CPS-2 Shock

Report One
I am now going to show you some encrypted data. To do this I will use ROM's from Street Fighter Zero and Alpha. Both games are the same but were released in different languages and use different encryption. Only one ROM from each game board contains the encrypted data in question, it sits in socket 3 of the game board. I am also going to use the one equivalent ROM from the CPS Changer version of Street Fighter Zero. This game is the same as its CPS-2 counterparts but is non encrypted. If you have ROM dumps of these games the checksums for these ROM's are;

Street Fighter Zero (rev. 950727) : f5444120
Street Fighter Alpha (rev. 950727) : ebf2054d
Street Fighter Zero (Changer) : 1140743f

Before I looked at any data from these ROM's they had to be byte swapped. If your going to compare data from this page with your ROM's you must byte swap them before the data here will match up. From now on all references to Street Fighter Zero, Street Fighter Alpha and Street Fighter Zero (CPS Changer) will be as SFz, SFa and SFzch. With these details out the way lets make a start.

The data below consists of three hexadecimal dumps of all ROM's at a set location. The location for both SFz and SFa is the same but the location in the SFzch ROM is different. I found these locations by matching non encrypted data from all ROM's and going from there. I have highlighted the encrypted data and relevant SFzch parts white so you can easily see that the data above and below is the same.

        SFzch
SFz   SFa

$44940 : $44950 : $44960 : $44970 : $44980 : $44990 : $449A0 : $449B0 : $449C0 : $449D0 : 09 C0 00 08 00 E1 09 C0 00 08 01 61 09 C0 00 08 01 01 09 C0 00 08 01 21 10 2E 00 04 32 3B 00 06 4E FB 10 02 00 08 00 44 00 4A 00 50 54 2E 00 04 70 00 1D 40 00 0A 1D 40 00 0F 1D 40 00 09 3D 7C 00 00 00 10 3D 7C 00 F0 00 14 0C 2E 00 02 00 03 66 06 3D 7C 00 30 00 14 10 2E 00 03 E5 48 41 FB 00 16 2D 48 00 20 4E 75 4E F9 00 01 33 00 54 2E 00 04 4E 75 4E F9 00 01 3B 2C 00 04 49 C6 00 04 4A 8A 00 04 49 C6 00 04 18 17 00 10 00 05 00 00 00 00 00 10 00 05 00 10 00 00 00 10 00 05 00 20 $445BC : $445CC : $445DC : $445EC : $445FC : $4460C : $4461C : $4462C : $4463C : $4464C : 09 C0 00 08 00 E1 09 C0 00 08 01 61 09 C0 00 08 01 01 09 C0 00 08 01 21 70 3C 3C F9 D3 9D 45 E4 B0 01 EA 9A DD 07 B7 4C 78 0E 03 F3 8D 0F 94 54 7B 5D 87 14 CF 07 DD C6 CD E5 7E C0 65 5B 50 E6 3F 64 65 57 52 C9 D0 DF 72 BC 03 8B AB 91 44 72 29 6D 01 51 3F 01 DF 0A 66 1C 11 57 89 D6 91 C1 10 C9 9F C5 B5 23 E2 1E 90 7F 1B F7 32 FC BA 58 22 CD DD 5A 25 64 C8 95 8E DA 00 04 46 42 00 04 47 06 00 04 46 42 00 04 18 17 00 10 00 05 00 00 00 00 00 10 00 05 00 10 00 00 00 10 00 05 00 20 09 C0 00 08 00 E1 09 C0 00 08 01 61 09 C0 00 08 01 01 09 C0 00 08 01 21 77 30 99 1E 62 CA 41 6F 4E E4 13 E2 46 EB 95 3A E8 D4 B0 64 2A 99 96 AF AA F9 3B 82 39 50 9A 0F DF 7D 44 A0 D7 9A BE 6E 40 19 27 A1 73 4F DB 1C F7 3F F5 26 0B F7 EC DC 98 1C 85 97 BF 5E 31 76 4D 95 FC DC 2D 79 BE 2E C6 73 86 1C EB 58 CE CB E1 57 25 75 65 65 C7 97 1D D6 3D 6D 6F F8 F1 10 5F A9 00 04 46 42 00 04 47 06 00 04 46 42 00 04 18 17 00 10 00 05 00 00 00 00 00 10 00 05 00 10 00 00 00 10 00 05 00 20

If you look at the data I have highlighted blue you can see that although the data is the same for SFz and SFa, the data in SFzch is different. Anyone who knows 68000 and has used a hexadecimal editor should notice these bytes are actually pointing to memory addresses, these are;

SFzch
SFz / SFa

$449C6 $44A8A $449C6 $44642 $44706 $44642
The difference in value between all these addresses above from SFzch to SFz / SFa is $384, this is also the difference between $44958 and $445D4 which is the start locations of the code in question (highlighted white in the first table). As you can also see, one address is repeated twice in all ROM's. I'll show you what data is at all these addresses in each ROM comparing it with the corresponding addresses in the other ROM's.

        SFzch
SFz   SFa

$449C6 : $44A8A : 00 04 18 17 00 04 18 11 $44642 : $44706 : 00 04 18 17 00 04 18 11 00 04 18 17 00 04 18 11

As I expected the data is 100% identical until the next piece of encrypted code starts. These addresses also look like they hold address pointers, but these pointers are to the same address. This can happen for many reasons, too many to go into it here.

All these findings confirm that I have picked out and correctly matched encrypted code from SFz and SFa with non encrypted code from SFzch. I have repeated this at many different locations throughout these ROM's and have had the same results. I hope this information proves that SFz, SFa and SFzch do use for some part the same code but with SFz and SFa being encrypted.

Please note. If the 68000 CPS-2 processor is custom then the chances of the encrypted bytes matching the non encrypted bytes once non encrypted is very slim, this does not affect in any way my findings though.