|
|
| Line 1: |
Line 1: |
| [[File:crt_snk-9201.jpg|right|thumb|SNK-9201 chip found in a [[Super Sidekicks]] MVS cartridge. Picture courtesy of [[http://www.mvs-scans.com MVS-Scans]].]]
| | #REDIRECT [[PRO-CT0]] |
| | |
| Protection chip in SDIP64 package used in [[Cartridges|MVS cartridges]] using [[PROG board#PROG-G2|PROG-G2]] boards. It is found in [[Fatal Fury 2]] and [[Super Sidekicks]] only. It was SNK's first attempt at protecting NeoGeo games.
| |
| | |
| The chip is tied to the [[68k]] address and data bus, listens to word writes and replies on odd addresses in the [[68k memory map|$200000-$2FFFFF]] address range.
| |
| | |
| The game program expects the chip to reply with specific data depending on the values written to it and will freeze if they are wrong.
| |
| | |
| ==Fatal Fury 2 code==
| |
| | |
| <syntaxhighlight>
| |
| 00296A:
| |
| move #$5555,$255552 ;Write $5555 to $255552
| |
| move.b $255551,$10AC2E ;Read from $255551
| |
| move.b d0,$255551 ;Write d0.b to $255551
| |
| move.b $2FFFF1,$10AC2F ;Read from $2FFFF1
| |
| move.b d0,$2FFFF1 ;Write d0.b to $2FFFF1
| |
| move.b $200001,$10AC30 ;Read from $200001
| |
| move.b d0,$2FF001 ;Write d0.b to $2FF001
| |
| move.b $2FF001,$10AC31 ;Read from $2FF001
| |
| cmpi.l #$FF00FF00,$10AC2E ;Reads should have been = $FF,$00,$FF,$00
| |
| beq +
| |
| move #$3328,24580(a5) ;Lock up flag ?
| |
| +:
| |
| rts
| |
| </syntaxhighlight>
| |
| | |
| <syntaxhighlight>
| |
| 012530:
| |
| move #$1234,$256782 ;Write $1234 to $256782
| |
| move.b $236001,18642(a5) ;Read $236001
| |
| move.b #$20,$236001 ;Write $20 to $236001
| |
| move.b $236001,18643(a5) ;Read $236001
| |
| move.b #$20,236001 ;Write $20 to $236001
| |
| move.b $236001,18644(a5) ;Read $236001
| |
| move.b #$20,$236001 ;Write $20 to $236001
| |
| move.b $236001,18645(a5) ;Read $236001
| |
| move.b #$20,$236001 ;Write $20 to $236001
| |
| move.l 18642(a5),d0
| |
| subi.l #$F05A3601,d0 ;cmp $F05A3601 ?
| |
| rts
| |
| </syntaxhighlight>
| |
| | |
| <syntaxhighlight>
| |
| move #$1824,EXT_02FC ;014C62: 33FC182400242812
| |
| move.b EXT_02FA,18642(a5) ;014C6A: 1B790023600948D2
| |
| move.b #$20,EXT_02FA ;014C72: 13FC002000236009
| |
| move.b EXT_02FA,18643(a5) ;014C7A: 1B790023600948D3
| |
| move.b #$20,EXT_02FA ;014C82: 13FC002000236009
| |
| move.b EXT_02FA,18644(a5) ;014C8A: 1B790023600948D4
| |
| move.b #$20,EXT_02FA ;014C92: 13FC002000236009
| |
| move.b EXT_02FA,18645(a5) ;014C9A: 1B790023600948D5
| |
| move.b #$20,EXT_02FA ;014CA2: 13FC002000236009
| |
| move.l 18642(a5),d0 ;014CAA: 202D48D2
| |
| subi.l #$81422418,d0 ;014CAE: 048081422418
| |
| rts ;014CB4: 4E75
| |
| </syntaxhighlight>
| |
| | |
| <syntaxhighlight>
| |
| move #$1234,EXT_02FF ;0155D4: 33FC123400256782
| |
| move.b EXT_02F9,18642(a5) ;0155DC: 1B790023600548D2
| |
| move.b #$20,EXT_02F9 ;0155E4: 13FC002000236005
| |
| move.b EXT_02F9,18643(a5) ;0155EC: 1B790023600548D3
| |
| move.b #$20,EXT_02F9 ;0155F4: 13FC002000236005
| |
| move.b EXT_02F9,18644(a5) ;0155FC: 1B790023600548D4
| |
| move.b #$20,EXT_02F9 ;015604: 13FC002000236005
| |
| move.b EXT_02F9,18645(a5) ;01560C: 1B790023600548D5
| |
| move.b #$20,EXT_02F9 ;015614: 13FC002000236005
| |
| move.l 18642(a5),d0 ;01561C: 202D48D2
| |
| subi.l #$0FA56310,d0 ;015620: 04800FA56310
| |
| rts ;015626: 4E75
| |
| move #$1824,EXT_02FC ;015628: 33FC182400242812
| |
| move.b EXT_02FB,18642(a5) ;015630: 1B790023600D48D2
| |
| move.b #$20,EXT_02FB ;015638: 13FC00200023600D
| |
| move.b EXT_02FB,18643(a5) ;015640: 1B790023600D48D3
| |
| move.b #$20,EXT_02FB ;015648: 13FC00200023600D
| |
| move.b EXT_02FB,18644(a5) ;015650: 1B790023600D48D4
| |
| move.b #$20,EXT_02FB ;015658: 13FC00200023600D
| |
| move.b EXT_02FB,18645(a5) ;015660: 1B790023600D48D5
| |
| move.b #$20,EXT_02FB ;015668: 13FC00200023600D
| |
| move.l 18642(a5),d0 ;015670: 202D48D2
| |
| subi.l #$18244281,d0 ;015674: 048018244281
| |
| rts ;01567A: 4E75
| |
| </syntaxhighlight>
| |
| | |
| | |
| ==Emulation==
| |
| | |
| MAME emulation (fatfury2_protection): [[http://mamedev.org/source/src/mame/machine/neoprot.c.html]]
| |
| | |
| Reads:
| |
| *To $255550, $2FFFF0, $200000, $2FF000, $236000, $236008: return dataout >> 24;
| |
| *To $236004, $23600C: return dataout >> 24 nibble swapped
| |
| | |
| Writes:
| |
| *To $211112, with data = $1111: dataout = $FF000000
| |
| *To $233332, with data = $3333: dataout = $0000FFFF;
| |
| *To $244442, with data = $4444: dataout = $00FF0000;
| |
| *To $255552, with data = $5555, read back from $255551, $2FFFF1, $200001, $2FF001: dataout = $FF00FF00
| |
| *To $256782, with data = $1234, read back from $36000 or $36004: dataout = $F05A3601
| |
| *To $242812, with data = $1824, read back from $36008 or $3600C: dataout = $81422418
| |
| *To $255551, $2FFFF1, $2FF001, $236001, $236005, $236009, $23600D, with data = $20: shift dataout left one byte
| |
| | |
| ==Pinout==
| |
| | |
| [[File:snk-9201_pinout.png]]
| |
| | |
| *D0~D15: 68k data bus
| |
| *A1~A19: 68k address bus
| |
| *D0out~D7out: output to a LS245 which puts the data on the 68k data when /PORTOEL goes low ($200000-$2FFFFF odd byte read).
| |
| | |
| Apparently [[PRO-CT0|those chips]] don't have tristate-able outputs.
| |
| | |
| [[Category:Chips]]
| |