Reading the device returns the value of the counter XOR register 1 XOR register 2. Writing to the device with D6 low stores the lower 4 bits in another internal register, and also increments a 4-bit counter. Writing to the device with D6 high stores the lower 4 bits (head number) in an internal register. The gist of the protection is that there's two 4-bit registers and a 4-bit counter. Of course this isn't actually a real IDE device, but since the IDE hard drive (master) sees that the host is communicating with a slave, it stays off the bus and ignores this data. ![]() when bit 4=1, the slave device is selected, and the lower 4 bits are the head number. This is the IDE head and device select register. The CPLD sits on the bus and works when the host selects the IDE slave device (/CS0=0, /CS1=1, A2=1, A1=1, A0=0). ![]() They were also kinda tricky since the protection to allow the game to boot was slightly different than the protection to start a game (I thought I knew how it worked, then when starting a game, it'd say "Time Out" and go to the continue screen). I ended up writing several test ROMs (MIPS assembly, ugh) to put it through a bunch of well defined states while watching the data on the logic analyzer, rather than just watching the random data presented by the game PCB.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |