Security code: Difference between revisions

From NeoGeo Development Wiki
Jump to navigation Jump to search
No edit summary
m (Add syntaxhighlight tag)
Line 7: Line 7:
From the official SNK doc :
From the official SNK doc :


<pre>
<syntaxhighlight>
dc.w 07600H, 04A6DH, 00A14H, 06600H
dc.w 07600H, 04A6DH, 00A14H, 06600H
dc.w 0003CH, 0206DH, 00A04H, 03E2DH
dc.w 0003CH, 0206DH, 00A04H, 03E2DH
Line 24: Line 24:
dc.w 05888H, 051CFH, 0FFD8H, 03607H
dc.w 05888H, 051CFH, 0FFD8H, 03607H
dc.w 04E75H
dc.w 04E75H
</pre>
</syntaxhighlight>


From KOF96 (CD):
From KOF96 (CD):


<pre>
<syntaxhighlight>
moveq #0,d3
moveq #0,d3
tst 2580(a5) ;$10FD14.w
tst 2580(a5) ;$10FD14.w
Line 77: Line 77:
LAB_20F6:
LAB_20F6:
rts
rts
</pre>
</syntaxhighlight>


From sp-s2.sp1 :
From sp-s2.sp1 :
<pre>
<syntaxhighlight>
Security:
Security:
                 moveq  #0, d3
                 moveq  #0, d3
Line 136: Line 136:
locret_C1471A:
locret_C1471A:
                 rts
                 rts
</pre>
</syntaxhighlight>


[[Category:Code]]
[[Category:Code]]

Revision as of 12:12, 14 March 2012

Pointed to at $182 (in the 68k_program_header).

The BIOS compares this code byte per byte with its internal copy (which is located at $C146CA for SP-E, and $C146A2 for SP-E v2) as part of the cartridge detection routine.

There is some jumps to the security code inside the BIOS but it seems to never be called (at least in SP-E v2).

From the official SNK doc :

dc.w	07600H, 04A6DH, 00A14H, 06600H
dc.w	0003CH, 0206DH, 00A04H, 03E2DH
dc.w	00A08H, 013C0H, 00030H, 00001H
dc.w	03210H, 00C01H, 000FFH, 0671AH
dc.w	03028H, 00002H, 0D02DH, 00ACEH
dc.w	06610H, 03028H, 00004H, 0B02DH
dc.w	00ACFH, 00606H, 0B22DH, 00AD0H
dc.w	06708H, 05088H, 051CFH, 0FFD4H
dc.w	03607H, 04E75H, 0206DH, 00A04H
dc.w	03E2DH, 00A08H, 03210H, 0E049H
dc.w	00C01H, 000FFH, 0671AH, 03010H
dc.w	0B02DH, 00ACEH, 06612H, 03028H
dc.w	00002H, 0E048H, 0B02DH, 00ACFH
dc.w	06606H, 0B22DH, 00AD0H, 06708H
dc.w	05888H, 051CFH, 0FFD8H, 03607H
dc.w	04E75H

From KOF96 (CD):

	moveq	#0,d3
	tst	2580(a5)		;$10FD14.w
	bne	LAB_20F3		;
	movea.l	2564(a5),a0		;$10FD04.l
	move	2568(a5),d7		;$10FD08.w
LAB_20F0:
	move.b	d0,EXT_03E5		;watchdog
	move	(a0),d1
	cmpi.b	#$FF,d1
	beq.s	LAB_20F1		;skip
	move	2(a0),d0
	cmp.b	2766(a5),d0		;$10FDCE.b
	bne.s	LAB_20F1		;skip
	move	4(a0),d0
	cmp.b	2767(a5),d0		;$10FDCF.b
	bne.s	LAB_20F1		;skip
	cmp.b	2768(a5),d1		;$10FDD0.b
	beq.s	LAB_20F2
LAB_20F1:
	addq.l	#8,a0
	dbf	d7,LAB_20F0
	move	d7,d3
LAB_20F2:
	rts

LAB_20F3:
	movea.l	2564(a5),a0		;$10FD04.l
	move	2568(a5),d7		;$10FD08.w
LAB_20F4:
	move	(a0),d1
	lsr	#8,d1
	cmpi.b	#$FF,d1
	beq.s	LAB_20F5		;skip
	move	(a0),d0
	cmp.b	2766(a5),d0		;$10FDCE.b
	bne.s	LAB_20F5		;skip
	move	2(a0),d0
	lsr	#8,d0
	cmp.b	2767(a5),d0		;$10FDCF.b
	bne.s	LAB_20F5		;skip
	cmp.b	2768(a5),d1		;$10FDD0.b
	beq.s	LAB_20F6
LAB_20F5:
	addq.l	#4,a0
	dbf	d7,LAB_20F4
	move	d7,d3
LAB_20F6:
	rts

From sp-s2.sp1 :

Security:
                moveq   #0, d3
                tst.w   0xA14(a5)
                bne.w   loc_C146E6
                movea.l 0xA04(a5), a0
                move.w  0xA08(a5), d7

loc_C146B4:
                move.b  d0, (0x300001).l
                move.w  (a0), d1
                cmpi.b  #0xFF, d1
                beq.s   loc_C146DC
                move.w  2(a0), d0
                cmp.b   0xACE(a5), d0
                bne.s   loc_C146DC
                move.w  4(a0), d0
                cmp.b   0xACF(a5), d0
                bne.s   loc_C146DC
                cmp.b   0xAD0(a5), d1
                beq.s   locret_C146E4

loc_C146DC:
                addq.l  #8, a0
                dbf     d7, loc_C146B4
                move.w  d7, d3

locret_C146E4:
                rts

loc_C146E6:
                movea.l 0xA04(a5), a0
                move.w  0xA08(a5), d7

loc_C146EE:
                move.w  (a0), d1
                lsr.w   #8, d1
                cmpi.b  #0xFF, d1
                beq.s   loc_C14712
                move.w  (a0), d0
                cmp.b   0xACE(a5), d0
                bne.s   loc_C14712
                move.w  2(a0), d0
                lsr.w   #8, d0
                cmp.b   0xACF(a5), d0
                bne.s   loc_C14712
                cmp.b   0xAD0(a5), d1
                beq.s   locret_C1471A

loc_C14712:
                addq.l  #4, a0
                dbf     d7, loc_C146EE
                move.w  d7, d3

locret_C1471A:
                rts