(Kawaks / Nebula) King of Fighters 2003 News IV

**Agozer** · February 4, 2004

Wrong forum. Why did you double-post?

**James** · February 4, 2004

Wrong forum. Why did you double-post?

Deleted .... they were warned.

Edited February 4, 2004 by james

cosmic_lord · February 4, 2004

Actually double posting isn't much to him. In the other thread that we moved here from, he posted the exact same thing like 8 times in a row.

cosmic_lord · February 4, 2004

Allright, I looked into the question I asked earlier. Apparently, in the driver for kof2003, in the line ROM_LOADp2 etc etc, 0x500000,0x200000

the 500000 is the address it loads the p2 rom to in the memory region.

I'm not used to writing drivers so I don't know what that means, but somebody should. But still what bugs me is that the mame driver lists the p2 rom as 0x200000 for its size. The p2 rom I have (that works on mame with this driver) is 0x400000 and has the same CRC as the p2 rom the driver reports as 0x200000.

How? Mame must somehow dice up the p2 rom... I've tried all the combinations of 2 roms I can think of to try and get the right CRC and none of them worked, so I don't know.

Anyway, I was thinking, in kawaks or nebula dat files. For example, kof2003

271-p1.bin,0,400000,92ed6ee3,0

Well, from running these tests, I know that if you leave the CRC slot with a 0, nebula determines it dynamically. So, I'm assuming that the 0 following the CRC slot is the SHA1 slot, and every rom I've seen leaves it with a 0 to let it be determined dynamically because CRC is accurate enough to identify a rom. But I'm going to put in the right SHA1 values and see if it helps any, give me some feedback here people.

aquasync · February 5, 2004

Its not surprising that your longer p rom has the same crc. if you check, the extra length will be all 0 - thats the idea of the rom_continue parts in the mame driver.

Skid - yeah, i checked to see if the table is static, or rotates around a finite number, with a number of dumps - but it changes continually.

One big difference between kof2003 and mslug5, is the write to the p rom (only ever the same spot).

When you start the game, it has a lot of code that sort of initializes the table i found, with a fairly obvious looking pattern. From then on it just goes berserk.

cosmic_lord · February 5, 2004

So... are you saying that if the p2 rom was changed to be 0x200000 in size, tand still have that same crc, the ROM_CONTINUE portion would be unnecessary?

skid · February 6, 2004

From what you just said, if you re structured the p rom in a hex editor to make it satisfy the forumla for the typical bank switch, would that not work?

After restructuring, at least part of the rom would need to be modified so that kof2003 knows it has been restructured. For example, the part of the rom that says, "jump to point b" would need to be changed to jump to the place where the code has been moved. I don't think this would be an easy thing to do.

One big difference between kof2003 and mslug5, is the write to the p rom (only ever the same spot).

I think that is part of the protection. Try commenting out this line in the driver and you'll find that the game resets just before a new game is started. This is typical for what protection schemes do - they allow the demo to run but won't allow anybody to play the game. Since it is only at the one memory location, I'd guess that this should be easy to crack.

*(((unsigned char *)memory_region(REGION_CPU1))+0x58196)=kof2003_tbl[0xff9]&0xff;

I also found that mslug5 uses only 4 banks and all of the banks are at 1meg boundaries.

Edited February 6, 2004 by skid

N3oGhost · February 6, 2004

so what relationship does the P roms have to the C roms?

would it be possible to restructure the P but then just change the order of the C roms?

or am i talkin out of my arse?

lol

N3oGhost · February 6, 2004

This is the driver used to run KOF2000 on FBA

How similar is this to the Mame driver for KOF2000?

Im wondering if by comparing this one with mame we can do similar changes (where needed) to run kof2k3 on FBA (i know this is kawaks thread but there is no FBA thread and the smart cookies hang out here)

// The King Of Fighters 2000 (encrypted code & grahics)

static struct BurnRomInfo kof2000RomDesc[] = {
{"257-sma.bin",0x040000, 0x71C6E6BB, 0x10}, // 0 68K code
{"257-p1.bin", 0x400000, 0x60947B4C, 0x10}, // 1
{"257-p2.bin", 0x400000, 0x1B7EC415, 0x10}, // 2

{"257-c1.bin", 0x800000, 0xCEF1CDFA, 1}, // 3 Sprite data
{"257-c2.bin", 0x800000, 0xF7BF0003, 1}, // 4
{"257-c3.bin", 0x800000, 0x101E6560, 1}, // 5
{"257-c4.bin", 0x800000, 0xBD2FC1B1, 1}, // 6
{"257-c5.bin", 0x800000, 0x89775412, 1}, // 7
{"257-c6.bin", 0x800000, 0xFA7200D5, 1}, // 8
{"257-c7.bin", 0x800000, 0x7DA11FE4, 1}, // 9
{"257-c8.bin", 0x800000, 0xB1AFA60B, 1}, // 10

{"257-m1d.bin",0x040000, 0xD404DB70, 0x10}, // 11 Z80 code (decrypted)
{"257-m1.bin", 0x040000, 0x4B749113, 0x10}, // 11 Z80 code

{"257-v1.bin", 0x400000, 0x17CDE847, 2}, // 12 Sound data
{"257-v2.bin", 0x400000, 0x1aFB20FF, 2}, // 13
{"257-v3.bin", 0x400000, 0x4605036A, 2}, // 14
{"257-v4.bin", 0x400000, 0x764BBD6B, 2}, // 15
};

STDROMPICKEXT(kof2000, kof2000, neogeo);
STD_ROM_FN(kof2000);

static void kof2000SMADecrypt()
{
for (int i = 0; i < 0x800000 / 2; i++) {
((unsigned short*)Neo68KROM02)[i] = BITSWAP16(((unsigned short*)Neo68KROM02)[i], 12, 8, 11, 3, 15, 14, 7, 0, 10, 13, 6, 5, 9, 2, 1, 4);
}

for (int i = 0; i < 0x0C0000 / 2; i++) {
((unsigned short*)Neo68KROM01)[i] = ((unsigned short*)Neo68KROM01)[0x73A000 / 2 + BITSWAP24(i, 23, 22, 21, 20, 19, 18, 8, 4, 15, 13, 3, 14, 16, 2, 6, 17, 7, 12, 10, 0, 5, 11, 1, 9)];
}

for (int i = 0; i < 0x63A000 / 2; i += 0x0800 / 2) {
unsigned short nBuffer[0x0800 / 2];
memcpy(nBuffer, &((unsigned short*)Neo68KROM02)[i], 0x0800);
for (int j = 0; j < 0x0800 / 2; j++) {
((unsigned short*)Neo68KROM02)[i + j] = nBuffer[BITSWAP24(j, 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13, 12, 11, 10, 4, 1, 3, 8, 6, 2, 7, 0, 9, 5)];
}
}
}

void __fastcall kof2000WriteWordBankswitch(unsigned int sekAddress, unsigned short wordValue)
{
if (sekAddress == 0x2FFFEC) {
static unsigned int bankoffset[64] = {
0x000000, 0x100000, 0x200000, 0x300000, // 00
0x3f7800, 0x4f7800, 0x3ff800, 0x4ff800, // 04
0x407800, 0x507800, 0x40f800, 0x50f800, // 08
0x416800, 0x516800, 0x41d800, 0x51d800, // 12
0x424000, 0x524000, 0x523800, 0x623800, // 16
0x526000, 0x626000, 0x528000, 0x628000, // 20
0x52a000, 0x62a000, 0x52b800, 0x62b800, // 24
0x52d000, 0x62d000, 0x52e800, 0x62e800, // 28
0x618000, 0x619000, 0x61a000, 0x61a800, // 32
};

// Unscramble bank number
int nBank =
(((wordValue >> 15) & 1) << 0) +
(((wordValue >> 14) & 1) << 1) +
(((wordValue >> 7) & 1) << 2) +
(((wordValue >> 3) & 1) << 3) +
(((wordValue >> 10) & 1) << 4) +
(((wordValue >> 5) & 1) << 5);

if (bankoffset[nBank] != nNeo68KROMBank) {
nNeo68KROMBank = bankoffset[nBank];
SekMapMemory(Neo68KROM02 + nNeo68KROMBank, 0x200000, 0x2FE3FF, SM_ROM);
SekMapMemory(Neo68KROM02 + nNeo68KROMBank + 0x0FE800, 0x2FE800, 0x2FFBFF, SM_ROM);
}
}
}

static int kof2000Init()
{
nNeoTextROMSize = 0x080000;
nNeoProtectionXor = 0x00;

nNeoSMARNGAddress[0] = 0x2FFFD8; nNeoSMARNGAddress[1] = 0x2FFFDA;
pNeoSMABankswitch = kof2000WriteWordBankswitch;
pNeoInitCallback = kof2000SMADecrypt;

return NeoInit();
}

struct BurnDriver BurnDrvkof2000 = {
{"kof2000", "The King of Fighters 2000", NULL, "SNK", "Neo Geo", "2000", NULL, "neogeo"},
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_ENCRYPTED_B | HARDWARE_SNK_ALTERNATE_TEXT | HARDWARE_SNK_SRAM | HARDWARE_SNK_SMA_PROTECTION,
NULL, kof2000RomInfo, kof2000RomName, neogeoInputInfo, neogeoDIPInfo,
kof2000Init, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};

Edited February 6, 2004 by N3oGhost

Xeon · February 6, 2004

somone at ROMShare Forums posted a preliminary driver for FBA, and you can safely assume that it didnt work. but its a start

heres the posted driver

// King of Fighters 2003

static struct BurnRomInfo kof2003RomDesc[] = {
{"271-p1.bin", 0x400000, 0x92ed6ee3, 0x10}, // 0 68K code
{"271-p2.bin", 0x400000, 0x5d3d8bb3, 0x10}, // 0 68K code

{"271-s1.bin", 0x020000, 0xc47f8ac3, 1}, // 1 Text layer tiles

{"271-c1d.bin", 0x800000, 0xe42fc226, 1}, // 2 Sprite data
{"271-c2d.bin", 0x800000, 0x1b5e3b58, 1}, // 3
{"271-c3d.bin", 0x800000, 0xd334fdd9, 1}, // 4
{"271-c4d.bin", 0x800000, 0xd457699, 1}, // 5
{"271-c5d.bin", 0x800000, 0x8a91aae4, 1}, // 6
{"271-c6d.bin", 0x800000, 0x9f8674b8, 1}, // 7
{"271-c7d.bin", 0x800000, 0x374ea523, 1}, // 8
{"271-c8d.bin", 0x800000, 0x75211f4d, 1}, // 9

{"271-m1d.bin", 0x080000, 0xe86af8f, 0x10}, // 10 Z80 code

{"271-v1d.bin", 0x400000, 0xd2b8aa5e, 2}, // 11 Sound data
{"271-v2d.bin", 0x400000, 0x71956ee2, 2}, // 12
{"271-v3d.bin", 0x400000, 0xddbbb199, 2}, // 13
{"271-v4d.bin", 0x400000, 0x1b90c4f, 2}, // 14
};

STDROMPICKEXT(kof2003, kof2003, neogeo);
STD_ROM_FN(kof2003);

static unsigned short kof2003_tbl[0x1000];

void __fastcall kof2003WriteWordBankswitch(unsigned int sekAddress, unsigned short wordValue)
{
if (sekAddress == 0x2fe000) {
//kof2003_tbl[sekAddress]=(kof2003_tbl[sekAddress]&mem_mask)|((~mem_mask)&wordValue);
if(sekAddress>0xff9) return;
nNeo68KROMBank = ((kof2003_tbl[0xff8]>>8)|(kof2003_tbl[0xff9]<<8))+0x100000;
SekMapMemory(Neo68KROM02 + nNeo68KROMBank, 0x??????, 0x??????, SM_ROM); 
}
}

static void kof2003Patch()
{
*((unsigned short*)(Neo68KROM01 + 0x1ff0)) = 0xa0;
*((unsigned short*)(Neo68KROM01 + 0x1ff1)) = 0xfe;
*((unsigned short*)(Neo68KROM01 + 0x1ff3)) = 0x7f;
*((unsigned short*)(Neo68KROM01 + 0x58196)) = kof2003_tbl[0xff9]&0xff;
}

static int kof2003Init()
{
//nNeoTextROMSize = 0x080000;
pNeoSMABankswitch=kof2003WriteWordBankswitch;
pNeoInitCallback = kof2003Patch;
return NeoInit();
}


struct BurnDriver BurnDrvkof2003 = {
{"kof2003", "The King of Fighters 2003", NULL, "Playmore", "Neo Geo", "2003", NULL, "neogeo"},
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_SWAPC,
NULL, kof2003RomInfo, kof2003RomName, neogeoInputInfo, neogeoDIPInfo,
NeoInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};

i tried to make some fixes here and there myself but everything has just gone to worse.

Edited February 6, 2004 by Xeon

**James** · February 6, 2004

somone at ROMShare Forums posted a preliminary driver for FBA, and you can safely assume that it didnt work. but its a start

heres the posted driver

// King of Fighters 2003

static struct BurnRomInfo kof2003RomDesc[] = {
{"271-p1.bin", 0x400000, 0x92ed6ee3, 0x10}, // 0 68K code
{"271-p2.bin", 0x400000, 0x5d3d8bb3, 0x10}, // 0 68K code

{"271-s1.bin", 0x020000, 0xc47f8ac3, 1}, // 1 Text layer tiles

{"271-c1d.bin", 0x800000, 0xe42fc226, 1}, // 2 Sprite data
{"271-c2d.bin", 0x800000, 0x1b5e3b58, 1}, // 3
{"271-c3d.bin", 0x800000, 0xd334fdd9, 1}, // 4
{"271-c4d.bin", 0x800000, 0xd457699, 1}, // 5
{"271-c5d.bin", 0x800000, 0x8a91aae4, 1}, // 6
{"271-c6d.bin", 0x800000, 0x9f8674b8, 1}, // 7
{"271-c7d.bin", 0x800000, 0x374ea523, 1}, // 8
{"271-c8d.bin", 0x800000, 0x75211f4d, 1}, // 9

{"271-m1d.bin", 0x080000, 0xe86af8f, 0x10}, // 10 Z80 code

{"271-v1d.bin", 0x400000, 0xd2b8aa5e, 2}, // 11 Sound data
{"271-v2d.bin", 0x400000, 0x71956ee2, 2}, // 12
{"271-v3d.bin", 0x400000, 0xddbbb199, 2}, // 13
{"271-v4d.bin", 0x400000, 0x1b90c4f, 2}, // 14
};

STDROMPICKEXT(kof2003, kof2003, neogeo);
STD_ROM_FN(kof2003);

static unsigned short kof2003_tbl[0x1000];

void __fastcall kof2003WriteWordBankswitch(unsigned int sekAddress, unsigned short wordValue)
{
if (sekAddress == 0x2fe000) {
//kof2003_tbl[sekAddress]=(kof2003_tbl[sekAddress]&mem_mask)|((~mem_mask)&wordValue);
if(sekAddress>0xff9) return;
nNeo68KROMBank = ((kof2003_tbl[0xff8]>>8)|(kof2003_tbl[0xff9]<<8))+0x100000;
SekMapMemory(Neo68KROM02 + nNeo68KROMBank, 0x??????, 0x??????, SM_ROM); 
}
}

static void kof2003Patch()
{
*((unsigned short*)(Neo68KROM01 + 0x1ff0)) = 0xa0;
*((unsigned short*)(Neo68KROM01 + 0x1ff1)) = 0xfe;
*((unsigned short*)(Neo68KROM01 + 0x1ff3)) = 0x7f;
*((unsigned short*)(Neo68KROM01 + 0x58196)) = kof2003_tbl[0xff9]&0xff;
}

static int kof2003Init()
{
//nNeoTextROMSize = 0x080000;
pNeoSMABankswitch=kof2003WriteWordBankswitch;
pNeoInitCallback = kof2003Patch;
return NeoInit();
}


struct BurnDriver BurnDrvkof2003 = {
{"kof2003", "The King of Fighters 2003", NULL, "Playmore", "Neo Geo", "2003", NULL, "neogeo"},
BDF_GAME_WORKING, 2, HARDWARE_SNK_NEOGEO | HARDWARE_SNK_SWAPC,
NULL, kof2003RomInfo, kof2003RomName, neogeoInputInfo, neogeoDIPInfo,
NeoInit, NeoExit, NeoFrame, NeoRender, NeoScan, &NeoRecalcPalette,
nNeoScreenWidth, 224, 4, 3
};

i tried to make some fixes here and there myself but everything has just gone to worse.

May i ask what happens when you try to load the game ?

Xeon · February 6, 2004

nothing, the same grid of death screen as usual. like i said, the driver is preliminary, or maybe i should say a rough translation from the MAME driver.

**James** · February 6, 2004

nothing, the same grid of death screen as usual. like i said, the driver is preliminary, or maybe i should say a rough translation from the MAME driver.

Ok thank you :lol:

Iori Yagami · February 6, 2004

I hear these guys have news:

http://fightersgym.killeens.com/forum/index.php? s=c0842fae5ea058ffcdd2d58da24fbaf3&showtopic=652&st=140entry21478

alphabetman · February 6, 2004

i don't see any news on that page that we don't have here

Sign In

(Kawaks / Nebula) King of Fighters 2003 News IV

Recommended Posts

Agozer

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

James

cosmic_lord

cosmic_lord

aquasync

cosmic_lord

skid

N3oGhost

N3oGhost

Xeon

James

Xeon

James

Iori Yagami

alphabetman

Browse

Activity