View Single Post
Old 02 January 2013, 16:54   #1
CaptainM68K-SPS France
dlfrsilver's Avatar
Join Date: Dec 2004
Location: Melun nearby Paris/France
Age: 39
Posts: 6,470
Send a message via MSN to dlfrsilver
copy protections hacking on CPS-1 hardware

I have lately been creating unprotected sets for the capcom CPS1 system protected by suicide battery. You remember Parasol stars on amiga with its 17 or 18 checksums ?

A game like Slam masters use 67 checksums which are XORing the tile layer bit enable/disable, with indirect use in registers....

It looks like a sort of hardware copylock, with hardware chip CPS-B adress modifications.

I have done also Three Wonders Euro phoenix set and also the japanese release, wonder 3 Jap. This one alone needs 350 modifications in the code.

btw, the tile layer enable disable is very simple and very complex, and is based on a word : for instance, a single Move #$12C0, D0 and move D0, $800160 (this value can change from game to game protected by the battery), displays no layers.

the activation is done by using bits : a game like slam masters use bit 2 (0x0004) for layer 0, bit 3 (0x0008) for layer 1 and bit 4 (0x0010) for layer 2.

to display layer 0 it's like 12C0+04=12C4 $12C4 is the word when pushed in the address register $80016a (control video register). for layer 1, $12C8 and layer 2 $12D0. You can there mix the values, like displaying layer 0 and 1 or 1 and 2 or 0,1,2 all together. $12DC display all the layers at the same time.

what i have discovered is that the CPS-1 games are games coded with a specialized tool to gain some development time, and made of clever and very clean ASM routines, all tight together by a C linker.

I have done Warriors of fate ETC latest revision, slam masters ETC, three wonders, king of dragons ETC (both releases, only the latest has still a missed checksum, i must clear that out), both JAP releases, The punisher ETC, Captain commando, etc etc.....

I'm actually fighting with quiz and dragons, which has also checksums to defeat And also capcom world 2 jap.

Muscle Bomber Duo ETC and Varth Japan are in the pipe too
dlfrsilver is offline  
AdSense AdSense  
Page generated in 0.05216 seconds with 9 queries