BIOS protection by Holly

[MetalliC]

(13.06.2014 09:27)kof888 писал(а):  mov.l @(h'EC,pc), r5 ; [8C0005F4] = h'A0008000
mov.w @(h'F0,pc), r4 ; [8C0005FA] = h'300
mov.w @(h'EC,pc), r0 ; [8C0005F8] = h'3400
bsr sub_8C00055E

а откуда это? я смотрел под отладчиком - да, в 8C00055E процедурка сравнения, но с такими аргументами она у меня не вызывалась.

Цитата:I'm wondering if the 0x001ffff can be reduced though?
It may just be to set the "size" of the final checksum and initialize it.

for sure.
for example Sammy Atomiswave have only 128Kb BIOS, so code writes 0xA677 to this register and then execute a read loop until this address.

from my current knowledge about "how it works" - 5F74E4 register is definitely "last address of checksum calculation".
then its written - device resets to "locked" state and (starts to )or(switch to state of) calculate checksum until that address.
after reading this "last address" calculated checksum compared with some hardcoded value, and if they match - G1 bus will be unlocked.

but how this is done totally unclear...
imo there is 2 options -
1. hardware reads data automatically, by itself, so "read loop" in bios code is just a delay, long enough until Holly reads BIOS and unlocks G1 bus.
2. hardware monitor data passed through G1 bus (i.e. bios readed by code) and summs them, and then readed address will match "last address" it compares calculated summ.