drivers/viper.cpp:
==========================================================================================

Konami Viper Hardware Overview (last updated 5th June 2011 10:56pm)

Games on this hardware include:

Konami
Game ID  Year    Game
-------------------------------------------------------------------------------------------------
GK922    2000    Code One Dispatch
G????    2001    ParaParaParadise 2nd Mix
GM941    2001    GTI Club 2
G?A00    2001    Police 911 (USA) / Police 24/7 (World) / Keisatsukan Shinjuku 24ji (Japan)
GKA13    2001    Silent Scope EX (USA/World) / Sogeki (Japan)
G?A29    2001    Mocap Boxing
G?A30    2002    Tsurugi
GMA41    2001    Thrill Drive 2
G?A45    2001    Boxing Mania
G*B11    2001    Police 911 2 (USA) / Police 24/7 2 (World) / Keisatsukan Shinjuku 24ji 2 (Japan)
G?B33    2001    Mocap Golf
G?B41    2001    Jurassic Park 3
G?B4x    2002    Xtrial Racing
G?C09    2002    Mahjong Fight Club
G?C22    2002    World Combat (USA/Japan/Korea) / Warzaid (Europe)

PCB Layout
----------
Early revision - GM941-PWB(A)B (CN13/15/16 not populated and using 941A01 BIOS)
Later revision - GM941-PWB(A)C (with 941B01 BIOS)
Copyright 1999 KONAMI
  |----------------------------------------------------------|
  |            LA4705      6379AL                            |
|-|  TD62064                               14.31818MHz   CN15|
|                  3793-A                                    |
|     |------|                            |--------|         |
|J    |056879|                            |3DFX    |MB81G163222-80
|A    |      |PQR0RV21                    |355-0024|         |
|M    |------|          XC9572XL          |-030    |MB81G163222-80
|M                                        |--------|         |
|A                                    MB81G163222-80         |
|    ADC0838           |------------|          MB81G163222-80|
|    LM358             |MOTOROLA    |                        |
|                      XPC8240LZU200E  33.868MHz         CN13|
|-| PC16552            |            |                        |
  |           PQ30RV21 |            |        CY7C199         |
|-|                    |            |                        |
|                      |------------|        XCS10XL         |
|                 48LC2M32B2   48LC2M32B2                    |
|2                                                           |
|8                                       CN17                |
|W       XC9536(1)  XC9536(2)        |-------------|         |
|A                                   |  DUAL       |         |
|Y                                   |  PCMCIA     |         |
|                     M48T58Y.U39    |  SLOTS      |         |
|                                    |             |         |
|           29F002                   |             |     CN16|
|-|                       DS2430.U37 |             |         |
  | DIP(4)  CN4 CN5 CN7         CN9  |             |  CN12   |
  |----------------------------------|-------------|---------|
Notes:
XPC8240LZU200E - Motorola XPC8240LZU200E MPC8420 PPC603e-based CPU (TBGA352 @ U38). Clock input is 33.868MHz
                Chip rated at 200MHz so likely clock is 33.868 x6 = 203.208MHz
         3DFX - 3DFX Voodoo III 3500 graphics chip with heatsink (BGA @ U54). Clock input 14.31818MHz
                Full markings: 355-0024-030 F26664.10C 0025 20005 TAIWAN 1301
   48LC2M32B2 - Micron Technology 48LC2M32B2-6 2M x32-bit (512k x 32 x 4 banks = 64MB) 166MHz Synchronous
                DRAM (TSOP86 @ U28 & U45)
MB81G163222-80 - Fujitsu MB81G163222-80 256k x 32-bit x 2 banks Synchronous Graphics DRAM (TQFP100 @ U53, U56, U59 & U60)
      CY7C199 - Cypress Semiconductor CY7C199-15VC 32k x8 SRAM (SOJ28 @ U57)
      PC16552 - National Semiconductor PC16552D Dual Universal Asynchronous Receiver/Transmitter with FIFO's (PLCC44 @ U7)
    XC9536(1) - Xilinx XC9536 In-System Programmable CPLD stamped 'M941A1' (PLCC44 @ U17)
    XC9536(2) - Xilinx XC9536 In-System Programmable CPLD stamped 'M941A2' (PLCC44 @ U24)
     XC9572XL - Xilinx XC9572XL High Performance CPLD stamped 'M941A3A' (PLCC44 @ U29)
      XCS10XL - Xilinx XCS10XL Spartan-XL FPGA (TQFP100 @ U55)
       056879 - Konami 056879 custom IC (QFP120 @ U15)
     PQ30RV21 - Sharp PQ30RV21 low-power voltage regulator (5 Volt to 3 Volt)
       LA4705 - Sanyo LA4705 15W 2-channel power amplifier (SIP18)
        LM358 - National Semiconductor LM358 low power dual operational amplifier (SOIC8 @ U14)
       6379AL - NEC uPC6379AL 2-channel 16-bit D/A converter (SOIC8 @ U30)
      ADC0838 - National Semiconductor ADC0838 Serial I/O 8-Bit A/D Converters with Multiplexer Options (SOIC20 @ U13)
       DS2430 - Dallas DS2430 256-bits 1-Wire EEPROM. Has 256 bits x8 EEPROM (32 bytes), 64 bits x8 (8 bytes)
                one-time programmable application register and unique factory-lasered and tested 64-bit
                registration number (8-bit family code + 48-bit serial number + 8-bit CRC) (TO-92 @ U37)
                The OTP application register on the common DS2430 and the Police 911 2 DS2430 are not programmed
                (application register reads all 0xFF and the status register reads back 0xFF), so it's probably safe
                to assume they're not used on any of them.
                It appears the DS2430 is not protected from reading and the unique silicon serial number is
                included in the 40 byte dump. This serial number is used as a check to verify the NVRAM and DS2430.
                In the Police 911 2 NVRAM dump the serial number of the DS2430 is located at 0x002A and 0x1026
                If the serial number in the NVRAM and DS2430 match then they are paired and the game accepts the NVRAM.
                If they don't match the game requires an external DS2430 (i.e. dongle) and flags the NVRAM as 'BAD'
                The serial number is not present in the CF card (2 different Police 911 2 cards of the same version
                were dumped and matched).
                When the lasered ROM is read from the DS2430, it comes out from LSB to MSB (family code, LSB of
                S/N->MSB of S/N, CRC)
                For Police 911 2 that is 0x14 0xB2 0xB7 0x4A 0x00 0x00 0x00 0x83
                Family code=0x14
                S/N=0x0000004AB7B2
                CRC=0x83
                In a DS2430 dump, the first 32 bytes is the EEPROM and the lasered ROM is 8 bytes and starts at 0x20h
                For Police 911 2 that is....
                00000000h CB 9B 56 EC A0 4C 87 53 51 46 28 E7 00 00 00 74
                00000010h 30 A9 C7 76 B9 85 A3 43 87 53 50 42 1A E7 FA CF
                00000020h 14 B2 B7 4A 00 00 00 83
                It may be possible to hand craft a DS2430 for a dongle-protected version of a game simply by using
                one of the existing DS2430 dumps and adjusting the serial number found in a dump of the NVRAM to pair them
                or adjusting the serial number in the NVRAM to match the serial number found in one of the dumped DS2430s.
                This Police 911 2 board was upgraded from Police 911 by plugging in the dongle and changing the CF card.
                The NVRAM had previously died and the board was dead. Normally for a Viper game that is fatal. Using
                the NVRAM from Police 911 allowed it to boot and then the NVRAM upgraded itself with some additional
                data (the original data remained untouched). This means the dongle does more than just protect the game.
                Another interesting fact about this upgrade is it has been discovered that the PCB can write to the
                external DS2430 in the dongle. This has been proven because the serial number of the DS2430 soldered
                on the PCB is present in the EEPROM area of the Police 911 2 DS2430.
                Here is a dump of the DS2430 from Police 911. Note the EEPROM area is empty and the serial number (from 0x20 onwards)
                is present in the above Police 911 2 DS2430 dump at locations 0x11, 0x10 and 0x0F
                00000000h FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
                00000010h FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
                00000020h 14 A9 30 74 00 00 00 E7
                This proves that the EEPROM area in the DS2430 is unused by an unprotected game and in fact the on-board
                DS2430 is completely unused by an unprotected game. That is why any unprotected game will work on any
                Viper PCB regardless of the on-board DS2430 serial number.
                The existing DS2430 'common' dump used in the unprotected games was actually from a (dongle-protected)
                Mahjong Fight Club PCB but that PCB was used to test and run all of the unprotected Viper games.
      M48T58Y - ST Microelectronics M48T58Y Timekeeper RAM (DIP28 @ U39). When this dies (after 10 year lifespan)
                the game will complain with error RTC BAD then reset. The data inside the RTC can not be hand created
                (yet) so to revive the PCB the correct RTC data must be re-programmed to a new RTC and replaced
                on the PCB.
                Regarding the RTC and protection-related checks....
                "RTC OK" checks 0x0000->0x0945 (i.e. I can clear the contents after 0x0945 and the game will still
                happily boot). The NVRAM contents are split into chunks, each of which are checksummed.  It is a 16-bit checksum,
                computed by summing two consecutive bytes as a 16-bit integer, where the final sum must add up to 0xFFFF (mod
                65536).  The last two bytes in the chunk are used to make the value 0xFFFF.  There doesn't appear to be a
                complete checksum over all the chunks (I can pick and choose chunks from various NVRAMs, as long as each chunk
                checksum checks out). The important chunks for booting are the first two.
                The first chunk goes from 0x0000-0x000F.  This seems to be a game/region identifier, and doesn't like its
                contents changed (I didn't try changing every byte, but several of the bytes would throw RTC errors, even with a
                fixed checksum).  I'd guess that the CF verifies this value, since it's different for every game (i.e. Mocap
                Boxing NVRAM would have a correct checksum, but shouldn't pass Police 911 checks).
                The second chunk goes from 0x0010-0x0079.  This seems to be a board identifier.  This has (optionally)
                several fields, each of which are 20 bytes long.  I'm unsure of the first 6 bytes, the following 6
                bytes are the DS2430A S/N, and the last 8 bytes are a game/region/dongle identifier.  If running
                without a dongle, only the first 20 byte field is present.  With a dongle, a second 20 byte field will
                be present.  Moving this second field into the place of the first field (and fixing the checksum)
                doesn't work, and the second field will be ignored if the first field is valid for the game (and in
                which case the dongle will be ignored).  For example, Police 911 will boot with a valid first field,
                with or without the second field, and with or without the dongle plugged in.  If you have both fields,
                and leave the dongle plugged in, you can switch between Police 911 and Police 911/2 by simply swapping
                CF cards.
       29F002 - Fujitsu 29F002 256k x8 EEPROM stamped '941B01' (PLCC44 @ U25). Earlier revision stamped '941A01'
      CN4/CN5 - RCA-type network connection jacks
          CN7 - 80 pin connector (unused in all games?)
          CN9 - DIN5 socket for dongle. Dongle is a DIN5 male plug containing a standard DS2430 wired to
                DIN pins 2, 3 & 4. Pin 1 NC, Pin 2 GND, Pin 3 DATA, Pin 4 NC, Pin 5 NC. If the dongle is
                required and plugged in it overrides the DS2430 on the main board. Without the (on-board)
                DS2430 the PCB will complain after the CF check with HARDWARE ERROR. If the DS2430 is not
                correct for the game the error given is RTC BAD even if the RTC is correct. Most games don't require
                a dongle and accept any DS2430 on the main board.
         CN12 - 4 pin connector (possibly stereo audio output?)
         CN13 - Power connector for plug-in daughterboard
    CN15/CN16 - Multi-pin IDC connectors for plug-in daughterboard (see detail below)
         CN17 - Dual PCMCIA slots. Usually only one slot is used containing a PCMCIA to CF adapter. The entire game
                software resides on the CF card. Games use 32M, 64M and 128M CF cards. In many cases a different
                CF card version of the same game can be swapped and the existing RTC works but sometimes the RTC data
                needs to be re-initialised to factory defaults by entering test mode. Sometimes the game will not boot
                and gives error RTC BAD meaning the RTC is not compatible with the version or the dongle is required.
                See DS2430 above for more info.
       28-WAY - Edge connector used for connecting special controls such as guns etc.
       DIP(4) - 4-position DIP switch. Switch 1 skips the CF check for a faster boot-up. The others appear unused?

The PCB pinout is JAMMA but the analog controls (pots for driving games mostly) connect to pins on the JAMMA connector.
The 2 outer pins of each pot connect to +5V and GND. If the direction of control is opposite to what is expected simply
reverse the wires.
The centre pin of each pot joins to the following pins on the JAMMA connector.....
Pin 25 Parts side  - GAS POT
Pin 25 Solder side - STEERING POT
Pin 26 Parts side  - HANDBRAKE POT (if used, for example Xtrail Racing)
Pin 26 Solder side - BRAKE POT

For the gun games (Jurassic Park III and Warzaid) the gun connects to the 28 way connector like this......
Pin 1 Parts side        - Gun optical input
Pin 2 Parts side        - Ground
Pin 3 Parts side        - +5V
Jamma pin 22 parts side - Gun trigger

Player 2 gun connects to the same pin numbers on the solder side.

Jurassic Park III also uses 2 additional buttons for escaping left and right. These are wired to buttons on the Jamma
connector.

Additionally on the 28-WAY connector is...
Pin 7 parts side       - Serial TX
Pin 7 solder side      - Serial RX
Pin 8 solder side      - GND (used by serial)

Pin 9 parts side       - SP_LP (outputs to SP-F, front speaker)
Pin 9 solder side      - SP_LN
Pin 9 parts side       - SP_RP (output splits into SP-BL and SP-BR, rear speaker(s))
Pin 9 solder side      - SP_RN


Measurements
------------
X1    - 33.86803MHz
X2    - 14.31700MHz
HSync - 24.48700kHz
VSync - 58.05630Hz


Additional PCBs
---------------

GQA13-PWB(D)
Copyright 2000 KONAMI
          |--------------------|
          | MB81G163222-80     |
          |               40MHz|
          |                 CN4|
          | IP90C63A           |
          |----|            CN2|
               |               |
               |               |
               |               |
               |            CN3|
               |               |
|--------------|               |
|                            |-|
|        IP90C63A            |
|                            |-|
| MB81G163222-80               |
|----------|     XC9536XL  CN1 |
           |----------------|  |
                            |  |
                            |  |
                            | *|
                            |  |
                            |  |
                            |  |
                            |  |
                            |  |
                            |  |
                            |  |
                            |CN5
                            |--|
Notes:
     This PCB is used with Mocap Golf only and drives the 2 external monitors.
     An almost identical PCB is used with Silent Scope EX but the sticker says '15KHz x2' and the
     CPLD is likely different. This most likely drives the small monitor inside the gun sight.

     XC9536XL - Xilinx XC9536 In-System Programmable CPLD stamped 'QB33A1' (PLCC44)
            * - sticker '24KHz x2'
MB81G163222-80 - Fujitsu MB81G163222-80 256k x 32-bit x 2 banks Synchronous Graphics DRAM (TQFP100)
     IP90C63A - i-Chips IP90C63A Video Controller chip (QFP144)
          CN1 - Power connector, plugs into CN13 on main board
      CN2/CN3 - Video output connector to external monitors
      CN4/CN5 - Multi-pin IDC connectors joining to main board CN15/CN16

An additional control PCB is used for Mocap Golf for the golf club sensor. It contains a ROMless MCU, an EPROM and
some other components. It will be documented at a later date.

---