NEO-SMA

Info from mame/src/devices/bus/neogeo/sma.cpp MAME's source

Security chip found connected to the P ROMs in The King of Fighters '99 - Millennium Battle (not all sets), The King of Fighters 2000 (not all sets), Metal Slug 3 (not all sets) and in Garou - Mark of the Wolves (all sets) cartridges. Bankswitches the second megabyte ($200000~$2FFFFF) of P ROM space and provides a 16bit pseudo-random number generator.

Upon system reset, the PRN is initialized to $2345.

The chip always (?) replies $9A37 on reads.

The stamp marking suggests that it is a programmable chip (OTP ?).

=PRN=

16bit LSFR with taps at bits 2, 3, 5, 6, 7, 11, 12, 15. Each read steps the register.



=Bankswitching=

Bankswitching is done by unscrambling the written bank number and using a 64 entry (256 bytes) lookup table to map the P ROM into $200000~$2FFFFF.

KOF 99



 * Bankswitching write at $2FFFF1
 * Read chip presence at $2FE447
 * PRN at $2FFFF8 and $2FFFFA

Bankswitch LUT (P2 ROM address):

Garou

 * Bankswitching write at $2FFFC0
 * Read chip presence at $2FE447
 * PRN at $2FFFCC and $2FFFF0

"KF" chip revision:

Bank scambling=12,14,6,7,9,5

"KE" chip revision:

Bank scambling=13,11,2,14,8,4

Metal Slug 3



 * Bankswitching write at $2FFFE5
 * Read chip presence at $2FE447
 * PRN at $2FFFF8 and $2FFFFA

Bankswitch LUT (P2 ROM address):

KOF 2000



 * Bankswitching write at $2FFFED
 * Read chip presence at $2FE447
 * PRN at $2FFFD8 and $2FFFDA

Bankswitch LUT (P2 ROM address):