What's new
By:

Sega Model 2 / 3 hacked romsets?

Darksoft

Darksoft

Staff member
Immortal
Joined
Jun 12, 2015
Messages
12,260
Reaction score
18,409
Location
Poland
I just opened this new section. Just wondering if anyone every saw or tried any Model 2 / 3 Romsets that don't need the security PCB?

not all games require one, but some like Daytona USA 2 do.

Pinging @Apocalypse @brizzo :thumbsup:
 
I haven't looked @ Model 2/3 yet, those systems are a bit too "modern" for me so won't probably ever play them.
However the fact that not all games require a security PCB is interesting, it probably means main code can be hacked to work without it just like System 32.
Given the security algorithm is in MAME it seems doable to move it to the progam ROMs (again, just like some System 32 games like The J.League 94).
 
I think Andy Geezer offers security board conversion for model 3.

There are secret codes to change pcb region on model 3 too.
 
Curious, how useful this is? Don't see tons of people trying to swap model 2/3 games due to the bulk.
 
@Darksoft

I have not looked into Model 2/3 myself. Lots of great tools for analyzing ppc code

Checking out the mame driver and other info on the hardware, seems like conversions would be a ton of work programming chips!

Does the hardware "Step 1.0/1.5/2.0/2.1" create restrictions on source and target conversions? What sets need deprotection and why?
 
I wasn't thinking on conversions which will be for sure complicated but rather on patching security board checks so one can play other games without having the original protection device.
 
Confused. To play other games, wouldn't it be necessairy to swap the rom's?
Maybe it's easier to swap the rom board with the roms?
Besides mame, there is also the supermodel 3 emulator which is open source and might reveal how the security is handeled.
 
obcd said:
Confused. To play other games, wouldn't it be necessairy to swap the rom's?
Maybe it's easier to swap the rom board with the roms?
Besides mame, there is also the supermodel 3 emulator which is open source and might reveal how the security is handeled.
Click to expand...
Yes, that'r right and would be a lot of work. I've done it though :) Look at the prices for some of these games like Call Ambulance...

In some cases you can find a Rom Board for a good price but comes without security board...
 
  • Like
Reactions: nem
I seem to remember that most of those roms are OTP, so you will need to buy a set of pin compatible eproms to change the code so it can run without protection board. You will also need a programmer that can handle those large eprom types. (Some only support up to 32 pin eproms)
 
obcd said:
I seem to remember that most of those roms are OTP, so you will need to buy a set of pin compatible eproms to change the code so it can run without protection board. You will also need a programmer that can handle those large eprom types. (Some only support up to 32 pin eproms)
Click to expand...
I got all of these. And my Wellon VP-496 can handle them all.
 
That makes more sense, I wasn't aware it was common to find the rom boards for sale stand alone -- but odd they would lose the security chip that goes with it :(
 
brizzo said:
odd they would lose the security chip that goes with it
Click to expand...
it's the same reason 90% of the Chihiros are missing the video AB cable, Ops pulling the machine apart to sell for parts don't realize you need both.

you have a Model 3 game that stops working they pull the ROM board to sell and junk the rest, now you're missing the security board.
 
obcd said:
I seem to remember that most of those roms are OTP, so you will need to buy a set of pin compatible eproms to change the code so it can run without protection board. You will also need a programmer that can handle those large eprom types. (Some only support up to 32 pin eproms)
Click to expand...
Those are just 27C322 or 27C160 equivalent (42 pins), they are very common and supported by most programmers (given they have a 42 pin socket).
 
I had a quick look for Virtual ON 2 (game is stated as working in MAME).
Program ROMs are loaded in RAM and then the 315-581 key is used for decryption:

MAME said:
AM_RANGE(0x00000000, 0x007fffff) AM_RAM AM_SHARE("work_ram") /* work RAM */
Click to expand...
MAME said:
ROM_START( von2 ) /* Step 2.0, Sega game ID# is 833-13346, ROM board ID# 834-13347 VOT, Security board ID# 837-13379-COM */

...

// ???? 317-0234-COM Model 3
ROM_PARAMETER( ":315_5881:key", "292a0e97" )
ROM_END
Click to expand...
To confirm that, I've recompiled MAME to change von2 from model3_20_5881:

MAME said:
GAME( 1998, von2, 0, model3_20_5881, model3, model3_state, von2, ROT0, "Sega", "Virtual On 2: Oratorio Tangram (Revision B)", MACHINE_NOT_WORKING | MACHINE_IMPERFECT_GRAPHICS | MACHINE_IMPERFECT_SOUND )
Click to expand...
To model3_20 (no encryption):

MAME said:
GAME( 1998, von2, 0, model3_20, model3, model3_state, von2, ROT0, "Sega", "Virtual On 2: Oratorio Tangram (Revision B)", MACHINE_NOT_WORKING | MACHINE_IMPERFECT_GRAPHICS | MACHINE_IMPERFECT_SOUND )
Click to expand...
To me we could use MAME to decrypt the game and then re-inject the decrypted code in the program ROMs.
Only issue is when trace is activated game becomes really slow.
And as usual we have to unsure all branches are decrypted.

Anyone with a spare encrypted Model2/Model3 game (supported in MAME obviously)?
 
i have a 2b running virtual-on - atleast it should run if i fix the ram error.
is that encrypted??
 
Apocalypse said:
Anyone with a spare encrypted Model2/Model3 game (supported in MAME obviously)?
Click to expand...
I have a Model 3 VOT 5.2A ROM board/security board I could let you borrow, but I'd need it back when you're done. took me quite a while and cost me quite a bit to obtain it in the first place.
 
i need to look at mame,
i'd love to turn my VF3 into Ocean Hunter.
 
You must log in or register to reply here.
Back
Top