PRO-CT0: Difference between revisions

From NeoGeo Development Wiki
Jump to navigation Jump to search
No edit summary
mNo edit summary
Line 10: Line 10:
{|align="center"
{|align="center"
!Sprite graphics mux
!Sprite graphics mux
<span style="color:#FF0000;">Warning: GAD/GBD order is wrong, it's 1032 instead of 3210</span>
!Security device
!Security device
|-
|-

Revision as of 19:36, 22 October 2012

PRO-CT0 is an early SDIP64 gate array chip used as:

  • A sprite graphics multiplexer on AES carts and MVS boards, sometimes named ALPHA-8921, later replaced by NEO-ZMC2 and then NEO-CMC.
  • Security device in Super Sidekicks and Fatal Fury 2 AES and MVS cartridges, also named SNK-9201.

The device probably wasn't intended to be used as as security measure at first.

ALPHA-8921 is the original chip name when Alpha Denshi designed it.

Pinouts

Sprite graphics mux

Warning: GAD/GBD order is wrong, it's 1032 instead of 3210

Security device
Info by User:Kyuusaku *D0~D15: 68k data bus
  • A1~A19: 68k address bus
  • D0out~D7out: output to a LS245 which puts the data on

the 68k bus when /PORTOEL goes low ($200000-$2FFFFF odd byte read).

Internal logic

Kyuusaku's Verilog definition: File:Ct0.zip

furrtek's version:

Use as graphics multiplexer

PRO-CT0 9020KX032 on an MV-4 MVS system, as a graphics serializer

See NEO-ZMC2.





Use as security device

PRO-CT0 9042KX023 on an AES cart PROG board as a security chip

Used on PROG-G2 boards. It is found in Fatal Fury 2 and Super Sidekicks only. It was SNK's first attempt at protecting NeoGeo games.

The chip is tied to the 68k address and data bus, listens to word writes and replies on odd addresses in the $200000-$2FFFFF address range.

The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.

Address bus mapping:

A19 A18 A17 A16 A15 A14 A13 A12 A11 A10 A9 A8 A7 A6 A5 A4 A3 A2 /PORTWEL A1
C31 C29 C27 C25 C30 C28 C26 C24 C23 C21 C19 C17 C22 C20 C18 C16 H EVEN 12M LOAD

Data bus mapping:

D15 D14 D13 D12 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0
C15 C13 C11 C9 C14 C12 C10 C8 C7 C5 C3 C1 C6 C4 C2 C0
File:Crt snk-9201.jpg
SNK-9201 chip found in a Super Sidekicks MVS cartridge. Picture courtesy of [MVS-Scans].

Fatal Fury 2 code

00296A:
	move	#$5555,$255552		;LOAD C $33333333
	move.b	$255551,$10AC2E		;Read GAD/GBD: $FF
	move.b	d0,$255551		;Clock
	move.b	$2FFFF1,$10AC2F		;Read GAD/GBD: $00
	move.b	d0,$2FFFF1		;Clock
	move.b	$200001,$10AC30		;Read GAD/GBD: $FF
	move.b	d0,$2FF001		;Clock
	move.b	$2FF001,$10AC31		;Read GAD/GBD: $00
	cmpi.l	#$FF00FF00,$10AC2E	;Compare reads
	beq	+
	move	#$3328,24580(a5)	;Lock up flag ?
+:
	rts
012530:
	move	#$1234,$256782		;LOAD C $366A061A (00110110 01101010 00000110 00011010)
	move.b	$236001,18642(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.b	$236001,18643(a5)	;Read GAD/GBD
	move.b	#$20,236001		;Clock
	move.b	$236001,18644(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.b	$236001,18645(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.l	18642(a5),d0
	subi.l	#$F05A3601,d0		;Compare reads (1111 0000 0101 1010 0011 0110 0000 0001)
	rts
	move	#$1824,$242812		;LOAD C
	move.b	$236009,18642(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18643(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18644(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18645(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.l	18642(a5),d0
	subi.l	#$81422418,d0		;Compare reads
	rts
	move	#$1234,$256782		;LOAD C
	move.b	$236005,18642(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18643(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18644(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18645(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.l	18642(a5),d0
	subi.l	#$0FA56310,d0		;Compare reads
	rts

	move	#$1824,$242812		;LOAD C
	move.b	$23600D,18642(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18643(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18644(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18645(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.l	18642(a5),d0
	subi.l	#$18244281,d0		;Compare reads
	rts

Emulation

MAME's HLE emulation (fatfury2_protection): [[1]]

Reads:

  • To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
  • To $236004, $23600C: return dataout >> 24 nibble swapped

Writes:

  • To $211112, with data = $1111: dataout = $FF000000
  • To $233332, with data = $3333: dataout = $0000FFFF;
  • To $244442, with data = $4444: dataout = $00FF0000;
  • To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
  • To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
  • To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
  • To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte