0.92 [Charles MacDonald, Nicola Salmoria]
0.74u2 [Andrew Prime]
0.36b2 [Andrew Prime]

TODO:
* Wanted: 317-0183/0185/0188/0189 FD1094 CPUs

Bugs:
- Vertical line glitch during intro. This bug does not occur on v0.90. only after 90+. sjyune (ID 00997)

WIP:
- 0.138: Changed parent description set 'D. D. Crew (set 4, World, 3 Player, FD1094 317-0190)' to 'D. D. Crew (World, 3 Player, FD1094 317-0190)' clones 'D. D. Crew (set 5, Japan, 2 Player, FD1094 317-0182)' to 'D. D. Crew (Japan, 2 Player, FD1094 317-0182)', 'D. D. Crew (set 3, US, 4 Player, FD1094 317-0186)' to 'D. D. Crew (US, 4 Player, FD1094 317-0186)', 'D. D. Crew (set 2, World, 2 Player, FD1094 317-0184)' to 'D. D. Crew (World, 2 Player, FD1094 317-0184)' and 'D. D. Crew (set 1, World, 4 Player, FD1094 317-0187)' to 'D. D. Crew (World, 4 Player, FD1094 317-0187)'.
- 0.118u1: Changed description of clone 'D. D. Crew (set 1, World, 4 Player, FD1094 317-?)' to 'D. D. Crew (set 1, World, 4 Player, FD1094 317-0187)'. Fixed rom names.
- 0.99: Nicola Salmoria and Chris Hardy fixed 1-bit errors in decryption keys for D.D.Crew (set 4, FD1094 317-0190) - Game now playable.
- 0.95u2: Chack'n added clone 'D. D. Crew (set 5, Japan, 2 Player, FD1094 317-0182)'. Chris Hardy added FD1094 317-0190 key to D. D. Crew (set 4, World, 3 Player). Hangs when you select character, needs investigation. Changed description to 'D. D. Crew (set 4, World, 3 Player, FD1094 317-0190)'.
- 0.93: David Haywood fixed cpu2 rom loading.
- 0.92: Changed 'D. D. Crew (US, 4 Player, FD1094 317-0186)' to clone '(set 3, US, 4 Player, FD1094 317-0186)', '(World, 3 Player, FD1094 317-0187)' to parent 'D. D. Crew (set 4, World, 3 Player, FD1094 317-0187)', '(World, 4 Player, FD1094 317-?)' to '(set 1, World, 4 Player, FD1094 317-?)' and '(World, 2 Player, FD1094 317-0184)' to '(set 2, World, 2 Player, FD1094 317-0184)'. Renamed (ddcrew) to (ddcrewu), (ddcrewc) to (ddcrew), (ddcrewa) to (ddcrew1) and (ddcrewb) to (ddcrew2).
- 0.90u4: Andreas Thorsen and Thierry added FD1094 317-0184 key to clone D.D.Crew (World, 2 Player, FD1094 317-0184).
- 0.90u1: Big Sega update [Aaron Giles]. Note that in the process, there is now a 1-pixel column error on DDCrew's attract mode. These are known issues that I will try to address soon.
- 0.89u1: Aaron Giles fixed column scroll (attract mode scrolls properly now) and cleaned up inputs in D.D. Crew - Game now playable. Thierry Lescot added 317-unknown.key to D.D. Crew (World, 4 Player). Added dipswitches 'Credits needed', 'Switch To Start', 'Coin Chute', 'Demo Sounds', 'Player Start/Continue' and 'Difficulty'. Changed description of clone '(Europe, 4 Player, FD1094 317-?)' to '(World, 4 Player, FD1094 317-?)', '(Europe, 2 Player, FD1094 317-0184)' to '(World, 2 Player, FD1094 317-0184)' and '(Europe, 3 Player, FD1094 317-0187)' to '(World, 3 Player, FD1094 317-0187)'.
- 24th November 2004: Thierry Lescot - Dumped the cpus from D.D.Crew (Europe, 4 Player), Ryukyu and Bloxeed (system18, japan).
- 0.89: David Haywood improved inputs in DDCrew, all 4 Players can now be used, although only the service coin works.
- 0.88u7: Many improvements to Sega System 18 driver [Aaron Giles]. D.D. Crew is fully playable but requires inputs to be fixed (currently only service coin and controls for 1 player work). Fixed gfx1/2 rom loading. Changed description to 'D. D. Crew (US, 4 Player, FD1094 317-0186)' and clones '(Europe, 4 Player, 317-?)' to '(Europe, 4 Player, FD1094 317-?)', '(Europe, 2 Player, 317-0184)' to '(Europe, 2 Player, FD1094 317-0184)' and '(Europe, 3 Player, 317-0187)' to '(Europe, 3 Player, FD1094 317-0187)'.
- 0.88u3: Added new 317-0186.key.
- 0.88u2: Added FD1094 317-0186.key to 'D. D. Crew (US, 4 Player, 317-0186)'.
- 0.88u1: Fixed D. D. Crew - Game now playable [Charles MacDonald, Nicola Salmoria, David Haywood]. Incomplete sound emulation, still some serious gfx problems in places. Changed region gfx1/2 to gfx3/4.
- 28th October 2004: David Haywood - I've added some crude banking support to D.D. Crew and Clutch Hitter, improves some (but not all) gfx.
- 0.88: Charles MacDonald and Nicola Salmoria added clones D. D. Crew (Europe, 2 Player, 317-0184), (Europe, 3 Player, 317-0187) and (Europe, 4 Player, 317-?). Fixed some issues with System18 emulation. Changed description of 'DD Crew' to 'D. D. Crew (US, 4 Player, 317-0186)'.
- 30th September 2004: Charles MacDonald - Here's D.D. Crew (System 18, 317-0186) decrypted and running. This game has a custom chip on the ROM board that adds a layer of abstraction to the regular sprite and tile banking controls. It may also be used for accessing program ROM contents with data shuffled around as a form of protection. The VDP seems to be heavily used, getting that hooked up will probably make for more interesting screenshots. I think this is why the bootleg D.D. Crew board had such a poor looking title screen, because the bootleggers just left out the VDP chip rather than copy it which would be a fairly difficult task. I'd bet the bootleg version of Alien Storm has no background graphics in the first person shooting stages for the same reason, even though the VDP setup code is still present. D.D. Crew pipes nearly all of the video data through the protection chip, so the game looks terrible even though it's running correctly. It also gets the address of some tables through the chip, which come out wrong and cause problems. The protection chip is programmable and has 16 registers that are updated during V-Blank, so it's not exactly simple. I tackled this game in a completely different way compared to what was done with Tetris. Instead of putting fragments of encrypted code together, I decrypted the entire ROM in each state that the game used. The 68000 emulator was modified to keep track of the decryption state and switch decrypted ROM images as needed. If a state is ever selected that has no corresponding table, the emulator exits gracefully and tells me what to dump next. Because the game actually works, this shows that current assumptions about how the decryption state is managed are correct. The upshot of this method is that you no longer have to identify all of the executable code in a game, just the states that are used. This can be determined by running the game in an emulator in the reset state, and dumping more data each time an unknown state comes up. D.D. Crew only uses 6 or so states, so analyzing disassemblies was all that was needed. I'll try to get the graphics fixed soon. The banking/protection chip will hopefully not be a problem, I have several System 18 boards with the same part and can run tests on it.
- 18th September 2004: Charles MacDonald - Great news, I've been able to sucessfully decrypt any 16K block from D.D. Crew. It should be possible to decrypt the entire game at this point. Because D.D. Crew is so large, I'm going to work on Tetris first. The decryption state can be changed by the programmer at almost any point in the game's code, you have to trace through the code which is a tedious process. D.D. Crew changes the state a lot but only uses the same few arguments, so one solution would be to decrypt the entire ROM multiple times with different compares being used, and then patch together the correct parts. Tetris only changes the state four times in the startup code and doesn't do anything afterwards, making it a better choice to work with.
- 16th September 2004: Charles MacDonald - Today I dumped about 512MB worth of tables for D.D Crew and was able to decrypt a reasonable portion of the startup code using a much smaller subset of that data. Also, comparisons between the Tetris CPU tests and D.D. Crew CPU show all the usual similarities; the direct opcodes are the same, PC relative instructions are missing, decryption repeats every 16K, etc. No surprises which is a good thing, I'd assume all other FD1094 CPUs work in the same way. A new finding is that within a 16K block, certain addresses (no relation to each other, seems random) have the same table output. So you don't get completely unique tables for every address within a 16K block. In theory this means a smaller set of tables would be needed per block, but there doesn't seem to be any apparent way to tell which addresses will decrypt identically. The D.D. Crew decryption was done using tables from $10000-$12000. The initial PC and SP don't come out correctly, even though they should work with table data from offsets $10000-$10007. At least determining the entry point is pretty easy to do, not being able to decrypt it (so far) will not be a problem for other games.
- 18th March 2004: Charles MacDonald fixed Z80 clock (8.192 Mhz -> 8.00 MHz).
- 0.74u2: Added DD Crew (Sega 1991).
- 0.36b2: Andrew Prime added DD Crew (Testdriver).

LEVELS: 7

Other Emulators:
* FB Alpha

Romset: 7560 kb / 20 files / 2.87 zip