Copy protection

The NeoGeo CDZ's system ROM has CD-ROM copy protection features. Not all games use them.

Notes

• Copies the whole CPY.TXT sector to $126000 (routine at $C0D358), BIB.TXT to $126800, ABS.TXT to $127000.
• All the normal file contents are removed ("Copyright by SNK corp...").
• Routine at $C0D230: Adds everything up except the very first word ($126002~$127000) byte per byte in a word and compares it to that first word (checksum).
• Checks for NEO-GEO,0 string at $126002.
• Checks bit 0 of $12600A. 1=Protection type=1, do region check with $12600B. Special case if the console's mode is 5: always trips the check !
• Clears 2048 bytes at $125800.
• Checks bit 1 of $12600A. 1=Protection type=2, and...
  • Routine at $C0D392: Loads sector from track XX+3 in $125800, then it's up to the game to do checks on the data ?
• Checks bit 2 of $12600A. 1=Put $FF in $10F792 (in-game protection flag ?).
• JSR to code at $12600C. Test D0, if non-zero, trip check.

Methods

One of the copy detection methods relies on the fact that most computer CD drives/burners will automatically correct disc errors thanks to the available EDC and ECC fields in CD-ROM sectors.

In some games, SNK intentionally inserted data with errors and the correct checksum value in the CPY.TXT, BIB.TXT and ABS.TXT files. If the system ROM detects the presence of such data, it computes its checksum and compares it against the given one. If they match, it means the errors were corrected (probably by a burner) and the system stops loading the game.

The console's own error correction system is certainly disabled when loading the .TXT files.

For example in Art of Fighting 3 - The Path of the Warrior, the following data is appended to CPY.TXT:

A fixed-format header:

0F BA 4E 45 4F 2D 47 45 4F 00 03 02 ...

• 0F BA: Checksum of the error-corrected data
• 4E 45 4F 2D 47 45 4F 00: "NEO-GEO", 0
• 03: Enabled checks (bit 0~2)
• 02: Region/zone flag (EURO)

And valid 68k code, which does another kind of region check:

clr.l   d0
clr.l   d1
tst.l   $10F782
beq     $12601C
bset    #0,d1
tst.l   $10F77E
beq     $126028
bset    #1,d1
cmp.b   $12600A,d1
beq     $126030
addq.l  #1,d0
rts

Todo: What are the $10F782 and $10F77E variables ? RTS with D0=1 means fail.

Patching

The patching tutorial commonly found online tells to replace the first two occurences of the letter "g" with "f" after the "NEO-GEO" string in CPY.TXT.

This causes the computed checksum to be wrong (pass first check) and turns the BEQ instructions into BNE (pass second check).

Emulation

MESS bypasses the protections by changing only one "g" to "f". See Read_LBA_To_Buffer() in megacdcd.c.

Game list

Since the NeoGeo CDZ came out in 1996, it is unclear if pre-1996 games had new masters made to use the protection or if SNK planned to use it since the beginning (makes no sense ?).

Todo: How does the in-game protection work ?

Title	CDZ protection	In-game protection
Art of Fighting 3 - The Path of the Warrior	Yes	Yes
Breakers	Yes	No
Brikin'Ger / IronClad	Yes	No
Fatal Fury 3 - Road to the Final Victory	No	Yes
Real Bout Fatal Fury	Yes	Yes
Real Bout Fatal Fury Special	Yes	Yes
Real Bout Fatal Fury 2 - The Newcomers	Yes	Yes
Pleasure Goal	Yes	No
The King of Fighters '95	No	Yes
The King of Fighters '96	Yes	Yes
The King of Fighters '96 Collection	Yes	Yes
The King of Fighters '97	Yes	Yes
The King of Fighters '98 - The Slugfest	Yes	Yes
The King of Fighters '99 - Millennium Battle	Yes	Yes
The Last Blade	Yes	Yes
The Last Blade 2	Yes	Yes
Magical Drop II	Yes	No
Metal Slug X - Super Vehicle-001	Yes	No
Metal Slug 2 - Super Vehicle-001/II	Yes	No
Neo Drift Out - New Technology	Yes	No
Neo Geo CD Special	No	Yes
Neo Turf Masters	Yes	No
Ninja Master's	Yes	No
Ragnagard	Yes	No
Robo Army	No	Yes
Samurai Shodown III	Yes	Yes
Samurai Shodown IV - Amakusa's Revenge	Yes	Yes
Samurai Shodown RPG	Yes	Yes
Soccer Brawl	No	Yes
Stakes Winner	Yes	No
Super Sidekicks 3 - The Next Glory	No	Yes
Twinkle Star Sprites	Yes	No

(List from [1])