SNK-9201: Difference between revisions

From NeoGeo Development Wiki
Jump to navigation Jump to search
m (3 revisions: Import from wikkii)
 
No edit summary
Line 1: Line 1:
[[File:crt_snk-9201.jpg|right|thumb|SNK-9201 chip found in a [[Super Sidekicks]] MVS cartridge. Picture courtesy of [[http://www.mvs-scans.com MVS-Scans]].]]
[[File:crt_snk-9201.jpg|right|thumb|SNK-9201 chip found in a [[Super Sidekicks]] MVS cartridge. Picture courtesy of [[http://www.mvs-scans.com MVS-Scans]].]]


Protection chip in SDIP64 package used in [[Cartridges|MVS cartridges]]. It is found in Fatal Fury 2 and Super Sidekicks only. Some other games use PROG boards that support the chip, but did not include it.  No decryption or banking.  It was the first attempt at protecting NeoGeo games.
Protection chip in SDIP64 package used in [[Cartridges|MVS cartridges]] using [[PROG board#PROG-G2|PROG-G2]] boards. It is found in [[Fatal Fury 2]] and [[Super Sidekicks]] only. It was SNK's first attempt at protecting NeoGeo games.
 
The chip is tied to the [[68k]] address and data bus, listens to word writes and replies on odd addresses in the [[68k memory map|$200000-$2FFFFF]] address range.
 
The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.
 
==Fatal Fury 2 code==
 
<syntaxhighlight>
00296A:
move #$5555,$255552 ;Write $5555 to $255552
move.b $255551,$10AC2E ;Read from $255551
move.b d0,$255551 ;Write d0.b to $255551
move.b $2FFFF1,$10AC2F ;Read from $2FFFF1
move.b d0,$2FFFF1 ;Write d0.b to $2FFFF1
move.b $200001,$10AC30 ;Read from $200001
move.b d0,$2FF001 ;Write d0.b to $2FF001
move.b $2FF001,$10AC31 ;Read from $2FF001
cmpi.l #$FF00FF00,$10AC2E ;Reads should have been = $FF,$00,$FF,$00
beq +
move #$3328,24580(a5) ;Lock up flag ?
+:
rts
</syntaxhighlight>
 
<syntaxhighlight>
012530:
move #$1234,$256782 ;Write $1234 to $256782
move.b $236001,18642(a5) ;Read $236001
move.b #$20,$236001 ;Write $20 to $236001
move.b $236001,18643(a5) ;Read $236001
move.b #$20,236001 ;Write $20 to $236001
move.b $236001,18644(a5) ;Read $236001
move.b #$20,$236001 ;Write $20 to $236001
move.b $236001,18645(a5) ;Read $236001
move.b #$20,$236001 ;Write $20 to $236001
move.l 18642(a5),d0
subi.l #$F05A3601,d0 ;cmp $F05A3601 ?
rts
</syntaxhighlight>
 
<syntaxhighlight>
move #$1824,EXT_02FC ;014C62: 33FC182400242812
move.b EXT_02FA,18642(a5) ;014C6A: 1B790023600948D2
move.b #$20,EXT_02FA ;014C72: 13FC002000236009
move.b EXT_02FA,18643(a5) ;014C7A: 1B790023600948D3
move.b #$20,EXT_02FA ;014C82: 13FC002000236009
move.b EXT_02FA,18644(a5) ;014C8A: 1B790023600948D4
move.b #$20,EXT_02FA ;014C92: 13FC002000236009
move.b EXT_02FA,18645(a5) ;014C9A: 1B790023600948D5
move.b #$20,EXT_02FA ;014CA2: 13FC002000236009
move.l 18642(a5),d0 ;014CAA: 202D48D2
subi.l #$81422418,d0 ;014CAE: 048081422418
rts ;014CB4: 4E75
</syntaxhighlight>
 
<syntaxhighlight>
move #$1234,EXT_02FF ;0155D4: 33FC123400256782
move.b EXT_02F9,18642(a5) ;0155DC: 1B790023600548D2
move.b #$20,EXT_02F9 ;0155E4: 13FC002000236005
move.b EXT_02F9,18643(a5) ;0155EC: 1B790023600548D3
move.b #$20,EXT_02F9 ;0155F4: 13FC002000236005
move.b EXT_02F9,18644(a5) ;0155FC: 1B790023600548D4
move.b #$20,EXT_02F9 ;015604: 13FC002000236005
move.b EXT_02F9,18645(a5) ;01560C: 1B790023600548D5
move.b #$20,EXT_02F9 ;015614: 13FC002000236005
move.l 18642(a5),d0 ;01561C: 202D48D2
subi.l #$0FA56310,d0 ;015620: 04800FA56310
rts ;015626: 4E75
move #$1824,EXT_02FC ;015628: 33FC182400242812
move.b EXT_02FB,18642(a5) ;015630: 1B790023600D48D2
move.b #$20,EXT_02FB ;015638: 13FC00200023600D
move.b EXT_02FB,18643(a5) ;015640: 1B790023600D48D3
move.b #$20,EXT_02FB ;015648: 13FC00200023600D
move.b EXT_02FB,18644(a5) ;015650: 1B790023600D48D4
move.b #$20,EXT_02FB ;015658: 13FC00200023600D
move.b EXT_02FB,18645(a5) ;015660: 1B790023600D48D5
move.b #$20,EXT_02FB ;015668: 13FC00200023600D
move.l 18642(a5),d0 ;015670: 202D48D2
subi.l #$18244281,d0 ;015674: 048018244281
rts ;01567A: 4E75
</syntaxhighlight>


The chip is mapped into the 68k address space ($200000-$2FFFFF) and various values are written to it to various addresses.  The game program expects the chip to reply with specific data depending on the values written and will freeze if the wrong values are returned.


==Emulation==
==Emulation==


MAME emulation (fatfury2_protection): [[http://mamedev.org/source/src/mame/machine/neoprot.c.html]]
MAME emulation (fatfury2_protection): [[http://mamedev.org/source/src/mame/machine/neoprot.c.html]]
Reads:
*To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
*To $236004, $23600C: return dataout >> 24 nibble swapped
Writes:
*To $211112, with data = $1111: dataout = $FF000000
*To $233332, with data = $3333: dataout = $0000FFFF;
*To $244442, with data = $4444: dataout = $00FF0000;
*To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
*To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
*To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
*To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte
==Pinout==
[[File:snk-9201_pinout.png]]
*D0~D15: 68k data bus
*A1~A19: 68k address bus
*D0out~D7out: output to a LS245 which puts the data on the 68k data when /PORTOEL goes low ($200000-$2FFFFF odd byte read).
Apparently [[PRO-CT0|those chips]] don't have tristate-able outputs.


[[Category:Chips]]
[[Category:Chips]]

Revision as of 04:06, 15 March 2012

File:Crt snk-9201.jpg
SNK-9201 chip found in a Super Sidekicks MVS cartridge. Picture courtesy of [MVS-Scans].

Protection chip in SDIP64 package used in MVS cartridges using PROG-G2 boards. It is found in Fatal Fury 2 and Super Sidekicks only. It was SNK's first attempt at protecting NeoGeo games.

The chip is tied to the 68k address and data bus, listens to word writes and replies on odd addresses in the $200000-$2FFFFF address range.

The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.

Fatal Fury 2 code

00296A:
	move	#$5555,$255552		;Write $5555 to $255552
	move.b	$255551,$10AC2E		;Read from $255551
	move.b	d0,$255551		;Write d0.b to $255551
	move.b	$2FFFF1,$10AC2F		;Read from $2FFFF1
	move.b	d0,$2FFFF1		;Write d0.b to $2FFFF1
	move.b	$200001,$10AC30		;Read from $200001
	move.b	d0,$2FF001		;Write d0.b to $2FF001
	move.b	$2FF001,$10AC31		;Read from $2FF001
	cmpi.l	#$FF00FF00,$10AC2E	;Reads should have been = $FF,$00,$FF,$00
	beq	+
	move	#$3328,24580(a5)	;Lock up flag ?
+:
	rts
012530:
	move	#$1234,$256782		;Write $1234 to $256782
	move.b	$236001,18642(a5)	;Read $236001
	move.b	#$20,$236001		;Write $20 to $236001
	move.b	$236001,18643(a5)	;Read $236001
	move.b	#$20,236001		;Write $20 to $236001
	move.b	$236001,18644(a5)	;Read $236001
	move.b	#$20,$236001		;Write $20 to $236001
	move.b	$236001,18645(a5)	;Read $236001
	move.b	#$20,$236001		;Write $20 to $236001
	move.l	18642(a5),d0
	subi.l	#$F05A3601,d0		;cmp $F05A3601 ?
	rts
	move	#$1824,EXT_02FC		;014C62: 33FC182400242812
	move.b	EXT_02FA,18642(a5)	;014C6A: 1B790023600948D2
	move.b	#$20,EXT_02FA		;014C72: 13FC002000236009
	move.b	EXT_02FA,18643(a5)	;014C7A: 1B790023600948D3
	move.b	#$20,EXT_02FA		;014C82: 13FC002000236009
	move.b	EXT_02FA,18644(a5)	;014C8A: 1B790023600948D4
	move.b	#$20,EXT_02FA		;014C92: 13FC002000236009
	move.b	EXT_02FA,18645(a5)	;014C9A: 1B790023600948D5
	move.b	#$20,EXT_02FA		;014CA2: 13FC002000236009
	move.l	18642(a5),d0		;014CAA: 202D48D2
	subi.l	#$81422418,d0		;014CAE: 048081422418
	rts				;014CB4: 4E75
	move	#$1234,EXT_02FF		;0155D4: 33FC123400256782
	move.b	EXT_02F9,18642(a5)	;0155DC: 1B790023600548D2
	move.b	#$20,EXT_02F9		;0155E4: 13FC002000236005
	move.b	EXT_02F9,18643(a5)	;0155EC: 1B790023600548D3
	move.b	#$20,EXT_02F9		;0155F4: 13FC002000236005
	move.b	EXT_02F9,18644(a5)	;0155FC: 1B790023600548D4
	move.b	#$20,EXT_02F9		;015604: 13FC002000236005
	move.b	EXT_02F9,18645(a5)	;01560C: 1B790023600548D5
	move.b	#$20,EXT_02F9		;015614: 13FC002000236005
	move.l	18642(a5),d0		;01561C: 202D48D2
	subi.l	#$0FA56310,d0		;015620: 04800FA56310
	rts				;015626: 4E75
	move	#$1824,EXT_02FC		;015628: 33FC182400242812
	move.b	EXT_02FB,18642(a5)	;015630: 1B790023600D48D2
	move.b	#$20,EXT_02FB		;015638: 13FC00200023600D
	move.b	EXT_02FB,18643(a5)	;015640: 1B790023600D48D3
	move.b	#$20,EXT_02FB		;015648: 13FC00200023600D
	move.b	EXT_02FB,18644(a5)	;015650: 1B790023600D48D4
	move.b	#$20,EXT_02FB		;015658: 13FC00200023600D
	move.b	EXT_02FB,18645(a5)	;015660: 1B790023600D48D5
	move.b	#$20,EXT_02FB		;015668: 13FC00200023600D
	move.l	18642(a5),d0		;015670: 202D48D2
	subi.l	#$18244281,d0		;015674: 048018244281
	rts				;01567A: 4E75


Emulation

MAME emulation (fatfury2_protection): [[1]]

Reads:

  • To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
  • To $236004, $23600C: return dataout >> 24 nibble swapped

Writes:

  • To $211112, with data = $1111: dataout = $FF000000
  • To $233332, with data = $3333: dataout = $0000FFFF;
  • To $244442, with data = $4444: dataout = $00FF0000;
  • To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
  • To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
  • To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
  • To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte

Pinout

  • D0~D15: 68k data bus
  • A1~A19: 68k address bus
  • D0out~D7out: output to a LS245 which puts the data on the 68k data when /PORTOEL goes low ($200000-$2FFFFF odd byte read).

Apparently those chips don't have tristate-able outputs.

Retrieved from "https://wiki.neogeodev.org/index.php?title=SNK-9201&oldid=1864"