Capcom's Play System 2 Decryption Team.
W.I.P. Status CPS-2 Specs CPS Suicide Encryption Game List
The CPS-2 Encryption Information Page.

Report Five

I am now going to show you some encrypted data. To do this I will use ROM's from Street Fighter Zero revisions 950627 and 950727 along with Street Fighter Alpha. Only one ROM from each game board contains the encrypted data in question, it sits in socket 3 of the game board. I am also going to use the one equivalent ROM from the CPS Changer version of Street Fighter Zero. This is the same as its CPS-2 counterparts but is non encrypted. If you have the ROM dumps of these games the checksums for these ROM's are;
 
Street Fighter Zero (rev. 950627) :  844220c2
Street Fighter Zero (rev. 950727) :  f5444120
Street Fighter Alpha (rev. 950727) :  ebf2054d
Street Fighter Zero (Changer) :  1140743f

Before I looked at any data from these ROM's they had to be byte swapped. If your going to compare data from this page with your ROM's you must byte swap them before the data here will match up. From now on all references to Street Fighter Zero revisions 950627 / 950727 and Street Fighter Alpha will be as SFz1, SFz2 and SFa. References to Street Fighter Zero (CPS Changer) will be as SFzch. With these details out the way lets make a start.
 
Below you will see the standard Motorola 68000 vector table entries for each ROM. These vectors are located from address $00 to $FF and I've listed what each does. I've also highlighted the encrypted data and relevant SFzch parts white.
 
    SFzch
 
     SFa      SFz1      SFz2
SYSTEM SSP  $00 
SYSTEM PC
 $04 
BUS ERROR
 $08 
ADDRESS ERROR
 $0C 
ILLEGAL INSTRUCTION
 $10 
DIVISION BY ZERO
 $14 
CHK EXCEPTION
 $18 
TRAPV EXCEPTION
 $1C 
PRIVILEGE VIOLATION
 $20 
TRACE EXCEPTION
 $24 
LINE-A EMULATOR
 $28 
LINE-F EMULATOR
 $2C 
RESERVED BY MOTOROLA
 $30 
RESERVED BY MOTOROLA
 $34 
RESERVED BY MOTOROLA
 $38 
RESERVED BY MOTOROLA
 $3C 
RESERVED BY MOTOROLA
 $40 
RESERVED BY MOTOROLA
 $44 
RESERVED BY MOTOROLA
 $48 
RESERVED BY MOTOROLA
 $4C 
RESERVED BY MOTOROLA
 $50 
RESERVED BY MOTOROLA
 $54 
RESERVED BY MOTOROLA
 $58 
RESERVED BY MOTOROLA
 $5C 
SPURIOUS EXCEPTION
 $60 
INTERRUPT REQ LEVEL 1
 $64 
INTERRUPT REQ LEVEL 2
 $68 
INTERRUPT REQ LEVEL 3
 $6C 
INTERRUPT REQ LEVEL 4
 $70 
INTERRUPT REQ LEVEL 5
 $74 
INTERRUPT REQ LEVEL 6
 $78 
INTERRUPT REQ LEVEL 7
 $7C 
TRAP #00 EXCEPTION
 $80 
TRAP #01 EXCEPTION
 $84 
TRAP #02 EXCEPTION
 $88 
TRAP #03 EXCEPTION
 $8C 
TRAP #04 EXCEPTION
 $90 
TRAP #05 EXCEPTION
 $94 
TRAP #06 EXCEPTION
 $98 
TRAP #07 EXCEPTION
 $9C 
TRAP #08 EXCEPTION
 $A0 
TRAP #09 EXCEPTION
 $A4 
TRAP #10 EXCEPTION
 $A8 
TRAP #11 EXCEPTION
 $AC 
TRAP #12 EXCEPTION
 $B0 
TRAP #13 EXCEPTION
 $B4 
TRAP #14 EXCEPTION
 $B8 
TRAP #15 EXCEPTION
 $BC 
RESERVED BY MOTOROLA
 $C0 
RESERVED BY MOTOROLA
 $C4 
RESERVED BY MOTOROLA
 $C8 
RESERVED BY MOTOROLA
 $CC 
RESERVED BY MOTOROLA
 $D0 
RESERVED BY MOTOROLA
 $D4 
RESERVED BY MOTOROLA
 $D8 
RESERVED BY MOTOROLA
 $DC 
RESERVED BY MOTOROLA
 $E0 
RESERVED BY MOTOROLA
 $E4 
RESERVED BY MOTOROLA
 $E8 
RESERVED BY MOTOROLA
 $EC 
RESERVED BY MOTOROLA
 $F0 
RESERVED BY MOTOROLA
 $F4 
RESERVED BY MOTOROLA
 $F8 
RESERVED BY MOTOROLA
 $FC 
 
00FF8000
00000950
000000C0
000000CC
000000D8
000000E6
000000F4
00000102
00000110
0000011E
0000012C
0000013A
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000148
00000148
00001068
00000148
00000148
00000148
00000148
00000148
0000119A
00001200
00001254
00001312
0000133C
00001362
0000137E
000011D8
00001284
00001222
000011BC
000012CC
00001392
00000148
00000148
00000148
33FC0000
00FF0000
508F607E
33FC0001
00FF0000
508F6072
007C2600
33FC0002
00FF0000
6064007C
260033FC
000300FF
00006056
007C2600
33FC0004
00FF0000
 
F058C474
1E4C719F
000000C0
000000CC
000000D8
000000E6
000000F4
00000102
00000110
0000011E
0000012C
0000013A
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000148
00000148
000011DE
00000148
00000148
00000148
00000148
00000148
0000132C
00001392
000013E6
000014A4
000014CE
000014F4
00001510
0000136A
00001416
000013B4
0000134E
0000145E
00001524
00000148
00000148
00000148
DA068640
CE49F5CA
65594489
E632FF36
FBA89D62
CCFF1531
5DF1A281
17CEFA2D
FF9D432F
D9657FC4
1AE1D59E
9E15F466
5D1F8779
A88034DC
27E7B4F3
D59D0E16
 
6FC42E65
4A447A0A
000000C0
000000CC
000000D8
000000E6
000000F4
00000102
00000110
0000011E
0000012C
0000013A
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000148
00000148
000011DE
00000148
00000148
00000148
00000148
00000148
0000132C
00001392
000013E6
000014A4
000014CE
000014F4
00001510
0000136A
00001416
000013B4
0000134E
0000145E
00001524
00000148
00000148
00000148
437E59E4
D5C8A559
4ABE285A
0A6A7F4E
076EB1E4
B9A67B9F
8D363FD1
CD546A05
166D2BB6
09422434
93E3A7E4
A6BECB9E
F1818F6F
0D4B990E
A35405EC
7651700F
 
6FC42E65
4A447A0A
000000C0
000000CC
000000D8
000000E6
000000F4
00000102
00000110
0000011E
0000012C
0000013A
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000148
00000148
000011DE
00000148
00000148
00000148
00000148
00000148
0000132C
00001392
000013E6
000014A4
000014CE
000014F4
00001510
0000136A
00001416
000013B4
0000134E
0000145E
00001524
00000148
00000148
00000148
437E59E4
D5C8A559
4ABE285A
0A6A7F4E
076EB1E4
B9A67B9F
8D363FD1
CD546A05
166D2BB6
09422434
93E3A7E4
A6BECB9E
F1818F6F
0D4B990E
A35405EC
7651700F
 
As you can see only the very top and bottom of the vector table is encrypted, the rest is not although some numbers are slightly different as would be expected (marked blue). The reserved vectors from $C0 to $FC contain program code for the vectors I've marked in green and I feel that once non encrypted this code will be the same as SFZch.
 
After matching code from these ROM's as explained in my first report here I suspect the Program Counter will equal $00000988 in all encrypted ROM's once non encrypted and not $00000950 as SFzch does.
 

 
Capcom's Play System 2 Decryption Team.
W.I.P. Status CPS-2 Specs CPS Suicide Encryption Game List
This site is not affliated with, nor authorized, endorsed or licensed in any way by CAPCOM.