Routine to bypass a firmware

I rummaged in a few other firmwares and obtained results.

Here are five routines (including three new) to bypass firmwares that no require to patch the firmware.

Panasonic FS-A1:

This firmware is bypassed when the 0CBD8h byte is equal to 023h.

; Routine to byppass the Panasonic FS-A1 firmware

	org	4000h

RomHeader:
	dw	4241h,4010h,0,0,0,0,0,0

	ld	a,023h
	ld	(0CBD8h),a	; To bypass the FS-A1 firmare
	ret
	
	ds	8000h - $,0	; Fill with 0 to make a 16K ROM

Panasonic FS-A1F:

This firmware is bypassed when the 0C3CEh byte is equal to 023h.

; Routine to byppass the Panasonic FS-A1F firmware

	org	4000h

RomHeader:
	dw	4241h,4010h,0,0,0,0,0,0

	ld	a,023h
	ld	(0C3CEh),a	; To bypass the FS-A1 firmare
	ret
	
	ds	8000h - $,0	; Fill with 0 to make a 16K ROM

Panasonic FS-A1mk2:

This firmware is bypassed when the 0C3D2h byte is equal to 023h.

; Routine to byppass the Panasonic FS-A1mk2 firmware

	org	4000h

RomHeader:
	dw	4241h,4010h,0,0,0,0,0,0

	ld	a,023h
	ld	(0C3D2h),a	; To bypass the FS-A1 firmare
	ret
	
	ds	8000h - $,0	; Fill with 0 to make a 16K ROM

Sony HB-201/HB-201P:

This firmware is bypassed when the 402Eh byte of the slot 3 is equal to 0c9h.

; Routine to byppass the HB-201/HB-201P firmware

RDSLT	equ	0000Ch		; Read a byte in a slot
WRSLT	equ	00014h		; Write a byte in a slot

	org	4000h

RomHeader:
	dw	4241h,4010h,0,0,0,0,0,0

	ld	a,3		; Slot 3
	ld	hl,4027h	; Address
	call	RDSLT
	cp	048h		; Test 'H'
	jr	nz,JUMP		; Jump if read value is not 'H'
	ld	a,3
	inc	hl		; 4028h
	call	RDSLT
	cp	049h		; Test 'I'
	jr	nz,JUMP		; Jump if read value is not 'I'
	ld	a,3		; Primary slot 3
	ld	e,0c9h		; RET opcode
	ld	hl,402Eh
	call	WRSLT		; Write C9h to bypass the firmware 
JUMP:
	ret
	
	ds	8000h - $,0	; Fill with 0 to make a 16K ROM

Sony HB-F1, HB-F1II and HB-F9P/S:

Theses firmwares are bypassed when the Hook H.STKE (0FEDAh) is used.

; Routine to Bypass the HB-F1, HB-F1II and HB-F9P/S Firmware


H_STKE	equ	0FEDAh

	org	4000h

RomHeader:
	dw	4241h,4010h,0,0,0,0,0,0

	bit	7,h
	ret	nz		; Back if Rom mirror

	ld	hl,H_STKE
	ld	de,0c100h
	ld	bc,5
	ldir			; Copy the current Hook in case another ROM uses it
	
	ld	hl,NewHook
	ld	de,H_STKE
	ld	bc,5
	ldir			; Set the new hook

	ld	hl,Adding
	ld	de,0c100h-5
	ld	bc,5
	ldir			; Adding to disable the H_STKE hook

	ret

NewHook:
	call	0c100h-5
	ret
	ret

Adding:
	ld	a,0c9h
	ld	(H_STKE),a	; Disable the H_STKE hook
	
	ds	8000h - $,0	; Fill with 0 to make a 16K ROM

These programs make each a 16k ROM. So you can easily try them on emulator. Only the routine for Sony HB-201/201P has a (simple) firmware detection routine. If you want to integrate all the routines to bypass the firmware in the ROM of an interface for example, you will probably need to add a firmware detection routine to run only the bypass routine correspodning to the used MSX.

The routines I give should prevent the execution of the firmware by inserting the cartridge in one of the cartridge slots of these MSXs.

Here's another one.

Sony HB-F5:

This firmwares is bypassed when the Hook H.STKE (0FEDAh) is created another program. So this routine disable the hook when it is used to run the firmware.

; Routine to Bypass the HB-F5 Firmware


H_STKE	equ	0FEDAh

	org	4000h

RomHeader:
	dw	4241h,4010h,0,0,0,0,0,0

	bit	7,h
	ret	nz		; Back if Rom mirror

	ld	hl,FirmwareHook
	ld	de,0c100h
	ld	bc,5
	ldir			; Copy the hook modified by the firmware 

	ld	a,(H_STKE+1)
	ld	(0c101h),a	; Change the slot number

	ld	hl,H_STKE
	ld	de,0c100h
Loop:
	ld	a,(de)
	cp	(hl)
	ret	nz		; Back if the Hook has been changed by the firmware
	cp	0c9h
	inc	hl
	inc	de
	jr	nz,Loop
	ld	(H_STKE),a	; Disable the Hook if it is that of the firmware
	ret

FirmwareHook:
	db	0f7h,03h,51h,40h,0c9h
	
	ds	8000h - $,0	; Fill with 0 to make a 16K ROM

The firmware not always start before the cartridges. It depends on the firmware.
In most firmware there is a key to prevent the firmware from running.
Panasonic has also provided a software solution. I found it by disassembling the beginning.
Sony uses the H.STKE hook to run the firmware after scanning roms. So, just change this hook to prevent the execution. (It must be done taking into account that other cartridges can also use this hook.)

Firmware that does not use these methods cannot be bypassed by software. This is the case of the Panasonic FS-A1FM and the Hitachi MB-H1/H2 for example. These should be patched or removed if they cause problems.

Mars2000, you got the wrong thread!

The firmware is only started before the cartridge if it is in a lower slot. In most MSX’s the firmware is therefore in slot 3.