not sure if I've seen this kind of things in blog posts.
back in the days M2/M3 cracks/patches was documented in MAME and Supermodel emulators source code. when protection chips was emulated patches was removed too.
anyone interested who is not totally braindead was able to apply those patches...
I'm not sure, but I may suggest it wasn't yet dumped at the moment when some smart person (Elsemi?) did all these M2/3 cracks.
is it still not cracked? or it's cracked but not available for free? ;)
btw, is there a list of protected Model 2/3 games which is still not cracked at all?
very few...
99% of protected Model 2 or Model 3 games have no any encrypted game data, and DOA is not exception.
because Sega used protection chip in the most dumb stupid of all the possible ways - push to it a bit of encrypted data, read decrypted data and then compare with some hardcoded values or text...
you'll get this error if anything wrong in the chain: 315-6146 I/O MCU -> ADM485 IC80 -> CN2 connector -> filter board -> JVS connector -> cable -> JVS I/O board.
in 1st place worth try to replace JVS I/O and its cable, if it doesn't solve the problem worth to check if JVS connector at filter...
it smells like VDP1 has been died, or something wrong with its connection to SCU chip, so, all the 3 RAM chips connected through it doesn't pass RAM test. not sure which exactly chip it is on ST-V, it might be 315-5689 or 315-5883
you've been already told - firmware programmed inside of ASIC (NEC V850 CPU with flash), and there is no known ways to manually reprogram it.
for sure there should be the way to (re)program it, for case when new PCB was manufactured at factory and ASIC have no any firmware yet. but, it's...
@telmnstr media board firmware is inside of large Sega ASIC, there is no known to me way somehow manually reprogram it.
TSOP flash ROM iirc is segaboot. that's the code which shows you test mode screens, and it's fine if you see them.
I see, missed this one.
it looks like both codes works. there is no clear confirmation, simply hold the buttons until capcom logo.
I'm wondering why you cant check this by yourself running this game on Naomi or in some emulator...
TLDR: AR protocol differs from BR with one status byte, in BR it's binary value while in AR it's ASCII digit
iirc someone already did 1231AR simulator for some other game, but I can't remember which one it was