PRO-CT0

PRO-CT0 is an early SDIP64 gate array chip used as:

• A sprite graphics multiplexer on AES carts and MVS boards, sometimes named ALPHA-8921, later replaced by NEO-ZMC2 and then NEO-CMC.
• Security device in Super Sidekicks and Fatal Fury 2 AES and MVS cartridges, also named SNK-9201.

The device probably wasn't intended to be used as as security measure at first ?

Pinouts

Sprite graphics mux	Security device
Info by User:Kyuusaku	*D0~D15: 68k data bus A1~A19: 68k address bus D0out~D7out: output to a LS245 which puts the data on the 68k bus when /PORTOEL goes low ($200000-$2FFFFF odd byte read).

Use as graphics multiplexer

PRO-CT0 9020KX032 on an MV-4 MVS system, as a graphics serializer

See NEO-ZMC2.

Use as security device

PRO-CT0 9042KX023 on an AES cart PROG board as a security chip

Used on PROG-G2 boards. It is found in Fatal Fury 2 and Super Sidekicks only. It was SNK's first attempt at protecting NeoGeo games.

The chip is tied to the 68k address and data bus, listens to word writes and replies on odd addresses in the $200000-$2FFFFF address range.

The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.

Address bus mapping:

A19

A18

A17

A16

A15

A14

A13

A12

A11

A10

A9

A8

A7

A6

A5

A4

A3

A2

/PORTWEL

A1

C31

C29

C27

C25

C30

C28

C26

C24

C23

C21

C19

C17

C22

C20

C18

C16

H

EVEN

12M

LOAD

Data bus mapping:

D15

D14

D13

D12

D11

D10

D9

D8

D7

D6

D5

D4

D3

D2

D1

D0

C15

C13

C11

C9

C14

C12

C10

C8

C7

C5

C3

C1

C6

C4

C2

C0

File:Crt snk-9201.jpg

SNK-9201 chip found in a Super Sidekicks MVS cartridge. Picture courtesy of [MVS-Scans].

Fatal Fury 2 code

00296A:
	move	#$5555,$255552		;LOAD C $33333333
	move.b	$255551,$10AC2E		;Read GAD/GBD: $FF
	move.b	d0,$255551		;Clock
	move.b	$2FFFF1,$10AC2F		;Read GAD/GBD: $00
	move.b	d0,$2FFFF1		;Clock
	move.b	$200001,$10AC30		;Read GAD/GBD: $FF
	move.b	d0,$2FF001		;Clock
	move.b	$2FF001,$10AC31		;Read GAD/GBD: $00
	cmpi.l	#$FF00FF00,$10AC2E	;Compare reads
	beq	+
	move	#$3328,24580(a5)	;Lock up flag ?
+:
	rts

012530:
	move	#$1234,$256782		;LOAD C $366A061A (00110110 01101010 00000110 00011010)
	move.b	$236001,18642(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.b	$236001,18643(a5)	;Read GAD/GBD
	move.b	#$20,236001		;Clock
	move.b	$236001,18644(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.b	$236001,18645(a5)	;Read GAD/GBD
	move.b	#$20,$236001		;Clock
	move.l	18642(a5),d0
	subi.l	#$F05A3601,d0		;Compare reads (1111 0000 0101 1010 0011 0110 0000 0001)
	rts

	move	#$1824,$242812		;LOAD C
	move.b	$236009,18642(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18643(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18644(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.b	$236009,18645(a5)	;Read GAD/GBD with H (reverse)
	move.b	#$20,$236009		;Clock
	move.l	18642(a5),d0
	subi.l	#$81422418,d0		;Compare reads
	rts

	move	#$1234,$256782		;LOAD C
	move.b	$236005,18642(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18643(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18644(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.b	$236005,18645(a5)	;Read GAD/GBD with EVEN (nibble swap)
	move.b	#$20,$236005		;Clock
	move.l	18642(a5),d0
	subi.l	#$0FA56310,d0		;Compare reads
	rts

	move	#$1824,$242812		;LOAD C
	move.b	$23600D,18642(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18643(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18644(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.b	$23600D,18645(a5)	;Read GAD/GBD with H and EVEN
	move.b	#$20,$23600D		;Clock
	move.l	18642(a5),d0
	subi.l	#$18244281,d0		;Compare reads
	rts

Emulation

MAME's HLE emulation (fatfury2_protection): [[1]]

Reads:

• To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
• To $236004, $23600C: return dataout >> 24 nibble swapped

Writes:

• To $211112, with data = $1111: dataout = $FF000000
• To $233332, with data = $3333: dataout = $0000FFFF;
• To $244442, with data = $4444: dataout = $00FF0000;
• To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
• To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
• To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
• To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte