Contained files:

jp_mcd1_9112_region_free.txt            This text file
jp_mcd1_9112_region_free.bin		Suitable to be used with GENS or KEGA emulators.
jp_mcd1_9112_region_free_byteswap.bin	For writting on a eprom, to be used on the real hardware.



Patches:

 00000364:   6000 41B6    BRA.L     B_451c   BIOS vector jump to SEGA logo exibition routine 
>00000364:   6000 6BBA    BRA.L     B_6F20   Added patched SEGA Logo data and code extracted from a disc at 0x006F20


 00000722:   6702         BEQ       B_726
>00000722:   4E75         RTS                Skips result of the Mega Drive mainboard region check routine

00006F20-0000798F:  Patched SEGA Logo code



 00006F20:   21fc 0000 0280 fd02              MOVE      #0x00000280,A_fd02.W     here we repeat all the security program code

 00006F28:   4bf9 00a1 2001                   LEA       A_00a12001,A5            that the game has executed already, but this 

 00006F2E:   08d5 0001                        BSET      #1,(A5)                  time we're pointing the outine to data 

 00006F32:   67fa                             BEQ       B_6f2e                   contained on the MEGA-CD BIOS instead.

 00006F34:   33fa 013e 0002 0528              MOVE.W    (D_013e,PC),A_00020528

 00006F3C:   0895 0001                        BCLR      #1,(A5)

 00006F40:   66fa                             BNE       B_6f3c

 00006F42:   43fa 000a                        LEA       (D_000a,PC),A1

 00006F46:   4e71                             NOP                            This is where the original call for the 0364 

 00006F48:   4e71                             NOP                            routine is made on the original security program.

 00006F4A:   6000 012a                        BRA.L     B_7076

...Graphic and text data up to 7076...

 00007076:   4e71                             NOP                     Some NOPs because I'm paranoid and have lots of space 

 00007078:   4e71                             NOP                      to spare)

 0000707A:   4e71                             NOP

 0000707C:   4e71                             NOP

 0000707E:   4e71                             NOP

 00007080:   4ef9 0000 451c                   JMP       A_0000451c   Original routine that were pointed to on the 0364 jump 
                                                                     vector/bios call



0x0016000  JPN SUB-CPU MEGA-CD BIOS,  modification based on the one made on the PAL ROM by Russell OQuigley:



Original code: (IDA PRO)

00004236                 movem.l d0/a0-a1,-(sp)
0000423A                 lea     logo_data,a1                                This refers to the graphic for the small SEGA logo
0000423E                 move.w  #$A9,d0 ; 'c'                               and text string.
00004242
00004242 loc_4242:                               ; CODE XREF: ROM:00004244j  
00004242                 cmpm.w  (a0)+,(a1)+
00004244                 dbne    d0,loc_4242
00004248                 beq.s   loc_424E
0000424A                 move    #1,ccr
0000424E
0000424E loc_424E:                               ; CODE XREF: ROM:00004248j
0000424E                 movem.l (sp)+,d0/a0-a1
00004252                 rts



Bypass patch:

>00004236:   44FC 0000                        MOVE #0000,CCR          Here it fakes success on the compare without doing anything...
>0000423A:   4E75                             RTS                     And returns... 




