SNK-9201
Protection chip in SDIP64 package used in MVS cartridges using PROG-G2 boards. It is found in Fatal Fury 2 and Super Sidekicks only. It was SNK's first attempt at protecting NeoGeo games.
The chip is tied to the 68k address and data bus, listens to word writes and replies on odd addresses in the $200000-$2FFFFF address range.
The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.
Fatal Fury 2 code
00296A:
move #$5555,$255552 ;Write $5555 to $255552
move.b $255551,$10AC2E ;Read from $255551
move.b d0,$255551 ;Write d0.b to $255551
move.b $2FFFF1,$10AC2F ;Read from $2FFFF1
move.b d0,$2FFFF1 ;Write d0.b to $2FFFF1
move.b $200001,$10AC30 ;Read from $200001
move.b d0,$2FF001 ;Write d0.b to $2FF001
move.b $2FF001,$10AC31 ;Read from $2FF001
cmpi.l #$FF00FF00,$10AC2E ;Reads should have been = $FF,$00,$FF,$00
beq +
move #$3328,24580(a5) ;Lock up flag ?
+:
rts012530:
move #$1234,$256782 ;Write $1234 to $256782
move.b $236001,18642(a5) ;Read $236001
move.b #$20,$236001 ;Write $20 to $236001
move.b $236001,18643(a5) ;Read $236001
move.b #$20,236001 ;Write $20 to $236001
move.b $236001,18644(a5) ;Read $236001
move.b #$20,$236001 ;Write $20 to $236001
move.b $236001,18645(a5) ;Read $236001
move.b #$20,$236001 ;Write $20 to $236001
move.l 18642(a5),d0
subi.l #$F05A3601,d0 ;cmp $F05A3601 ?
rts move #$1824,EXT_02FC ;014C62: 33FC182400242812
move.b EXT_02FA,18642(a5) ;014C6A: 1B790023600948D2
move.b #$20,EXT_02FA ;014C72: 13FC002000236009
move.b EXT_02FA,18643(a5) ;014C7A: 1B790023600948D3
move.b #$20,EXT_02FA ;014C82: 13FC002000236009
move.b EXT_02FA,18644(a5) ;014C8A: 1B790023600948D4
move.b #$20,EXT_02FA ;014C92: 13FC002000236009
move.b EXT_02FA,18645(a5) ;014C9A: 1B790023600948D5
move.b #$20,EXT_02FA ;014CA2: 13FC002000236009
move.l 18642(a5),d0 ;014CAA: 202D48D2
subi.l #$81422418,d0 ;014CAE: 048081422418
rts ;014CB4: 4E75 move #$1234,EXT_02FF ;0155D4: 33FC123400256782
move.b EXT_02F9,18642(a5) ;0155DC: 1B790023600548D2
move.b #$20,EXT_02F9 ;0155E4: 13FC002000236005
move.b EXT_02F9,18643(a5) ;0155EC: 1B790023600548D3
move.b #$20,EXT_02F9 ;0155F4: 13FC002000236005
move.b EXT_02F9,18644(a5) ;0155FC: 1B790023600548D4
move.b #$20,EXT_02F9 ;015604: 13FC002000236005
move.b EXT_02F9,18645(a5) ;01560C: 1B790023600548D5
move.b #$20,EXT_02F9 ;015614: 13FC002000236005
move.l 18642(a5),d0 ;01561C: 202D48D2
subi.l #$0FA56310,d0 ;015620: 04800FA56310
rts ;015626: 4E75
move #$1824,EXT_02FC ;015628: 33FC182400242812
move.b EXT_02FB,18642(a5) ;015630: 1B790023600D48D2
move.b #$20,EXT_02FB ;015638: 13FC00200023600D
move.b EXT_02FB,18643(a5) ;015640: 1B790023600D48D3
move.b #$20,EXT_02FB ;015648: 13FC00200023600D
move.b EXT_02FB,18644(a5) ;015650: 1B790023600D48D4
move.b #$20,EXT_02FB ;015658: 13FC00200023600D
move.b EXT_02FB,18645(a5) ;015660: 1B790023600D48D5
move.b #$20,EXT_02FB ;015668: 13FC00200023600D
move.l 18642(a5),d0 ;015670: 202D48D2
subi.l #$18244281,d0 ;015674: 048018244281
rts ;01567A: 4E75
Emulation
MAME emulation (fatfury2_protection): [[1]]
Reads:
- To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
- To $236004, $23600C: return dataout >> 24 nibble swapped
Writes:
- To $211112, with data = $1111: dataout = $FF000000
- To $233332, with data = $3333: dataout = $0000FFFF;
- To $244442, with data = $4444: dataout = $00FF0000;
- To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
- To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
- To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
- To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte
Pinout
- D0~D15: 68k data bus
- A1~A19: 68k address bus
- D0out~D7out: output to a LS245 which puts the data on the 68k data when /PORTOEL goes low ($200000-$2FFFFF odd byte read).
Apparently those chips don't have tristate-able outputs.