PRO-CT0: Difference between revisions
No edit summary |
mNo edit summary |
||
Line 3: | Line 3: | ||
*Security device in [[Super Sidekicks]] and [[Fatal Fury 2]] AES and MVS cartridges, also named SNK-9201. | *Security device in [[Super Sidekicks]] and [[Fatal Fury 2]] AES and MVS cartridges, also named SNK-9201. | ||
The device probably wasn't intended to be used as as security measure at first | The device probably wasn't intended to be used as as security measure at first. | ||
ALPHA-8921 is the original chip name when [[Alpha Denshi]] designed it. | |||
=Pinouts= | =Pinouts= |
Revision as of 23:18, 27 June 2012
PRO-CT0 is an early SDIP64 gate array chip used as:
- A sprite graphics multiplexer on AES carts and MVS boards, sometimes named ALPHA-8921, later replaced by NEO-ZMC2 and then NEO-CMC.
- Security device in Super Sidekicks and Fatal Fury 2 AES and MVS cartridges, also named SNK-9201.
The device probably wasn't intended to be used as as security measure at first.
ALPHA-8921 is the original chip name when Alpha Denshi designed it.
Pinouts
Sprite graphics mux | Security device |
---|---|
Info by User:Kyuusaku | *D0~D15: 68k data bus
the 68k bus when /PORTOEL goes low ($200000-$2FFFFF odd byte read). |
Use as graphics multiplexer
See NEO-ZMC2.
Use as security device
Used on PROG-G2 boards. It is found in Fatal Fury 2 and Super Sidekicks only. It was SNK's first attempt at protecting NeoGeo games.
The chip is tied to the 68k address and data bus, listens to word writes and replies on odd addresses in the $200000-$2FFFFF address range.
The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.
Address bus mapping:
A19 | A18 | A17 | A16 | A15 | A14 | A13 | A12 | A11 | A10 | A9 | A8 | A7 | A6 | A5 | A4 | A3 | A2 | /PORTWEL | A1 |
C31 | C29 | C27 | C25 | C30 | C28 | C26 | C24 | C23 | C21 | C19 | C17 | C22 | C20 | C18 | C16 | H | EVEN | 12M | LOAD |
Data bus mapping:
D15 | D14 | D13 | D12 | D11 | D10 | D9 | D8 | D7 | D6 | D5 | D4 | D3 | D2 | D1 | D0 |
C15 | C13 | C11 | C9 | C14 | C12 | C10 | C8 | C7 | C5 | C3 | C1 | C6 | C4 | C2 | C0 |
Fatal Fury 2 code
00296A:
move #$5555,$255552 ;LOAD C $33333333
move.b $255551,$10AC2E ;Read GAD/GBD: $FF
move.b d0,$255551 ;Clock
move.b $2FFFF1,$10AC2F ;Read GAD/GBD: $00
move.b d0,$2FFFF1 ;Clock
move.b $200001,$10AC30 ;Read GAD/GBD: $FF
move.b d0,$2FF001 ;Clock
move.b $2FF001,$10AC31 ;Read GAD/GBD: $00
cmpi.l #$FF00FF00,$10AC2E ;Compare reads
beq +
move #$3328,24580(a5) ;Lock up flag ?
+:
rts
012530:
move #$1234,$256782 ;LOAD C $366A061A (00110110 01101010 00000110 00011010)
move.b $236001,18642(a5) ;Read GAD/GBD
move.b #$20,$236001 ;Clock
move.b $236001,18643(a5) ;Read GAD/GBD
move.b #$20,236001 ;Clock
move.b $236001,18644(a5) ;Read GAD/GBD
move.b #$20,$236001 ;Clock
move.b $236001,18645(a5) ;Read GAD/GBD
move.b #$20,$236001 ;Clock
move.l 18642(a5),d0
subi.l #$F05A3601,d0 ;Compare reads (1111 0000 0101 1010 0011 0110 0000 0001)
rts
move #$1824,$242812 ;LOAD C
move.b $236009,18642(a5) ;Read GAD/GBD with H (reverse)
move.b #$20,$236009 ;Clock
move.b $236009,18643(a5) ;Read GAD/GBD with H (reverse)
move.b #$20,$236009 ;Clock
move.b $236009,18644(a5) ;Read GAD/GBD with H (reverse)
move.b #$20,$236009 ;Clock
move.b $236009,18645(a5) ;Read GAD/GBD with H (reverse)
move.b #$20,$236009 ;Clock
move.l 18642(a5),d0
subi.l #$81422418,d0 ;Compare reads
rts
move #$1234,$256782 ;LOAD C
move.b $236005,18642(a5) ;Read GAD/GBD with EVEN (nibble swap)
move.b #$20,$236005 ;Clock
move.b $236005,18643(a5) ;Read GAD/GBD with EVEN (nibble swap)
move.b #$20,$236005 ;Clock
move.b $236005,18644(a5) ;Read GAD/GBD with EVEN (nibble swap)
move.b #$20,$236005 ;Clock
move.b $236005,18645(a5) ;Read GAD/GBD with EVEN (nibble swap)
move.b #$20,$236005 ;Clock
move.l 18642(a5),d0
subi.l #$0FA56310,d0 ;Compare reads
rts
move #$1824,$242812 ;LOAD C
move.b $23600D,18642(a5) ;Read GAD/GBD with H and EVEN
move.b #$20,$23600D ;Clock
move.b $23600D,18643(a5) ;Read GAD/GBD with H and EVEN
move.b #$20,$23600D ;Clock
move.b $23600D,18644(a5) ;Read GAD/GBD with H and EVEN
move.b #$20,$23600D ;Clock
move.b $23600D,18645(a5) ;Read GAD/GBD with H and EVEN
move.b #$20,$23600D ;Clock
move.l 18642(a5),d0
subi.l #$18244281,d0 ;Compare reads
rts
Emulation
MAME's HLE emulation (fatfury2_protection): [[1]]
Reads:
- To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
- To $236004, $23600C: return dataout >> 24 nibble swapped
Writes:
- To $211112, with data = $1111: dataout = $FF000000
- To $233332, with data = $3333: dataout = $0000FFFF;
- To $244442, with data = $4444: dataout = $00FF0000;
- To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
- To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
- To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
- To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte