TMSS to append to ROM

[retrorepair]

Not an issue really, more a question; if I wanted to append the TMSS to a ROM (ala Sonic & Knuckles) just to see the licence screen before a game rather than actually do any checking, would all that's required be to spoof a "pass" and concatenate the resulting TMSS to the start of a ROM?

I'm not sure how to do any of this, but will try my best to figure it out if that's what I need to do!

[retrorepair]

I've managed to disable the check, but it seems I now need to jmp to the start of the rom, which I can't for the life of me figure out. Seems this is way over my head :(

I thought the start would be 512 bytes into the rom so after the header, but I'm not even sure I'm doing what I need to in order to get there, I think all I'm doing is jumping to a random memory location.

[OrionNavattan]

I assume your goal is a behavior similar to what games released for the Genesis by Absolute Entertainment did: displaying a "fake" version of the TMSS message if the console does not have TMSS. In that case, the best approach would be to incorporate the data for the message and the code to load it within the game's init code. The following is a general example of how you could implement this: it will display the message only on non-TMSS consoles, and only on cold boot:

		
		move.b	(console_version).l,d0	; get hardware version register
		andi.b	#console_revision,d0	; only version bits
		bne.w	Continue_Init			; if console has TMSS (Model 1 VA5/VA6 and later), skip displaying the fake TMSS message
		tst.w	(port_e_control_hi).l	; was this a soft reset?
		bne.w	Continue_Init			; if so, skip displaying the fake TMSS message

LoadLicenseMessage:
		lea	(vdp_control_port).l,a4
		lea	(vdp_data_port).l,a5
		lea	Pal_Text_Data(pc),a1		; start of license message data
		move.w	(a1)+,d0				; set loop counter to the palette size ($1, aka 2 colors)
		vdp_comm.l	move,2,cram,write,(a4)		; set VDP to CRAM write at Line 1, Entry 3

	.cram_loop:
		move.w 	(a1)+,(a5)				; copy the palette to CRAM
		dbf	d0,.cram_loop

		move.l (sizeof_LicenseFont/4)-1,d6	; loops to copy license message font to VRAM
		vdp_comm.l	move,vram_LicenseFont,vram,write,(a4) ; set VDP to VRAM write at address $C20

	.load_font:
		move.l	(a1)+,(a5)				; copy the character set for the license message to VRAM
		dbf	d6,.load_font

		vdp_comm.l	move,(vram_fg+$594),vram,write,d5	; VRAM write at $C594, location where mappings for first line of license message are written

Load_Mappings:
		move.l	d5,(a4)					; on first run, set VDP to VRAM write at $C594; on all subsequent runs, set write address for new line

	.main:
		moveq	#0,d1
		move.b 	(a1)+,d1				; get current byte of license text to d1
		bmi.s	.next_line				; if it is the line terminator, branch
		bne.s	.set					; if not zero, branch
		bra.s	.enable_display					; if zero, we are done

	.set:
		move.w	d1,(a5)					; copy current byte to VRAM as word, generating a tile map entry
		bra.s	.main					; next byte

	.next_line:
		addi.l	#$1000000,d5				; add $1000000 to make VDP command longword to start the next line
		bra.s	Load_Mappings				; set new write address		
		
		move.w	#vdp_enable_display|vdp_md_display,(a4)	; enable display, showing the license message
		move.w	#$3C,d0

DelayLoop:							; double-nested loop to delay for a couple seconds while the license message is displayed
		move.w	#$95CE,d1				; set inner loop counter to 38,350

	.inner_delay_loop:
		dbf d1,.inner_delay_loop
		dbf d0,DelayLoop				; repeat the inner loop 60 times
	
		move.w	#vdp_md_display,(a4)			; disable display
		bra.w	Continue_Init			; continue with program init

Pal_Text_Data:
		dc.w	1					; palette size
		dc.w	$EEE					; white
		dc.w	$EE8					; blue (for unused SEGA logo text)

	;.license_font:
		incbin	"License Text Font.bin"			;  character set for license message (also includes an unused mini SEGA logo)

	;.license_mappings:
		dc.b	"   produced by or",endline 
		dc.b	" under license from",endline 
		dc.b	"sega,enterprises ltd{",endstring	; opening curly brace represents a period, comma may have been meant for a TM symbol or related


Continue_Init:

As for where to insert it, assuming you're playing with one of the Sonic disassemblies, best place to put it would be after the standard init library but before the checksum check. Using my Sonic 2 disassembly as an example

GameProgram:				
		tst.w	(vdp_control_port).l

CheckSumCheck:				
		move.w	(vdp_control_port).l,d1			; get status register
	if Revision>0
		btst	#dma_status_bit,d1			; was the console soft reset at the start of a 68K to DMA operation?
		bne.s	CheckSumCheck				; if so, wait until the DMA is completed
	endc
               ; Code for fake TMSS screen would go here.

		btst	#6,(port_e_control).l			; was this a soft reset?
		beq.s	ChecksumTest				; if so, branch
		cmpi.l	#'init',(v_checksum_pass).w		; has checksum routine already run?
		beq.w	GameInit				; if it has, branch

[retrorepair]

Thank you for the in depth example, it's much appreciated.

The trouble is, I'm hoping to append it to existing roms. Looking at it, I don't think it'll work how I imagined though. I think the TMSS is just selected in the same address space as the start of the cartridge, is that right?

I was hoping to add this to MiSTer but I don't think I'm up to it, this was my fallback plan but seems I'm out of luck :(

[OrionNavattan]

The way it works, you can't really "append" it to an existing ROM. I'm not familiar with MiSTer, but I can say that if you want to have the TMSS in the Genesis core, your best bet would simply be to add its functionality to the emulation of the bus arbiter, and have users provide their own copy of the ROM. If it's any help, here's a full explanation of how the entire security module works.

The TMSS ROM is indeed set up as a bankswitch with the cartridge slot, toggled by flipping bit 0 of $A14101 (0 = TMSS ROM, 1 = cartridge slot). The security mechanism, aka the VDP lock, works by blocking the /DTACK pulses from the VDP address space ($C00000) if the register at $A14000 is set to anything other than "SEGA". The ROM, registers, and the lock mechanism are all located on the bus arbiter-I/O controller die on Model 1 VA6 boards, and on the VDP/System ASIC on all later hardware revisions.

[RepellantMold]

I could never get the code in the example working, since .enable_display doesn't exist in the code and all I get is a blank screen when I attempt to test it