Gunner board stack If anyone needs info on that.
 
Trol said:
Pilot kids jumper settings

Tested and working :thumbup:
Click to expand...
Just wanted to say thanks to everyone who's helped with the Pilot Kids jumper settings - got my ROM board working now!

The only issue is that the Test and Service buttons on the PCB don't work - could that be to do with any jumper settings? Those buttons do work when I put a Virtua Striker ROM board on, so it's not the buttons themselves that are faulty.
 
2huwman said:
The only issue is that the Test and Service buttons on the PCB don't work - could that be to do with any jumper settings? Those buttons do work when I put a Virtua Striker ROM board on, so it's not the buttons themselves that are faulty.
Click to expand...
do the buttons work through the connector on the filter board?
 
Good question - I've only tried it on my supergun so far which doesnt have those buttons wired up. I can try it on my Virtua Striker cab later in the week - but I would have thought that the test and service buttons on the PCB should always work?

EDIT - realised my supergun does have those buttons wired up to the filterboard, but pressing them still doesn't activate the test menu.

Can anyone with Pilot Kids access the test menu with the above jumper settings?
 
Last edited:
I would guess it has less to do with the jumpers and more to do with the security patch.

it's seems unlikely that incorrect jumpers would have such a small and specific effect on the game.
 
No test mode here either.
I've tried the original roms with my DOA security board, no response from the test button.
Same goes for the unencrypted roms.
 
twistedsymphony said:
I would guess it has less to do with the jumpers and more to do with the security patch.

it's seems unlikely that incorrect jumpers would have such a small and specific effect on the game.
Click to expand...
Yeah turns out my security patches were not 100% and started to "wig-out graphically in gameplay" so whoever was stupid enough to distribute them before testing has caused a lot of false issues.
 
My Pilot Kids jumpers match the previous pic. My test button on my supergun does work.

IMG_8691.JPG
 
Do you guys know if Spikeout Digital Battle Online & Spikeout Final Edition used the same sound roms in the DSB2?
 
So, what should we do to get the ball rolling? XD
Let's take Zero Gunner 2b as example, i have read some stuff about the 5881 protection and i was able to find this in the model2cpp:

// 1997 317-5038-COM Model 2 ROM_PARAMETER( ":315_5881:key", "042c0d13" )

So, i assume thats the key right?I'm a total donkey when speaking about code/emulation stuff, could be this handy to figure out the decprition?Please teach us somebody!
 
TheDeath said:
So, what should we do to get the ball rolling? XD
Let's take Zero Gunner 2b as example, i have read some stuff about the 5881 protection and i was able to find this in the model2cpp:

// 1997 317-5038-COM Model 2 ROM_PARAMETER( ":315_5881:key", "042c0d13" )

So, i assume thats the key right?I'm a total donkey when speaking about code/emulation stuff, could be this handy to figure out the decprition?Please teach us somebody!
Click to expand...
If you want to try my hack(s) maybe we can finish them off?
The problem was no boards for testing in hardware here (and i think my tester(s) had a faulty board / bad config? who knows...).
 
Hammy said:
TheDeath said:
So, what should we do to get the ball rolling? XD
Let's take Zero Gunner 2b as example, i have read some stuff about the 5881 protection and i was able to find this in the model2cpp:

// 1997 317-5038-COM Model 2 ROM_PARAMETER( ":315_5881:key", "042c0d13" )

So, i assume thats the key right?I'm a total donkey when speaking about code/emulation stuff, could be this handy to figure out the decprition?Please teach us somebody!
Click to expand...
If you want to try my hack(s) maybe we can finish them off?The problem was no boards for testing in hardware here (and i think my tester(s) had a faulty board / bad config? who knows...).
Click to expand...
Let's do this! :thumbsup:
 
I'm pairing with @Hammy works to test the mods.
In 0229 protection, DOA is working but we still have the same issues from the previous tester. Kasumi polygons are messed up and the game freeze after few minutes in a match.
There's something involved in eeproms speed access. This game refused to have above 95/100Ns for the main program at IC15&16, but i'm sure this involves also the whole 27c322 set. I got all 100ns of these and it seems finding something below that is a challange.
I hope i don't have to make some tsop adapting in order to have better access time (is there any 27c322 equivalent is tssop form? i haven't check yet).
All the other Model2 convert i've made use 120/150ns for the main code and they just work fine, it's a big guess at the moment.
Jumper settings were taken off the Japanese manual for DOA and they look like stock configuration.
Unfortunatly it's impossible to find a picture of the real board (2b version, obviously) and compare/guarantee those are all right.

thumbnaiwl.jpg

thumwbnail.jpg


Last, speaking of 5881 protection, i was able to boot Pilot Kids.
I ran out for 27c322 but the game is booting up and play. It's still early to say if this is 100% playable but at least we got something to begin with.
I would also need the picture of the real board in order to compare my jumpers. These were left stock aswell.
Code is running up on 120ns but sometimes it does not boot al all, no idea if related to lack of eeproms or they, again, need to be faster. I'll change them too just to be sure.


thumbnail.jpg



Hope you like the progress so far :)
 
You must log in or register to reply here.
Back
Top