> It's not the Amiga internals, it's the part where the ROMs are encrypted. The > code/data is gibberish outside of the startup tests, and the ROMs were dumped > multiple times on multiple readers with matching results.
Yes, Kickstart does only check $f00000 for $1111 and if it finds that jumps to $f00002, so it's only the ROM code that matters. I did a quick check of the disassembly, but didn't find anything in initializing that say descrambles the encrypted code to ram and jumps into it or something like that. It must be something outside the ROMs which does the descrambling, which would also explain that the rom dumps are fine. Additionally, the internal rom crc check works with the encrypted rom at $300000, so maybe there's some address descrambling (+other descrambling) happening at $f00000, so the memory there isn't a direct copy of the encrypted roms like at $300000 but the unencrypted version. As I said in my other post it would be interesting if someone finds out what the left 4 chips on the rom board do.
|