Static analysis¶

The Samurai Shodown 2 cartridge, disassembled to recover the link logic a capture can only watch from outside. Full notebook: appendix.

Target¶

Field	Value
ROM	Samurai Shodown 2 (World), 2 MiB, `SAMURAI2v000`
CPU	TLCS-900/H (TMP95C061)
Entry	`0x200046`
Catalog	`0x0030` (identity word)

Samurai Shodown 2 cartridge — The cart under test — **NEOP0030**. That `0030` is the catalog word in the handshake (`FC 01 00 30`): photo and disassembly agree.

Disassembler¶

MAME's dasm900 (BSD) in a standalone frontend (tools/tlcs900d.cpp), emitting the SIO register names (SC0BUF/SC0CR/SC0MOD/BR0CR at 0x50–0x53).

Warning

Prefix-dependent operands + code/data interleaving make a naive linear sweep unreliable. Use reachability from entry. Outputs: out/reachable.asm, out/link-*.asm.

Recovered¶

Piece	Location
BIOS COM ABI	`0x2304cd` wrapper, `0xFFFE00` table, services `10`–`1a`
9-state dispatcher	`0x206cd0`, driven by `0x564e`
Identity validation	`FC`/`FD 01 <catalog>`
Transport + rings + `F9` ack	control `F0`–`F7`, rings `0x566d`/`0x56ad`
`F8` gameplay	slots `0x570d`/`0x5715`, `& 0x7f` mask
Teardown	`F8 FE FE`, standalone `FE`, `FF`, timeouts

Got backwards (only execution caught it)¶

bit 7,(0x564d) ; jrl Z,0x207447    ; bit7 clear → gameplay

Bit 7 set = transport, clear = gameplay — opposite of the intuitive read.

Whole-ROM audit¶

make audit-comms: all 32 COMCREATEDATA literals are in the link routines; byte set 00 01 F8 F9 FC FD FE. Confirms FA is receive-only and no hidden byte producer exists.