How does the NES PlayChoice arcade's security EPROM work?

Question

I've read that the PlayChoice 10's security system includes a 64-bit serial EPROM that gets compared against the first 64 bits of code, and that it's possible to swap the ROMs between compatible cartridges (that use the same mapper) to play different games. What's not clear is exactly which program code is compared with the security EPROM - does this work because different games happen to have the same first 64 bits, is it checking against the PlayChoice-only title/instructions ROM, or does this only work with an alternate PlayChoice BIOS?

Answer 1

The security is handled entirely by the Z80, the NES side of the machine has no awareness of anything outside of the normal behavior of an NES. In fact, all the games (except for Mike Tyson's Punch Out) are 100% identical to the NES cartridge versions, and frequently use the same maskROMs from the NES version. Because of this, you can exchange the ROMs for another game that uses the same mapper. The downside to this, is that in the game list and instructions screen, it will show up with the name/instructions of the original title. Note that the boards have extensive solder jumpers that can be used to allow it support various sizes of EPROMs and maskROMs.

There actually are 2 security chips on a Playchoice cartridge. There is the small serial ROM, and there is also another standard 27C64 EPROM that is used by the Z80. That ROM contains the game's name, instruction screen, and also the Z80 code that does the actual comparison to the serial ROM. If it doesn't match, then the game will not show up on the list.

So the Z80 boots into the Playchoice "BIOS" ROM, and when it selects a cartridge slot, the cartridge's Z80 ROM gets mapped into an area of the Z80's memory. The Z80 then executes code in that ROM to validate the cartridge.

This is known thanks to the work of Martin Korth (author of the NO$NES emulator), and he has also created a utility which will allow anyone to create a custom ROM with their own game name and instructions, and also does no checking of the serial ROM, so you no longer need that part on the board. I have designed my own Playchoice game boards and used his utility with it, it does work.