PRO-CT0: Difference between revisions

From NeoGeo Development Wiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 1: Line 1:
PRO-CT0 is an early SDIP64 gate array chip used as:
*A sprite graphics multiplexer on AES carts and MVS boards, sometimes named ALPHA-8921, later replaced by [[NEO-ZMC2]] and then [[NEO-CMC]].
*Security device in [[Super Sidekicks]] and [[Fatal Fury 2]] AES and MVS cartridges, also named SNK-9201.
The device probably wasn't intended to be used as as security measure at first ?
=Pinouts=
{|align="center"
!Sprite graphics mux
!Security device
|-
|[[File:pro-ct0_pinout.png]]
|[[File:snk-9201_pinout.png]]
|-
|Info by [[User:Kyuusaku]]
|*D0~D15: 68k data bus
*A1~A19: 68k address bus
*D0out~D7out: output to a LS245 which puts the data on
the 68k bus when /PORTOEL goes low ($200000-$2FFFFF odd byte read).
|}
=Use as graphics multiplexer=
[[File:mvs_pro-ct0.jpg|right|thumb|PRO-CT0 9020KX032 on an MV-4 [[MVS system]], as a graphics serializer]]
[[File:mvs_pro-ct0.jpg|right|thumb|PRO-CT0 9020KX032 on an MV-4 [[MVS system]], as a graphics serializer]]
See [[NEO-ZMC2]].
=Use as security device=


[[File:proct0prog.jpg|thumb|PRO-CT0 9042KX023 on an AES cart [[PROG board]] as a security chip]]
[[File:proct0prog.jpg|thumb|PRO-CT0 9042KX023 on an AES cart [[PROG board]] as a security chip]]


PRO-CT0 are early SDIP64 gate array chips used as:
Used on [[PROG board#PROG-G2|PROG-G2]] boards. It is found in [[Fatal Fury 2]] and [[Super Sidekicks]] only. It was SNK's first attempt at protecting NeoGeo games.
*Sprite graphics multiplexers on AES carts and MVS boards, sometimes named ALPHA-8921, later replaced by [[NEO-ZMC2]] and then [[NEO-CMC]].
 
*Security devices in AES and MVS cartridges like [[Super Sidekicks]] and [[Fatal Fury 2]], later renamed [[SNK-9201]].
The chip is tied to the [[68k]] address and data bus, listens to word writes and replies on odd addresses in the [[68k memory map|$200000-$2FFFFF]] address range.
 
The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.
 
Address bus mapping:
{|class="wikitable"
|A19||A18||A17||A16||A15||A14||A13||A12||A11||A10||A9||A8||A7||A6||A5||A4||A3||A2||/PORTWEL||A1
|-
|C31||C29||C27||C25||C30||C28||C26||C24||C23||C21||C19||C17||C22||C20||C18||C16||H||EVEN||12M||LOAD
|}
 
Data bus mapping:
{|class="wikitable"
|D15||D14||D13||D12||D11||D10||D9||D8||D7||D6||D5||D4||D3||D2||D1||D0
|-
|C15||C13||C11||C9||C14||C12||C10||C8||C7||C5||C3||C1||C6||C4||C2||C0
|}
 
[[File:crt_snk-9201.jpg|right|thumb|SNK-9201 chip found in a [[Super Sidekicks]] MVS cartridge. Picture courtesy of [[http://www.mvs-scans.com MVS-Scans]].]]
 
==Fatal Fury 2 code==
 
<syntaxhighlight>
00296A:
move #$5555,$255552 ;LOAD C $33333333
move.b $255551,$10AC2E ;Read GAD/GBD: $FF
move.b d0,$255551 ;Clock
move.b $2FFFF1,$10AC2F ;Read GAD/GBD: $00
move.b d0,$2FFFF1 ;Clock
move.b $200001,$10AC30 ;Read GAD/GBD: $FF
move.b d0,$2FF001 ;Clock
move.b $2FF001,$10AC31 ;Read GAD/GBD: $00
cmpi.l #$FF00FF00,$10AC2E ;Compare reads
beq +
move #$3328,24580(a5) ;Lock up flag ?
+:
rts
</syntaxhighlight>
 
<syntaxhighlight>
012530:
move #$1234,$256782 ;LOAD C $366A061A (00110110 01101010 00000110 00011010)
move.b $236001,18642(a5) ;Read GAD/GBD
move.b #$20,$236001 ;Clock
move.b $236001,18643(a5) ;Read GAD/GBD
move.b #$20,236001 ;Clock
move.b $236001,18644(a5) ;Read GAD/GBD
move.b #$20,$236001 ;Clock
move.b $236001,18645(a5) ;Read GAD/GBD
move.b #$20,$236001 ;Clock
move.l 18642(a5),d0
subi.l #$F05A3601,d0 ;Compare reads (1111 0000 0101 1010 0011 0110 0000 0001)
rts
</syntaxhighlight>


==Internal designs==
<syntaxhighlight>
move #$1824,$242812 ;LOAD C
move.b $236009,18642(a5) ;Read GAD/GBD with H (reverse)
move.b #$20,$236009 ;Clock
move.b $236009,18643(a5) ;Read GAD/GBD with H (reverse)
move.b #$20,$236009 ;Clock
move.b $236009,18644(a5) ;Read GAD/GBD with H (reverse)
move.b #$20,$236009 ;Clock
move.b $236009,18645(a5) ;Read GAD/GBD with H (reverse)
move.b #$20,$236009 ;Clock
move.l 18642(a5),d0
subi.l #$81422418,d0 ;Compare reads
rts
</syntaxhighlight>


Known PRO-CT0 markings to be of the '''graphics chip''' type: 9020KX032, ...
<syntaxhighlight>
move #$1234,$256782 ;LOAD C
move.b $236005,18642(a5) ;Read GAD/GBD with EVEN (nibble swap)
move.b #$20,$236005 ;Clock
move.b $236005,18643(a5) ;Read GAD/GBD with EVEN (nibble swap)
move.b #$20,$236005 ;Clock
move.b $236005,18644(a5) ;Read GAD/GBD with EVEN (nibble swap)
move.b #$20,$236005 ;Clock
move.b $236005,18645(a5) ;Read GAD/GBD with EVEN (nibble swap)
move.b #$20,$236005 ;Clock
move.l 18642(a5),d0
subi.l #$0FA56310,d0 ;Compare reads
rts


Marking of '''SNK-9201's''': 9246EX020, 9247EX010, 9247EX007, 2947EX029
move #$1824,$242812 ;LOAD C
move.b $23600D,18642(a5) ;Read GAD/GBD with H and EVEN
move.b #$20,$23600D ;Clock
move.b $23600D,18643(a5) ;Read GAD/GBD with H and EVEN
move.b #$20,$23600D ;Clock
move.b $23600D,18644(a5) ;Read GAD/GBD with H and EVEN
move.b #$20,$23600D ;Clock
move.b $23600D,18645(a5) ;Read GAD/GBD with H and EVEN
move.b #$20,$23600D ;Clock
move.l 18642(a5),d0
subi.l #$18244281,d0 ;Compare reads
rts
</syntaxhighlight>


Marking of PRO-CT0's on '''AES PROG PCBs''': 9042KX023
==Emulation==


==Pinout==
MAME's HLE emulation (fatfury2_protection): [[http://mamedev.org/source/src/mame/machine/neoprot.c.html]]


<nowiki>ALPHA-8921 / PRO-CT0
Reads:
*To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
*To $236004, $23600C: return dataout >> 24 nibble swapped


D1 odd.15 1 64 VCC
Writes:
D3 odd.19 2 63 VCC
*To $211112, with data = $1111: dataout = $FF000000
D5 odd.24 3 62 odd.26 D6
*To $233332, with data = $3333: dataout = $0000FFFF;
D7 odd.28 4 61 odd.22 D4
*To $244442, with data = $4444: dataout = $00FF0000;
D8 odd.14 5 60 odd.17 D2
*To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
D10 odd.18 6 59 odd.13 D0
*To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
D12 odd.23 7 58 A8 H
*To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
D14 odd.27 8 57 A7 even
*To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte
D9 odd.16 9 56 A5 12 MHz clk
D11 odd.20 10 55 A9 load
D13 odd.25 11 54 nc
D15 odd.29 12 53 nc
D0 even.13 13 52 nc
D2 even.17 14 51 nc
D4 even.22 15 50 GND
D6 even.26 16 49 GND
D1 even.15 17 48 B39 gbd3
D3 even.19 18 47 B38 gbd2
D5 even.24 19 46 B37 gbd1
D7 even.28 20 45 B36 gbd0
D8 even.14 21 44 GND
D10 even.18 22 43 GND
D12 even.23 23 42 B35 gad3
D14 even.27 24 41 B34 gad2
D9 even.16 25 40 B33 gad1
D11 even.20 26 39 B32 gad0
D13 even.25 27 38 nc
D15 even.29 28 37 nc
dota B30 29 36 nc
dotb B31 30 35 nc
GND 31 34 nc
GND 32 33 nc</nowiki>


[[Category:Chips]]
[[Category:Chips]]

Revision as of 18:47, 16 March 2012

PRO-CT0 is an early SDIP64 gate array chip used as:

  • A sprite graphics multiplexer on AES carts and MVS boards, sometimes named ALPHA-8921, later replaced by NEO-ZMC2 and then NEO-CMC.
  • Security device in Super Sidekicks and Fatal Fury 2 AES and MVS cartridges, also named SNK-9201.

The device probably wasn't intended to be used as as security measure at first ?

Pinouts

Sprite graphics mux Security device
Info by User:Kyuusaku *D0~D15: 68k data bus
  • A1~A19: 68k address bus
  • D0out~D7out: output to a LS245 which puts the data on

the 68k bus when /PORTOEL goes low ($200000-$2FFFFF odd byte read).

Use as graphics multiplexer

PRO-CT0 9020KX032 on an MV-4 MVS system, as a graphics serializer

See NEO-ZMC2.





Use as security device

PRO-CT0 9042KX023 on an AES cart PROG board as a security chip

Used on PROG-G2 boards. It is found in Fatal Fury 2 and Super Sidekicks only. It was SNK's first attempt at protecting NeoGeo games.

The chip is tied to the 68k address and data bus, listens to word writes and replies on odd addresses in the $200000-$2FFFFF address range.

The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.

Address bus mapping:

A19 A18 A17 A16 A15 A14 A13 A12 A11 A10 A9 A8 A7 A6 A5 A4 A3 A2 /PORTWEL A1
C31 C29 C27 C25 C30 C28 C26 C24 C23 C21 C19 C17 C22 C20 C18 C16 H EVEN 12M LOAD

Data bus mapping:

D15 D14 D13 D12 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0
C15 C13 C11 C9 C14 C12 C10 C8 C7 C5 C3 C1 C6 C4 C2 C0
File:Crt snk-9201.jpg
SNK-9201 chip found in a Super Sidekicks MVS cartridge. Picture courtesy of [MVS-Scans].

Fatal Fury 2 code

00296A:
	move	#$5555,$255552		;LOAD C $33333333
	move.b	$255551,$10AC2E		;Read GAD/GBD: $FF
	move.b	d0,$255551		;Clock
	move.b	$2FFFF1,$10AC2F		;Read GAD/GBD: $00
	move.b	d0,$2FFFF1		;Clock
	move.b	$200001,$10AC30		;Read GAD/GBD: $FF
	move.b	d0,$2FF001		;Clock
	move.b	$2FF001,$10AC31		;Read GAD/GBD: $00
	cmpi.l	#$FF00FF00,$10AC2E	;Compare reads
	beq	+
	move	#$3328,24580(a5)	;Lock up flag ?
+:
	rts
012530:
	move	#$1234,$256782		;LOAD C $366A061A (00110110 01101010 00000110 00011010)
	move.b	$236001,18642(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.b	$236001,18643(a5)	;Read GAD/GBD
	move.b	#$20,236001		;Clock
	move.b	$236001,18644(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.b	$236001,18645(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.l	18642(a5),d0
	subi.l	#$F05A3601,d0		;Compare reads (1111 0000 0101 1010 0011 0110 0000 0001)
	rts
	move	#$1824,$242812		;LOAD C
	move.b	$236009,18642(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18643(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18644(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18645(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.l	18642(a5),d0
	subi.l	#$81422418,d0		;Compare reads
	rts
	move	#$1234,$256782		;LOAD C
	move.b	$236005,18642(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18643(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18644(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18645(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.l	18642(a5),d0
	subi.l	#$0FA56310,d0		;Compare reads
	rts

	move	#$1824,$242812		;LOAD C
	move.b	$23600D,18642(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18643(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18644(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18645(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.l	18642(a5),d0
	subi.l	#$18244281,d0		;Compare reads
	rts

Emulation

MAME's HLE emulation (fatfury2_protection): [[1]]

Reads:

  • To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
  • To $236004, $23600C: return dataout >> 24 nibble swapped

Writes:

  • To $211112, with data = $1111: dataout = $FF000000
  • To $233332, with data = $3333: dataout = $0000FFFF;
  • To $244442, with data = $4444: dataout = $00FF0000;
  • To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
  • To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
  • To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
  • To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte
Retrieved from "https://wiki.neogeodev.org/index.php?title=PRO-CT0&oldid=1876"