Quote:

---

After many nights of soldering, we ended up with a setup that looks like this:

http://s32.postimg.org/6r8t70fcl/IMG_20160513_162756.jpg

We could now log in real time what was happening on the bus and what the FPGA did to the SRAM. Next step was writing some MC68EC020 code to query the protection on the CLARN (protection) board. Many many program/erase EPROM cycles later we had gaining enough of knowledge about the algorithm that we could start to do some cryptanalysis. This was finished last night and we can now consider the protection on Moto Frenzy fully solved and understood. It is several Linear Feedback Shift Registers mixed together in a odd way to work as a stream cipher.I have been in contact with Aaron Giles and sent him the implementation and hopefully we should see a commit real soon now.