decrypted = (src & 0x11) | ((src & 0xE0) >> 4) | ((src & 0x0E) << 4) bit 7 6 5 4 3 2 1 0 from 3 2 1 4 7 6 5 0 (bits 0 and 4 stay put)Ordinary data reads pass through untouched. The permutation is its own inverse, so the same wiring works in both directions — which is exactly why a bootlegger can replace a custom LSI with a handful of TTL.
This board has no riser. The bootlegger redrew the PCB with the decryptor designed in: the
silkscreen itself reads PAL16L8, an AMPAL16L8NC sits in it, with LS08 directly
above and LS245 above that, all a few millimetres from the Z80. That trio — PAL16L8 +
74LS245 + 74LS08 — is the architecture MAME documents for commandob2, and it is
the variant whose PAL was dumped, so the equations below describe this board directly rather
than by analogy.
commandob3). Bootleggers mixed board runs and ROM sets freely, so rather than force it
into one label this page describes it as what it is: the clean board.
The PAL turns out to be a plain tri-state buffer — every output is its own input
(D1'=D1, D2'=D2…). It does not do the swap. The scramble is in the
'245's cross-wiring; the PAL just picks which buffer drives the CPU bus:
pin 19 (D1') OE = P8*P9*P11 out = P1 pin 15 (D5') OE = P8*P9*P11 out = P5 pin 18 (D2') OE = P8*P9*P11 out = P2 pin 14 (D6') OE = P8*P9*P11 out = P6 pin 17 (D3') OE = P8*P9*P11 out = P3 pin 13 (D7') OE = P8*P9*P11 out = P7 pin 12 (/OE of the '245) = /( P4*P9*/P11 + P4*/P8*P9 ) pin 16 (not connected) = /( P4*/P8*P9*/P11 )
| Cycle | P8 (/M1) | P11 (/WR) | Who drives | Result |
|---|---|---|---|---|
| Normal data read | high | high | PAL enabled | unchanged |
| Opcode fetch | low | high | '245 enabled | groups swapped |
| Write | high | low | '245, DIR = /WR | CPU data out to memory |
Note the economy against the dirty board: because the '245 is bidirectional, one chip covers both the swapped read path and the write direction. The dirty board's '367 only goes one way, so it needs a '244 alongside. Same PAL, same trick, one chip fewer.
Two D27128s are piggybacked in the ROM socket with a wire running from the LS08 to a
lifted pin. That looks like a decryption trick — and it is a real one — but not here.
The two devices hold the two address halves of the same program, byte for byte:
lower (bottom) ROM == cm04.9m[0x0000:0x4000] 0 bytes differ CRC DF8F4E9A upper (top) ROM == cm04.9m[0x4000:0x8000] 0 bytes differ CRC ACA99905
They are an ordinary 27256 substitute, the wire carrying the A14-derived select that picks
between them. Their contents are the plain encrypted program — descrambling is the PAL's
job. The dirty board makes the point by contrast: it has a genuine AM27256DC in that
socket and no stack at all.
Byte 0 of the bottom ROM reads 3E raw (3E 04 32 00 E0… =
LD A,4 / LD (E000),A at the reset vector), so this board's decryptor passes the first
opcode fetch through untouched, exactly as Capcom's chip did. Spare images for both halves live in
MAME/Extracted/.
photographed The on-board PAL16L8 (silkscreened), the LS245/LS08 above
it, and the piggybacked ROM pair with its select wire.
measured PAL equations from the dumped set-2 device (CRC BDBCAF02),
the same architecture as this board; the 9M stack proven an address split by byte comparison against
cm04.9m.
deduced The '245 B-side cross-wiring — undocumented, but forced by
the logic: the PAL path is straight and bits 0/4 bypass, so the swap can only live there. Likewise
the exact '08/'14 gate inputs, which MAME records only as feeding PAL pins 4, 8 and 9.
Web/gen_variants.py