Can someone help decrypt menghong.cpp for Crazy Dou Di Zhu II (crzyddz2)?

[lyangsha]

I'm trying to get crzyddz2 working in MAME, but it keeps crashing due to HY04 protection.
I've checked the following:

• MAME version: git 2024-02-27 (latest main branch)
• ROM files: crzyddz2.zip (CRC/SHA1 verified)
• Code snippet from menghong.cpp:

  // HY04 protection logic that's causing issues...

Error logs:
text
0x00100000: Protection check failed at 0x485
Could someone guide me on how to bypass this or fix the XOR key?

[angelosa]

There's no "fix the XOR key": the game uses a shared RAM with a MCU named HY04 that needs decapping to progress, as per the driver notes and the "no good dump known" warning it throws at emulation startup.
I experimented specifically with menghong at the time just as a convenience: if I'm not mistaken that one won't even surpass the Sealy logo without the handcrafted ROM data table. crzyddz2_shared_w is separate protection simulation, and doesn't use the table lookup for anything at the moment.