The copy protections
A cartridge writing inside its own space is doing nothing at all: ROM takes no writes, so that instruction looks like dead code. It is not. A pirated cartridge is a copy loaded into RAM, and there the write does land and leaves the game broken somewhere it never returns from.
The pattern was identified by Manuel Pazos
(@ManuelPazosMSX) in his disassembly of
King's Valley (RC-727), where he named the two routines
ReadKeys_AC and VRAM_writeAC. What is here is that same
pattern, looked for across the 40 cartridges in the series.
13 of the 40 write inside their own space, and all
13 are Konami. The family always repeats the same two, in the same
two start-up routines: one puts a pop hl and a ret over
a djnz in the presentation chain, the other leaves a zero in
the operand of a jp, which in memory turns it into
jp 00000h —a dead reset—. That the target is always a
djnz or the operand of a jump, and never a gap in the data, is what
rules out stray writes.
| game | where | what it does | where it lands | what is there |
|---|---|---|---|---|
| Hyper Rally | 0x79C8 | ld (06957h),a | 0x6957 | ld a,(0e00ah) |
| Hyper Sports 3 | 0x4013 | ld (0412fh),hl | 0x412F | djnz L_413D |
| Hyper Sports 3 | 0x4040 | ld (0413bh),hl | 0x413B | jp espera_y_pasa — its operand |
| King's Valley | 0x4044 | ld (hl),a | 0x40E4 | djnz tarea_0_dibuja_o_avanza |
| King's Valley | 0x409C | ld (043c0h),de | 0x43C0 | jp nc,cierra_aviso_titulo — its operand |
| Knightmare | 0x4028 | ld (04112h),hl | 0x4112 | djnz L_4120 |
| Knightmare | 0x4055 | ld (0411eh),hl | 0x411E | jp L_4187 — its operand |
| Konami's Boxing | 0x470E | ld (04f84h),a | 0x4F84 | pop af |
| Konami's Ping Pong | 0x4013 | ld (040eeh),a | 0x40EE | djnz L_40FA |
| Konami's Ping Pong | 0x4052 | ld (040f8h),hl | 0x40F8 | jp L_4318 — its operand |
| Konami's Tennis | 0x7A31 | ld (0409ah),a | 0x409A | ret |
| Konami’s Soccer | 0x4028 | ld (0410ah),hl | 0x410A | djnz escena_presentacion_3 |
| Konami’s Soccer | 0x4056 | ld (04116h),hl | 0x4116 | jp espera_n_y_avanza_escena — its operand |
| Mopi Ranger | 0x406A | ld (04146h),a | 0x4146 | djnz comprueba_el_arranque |
| Mopi Ranger | 0x406F | ld (04147h),a | 0x4147 | djnz comprueba_el_arranque — its operand |
| Mopi Ranger | 0x40A5 | ld (044dfh),de | 0x44DF | jp L_45FF — its operand |
| Pippols | 0x4033 | ld (040c5h),hl | 0x40C5 | jp SIGUIENTE_ESTADO — its operand |
| The Goonies | 0x4022 | ld (0411ch),hl | 0x411C | djnz presentacion_anima |
| The Goonies | 0x4050 | ld (04129h),hl | 0x4129 | jp L_41C8 — its operand |
| Twin Bee | 0x4028 | ld (04195h),hl | 0x4195 | djnz L_41A3 |
| Twin Bee | 0x4055 | ld (041a1h),hl | 0x41A1 | jp empieza_la_escena_siguiente — its operand |
| Yie Ar Kung-Fu II | 0x4028 | ld (0410dh),hl | 0x410D | djnz L_411B |
| Yie Ar Kung-Fu II | 0x4056 | ld (04119h),hl | 0x4119 | jp L_41FB — its operand |
Page 0 of an MSX is ROM too, so a write there does not land either. But going to the BIOS does not make a write a protection: one turns up, and it is explained.
| game | where | what it does | where it lands | what is there |
|---|---|---|---|---|
| Antarctic Adventure | 0x4055 | ldir | 0x0000 | BIOS ROM |
Antarctic Adventure. It is the start-up guard: it copies jp 0000h over the BIOS entry point. A fourth build of the game proves it is a protection: identical save for two bytes, exactly the ones that send that same copy to DESPACHA, inside the cartridge itself.
Of Konami's, 20 cartridges write neither to their own space nor to the BIOS: Athletic Land, Cabbage Patch Kids, F-1 Spirit — The Way to Formula 1, Frogger, Hyper Olympic 1, Hyper Olympic 2, Hyper Sports 1, Hyper Sports 2, Konami's Baseball, Konami's Golf, Konami’s Billiards, Konami’s Game Master, Konami’s Mahjong Dojo, Monkey Academy, Nemesis / Gradius, Road Fighter, Sky Jaguar, Super Cobra, Time Pilot, Yie Ar Kung-Fu.
And none of the 6 cartridges that are not Konami's carries any of this (3D Golf Simulation, Bomber Man, Hole in One, Hole in One Professional, Casio World Open, Pitfall!). That is the control: if the sweep swallowed coincidences, they would show up there too.
The two MegaROMs, Nemesis / Gradius (KONAMI), F-1 Spirit — The Way to Formula 1 (SCC), are checked differently: their listing goes bank by
bank, so their own space is the whole window, 0x4000–0xBFFF,
minus the registers of their mapper, worked out from their own writes. Everything
they write there is a bank switch.
What actually happens when a copy runs in RAM is not measured: that would mean loading a copy and playing it, and no binary is distributed here. What is claimed is what the listing says: where the write is, where it points and what instruction sits at the target.
Nor are these all of them: the sweep sees writes to a fixed address, and
those going through HL or DE loaded just before. One
computing its target on the fly would slip past.