Thanks very much
@MetalliC - read up on those two topics, and they explained everything I was missing!
For others if they are interested the issues were:
- I was reading the addresses the wrong way around, due to the endianness. When I was quoting 0x00000040 I really meant 0x40000000 and ditto for 0x00003000 I really meant 0x00300000.
- This made it easy to see that it's only the first 0x300000 of the first IC that is actually decrypted, and not the first 0x800000 as I thought. The fact there is an unencrypted header at this point should have been a good hint lol (this unencrypted section is clearly the test mode, that for some reason in this game sits unencrypted unlike the other m4 games I looked at which encrypt test mode as well).
- The 40 I was seeing was actually a flag (explained in the naomi source code linked by MetalliC) to tell the naomi to decrypt that section. Seeing as I decrypted the first sets of bytes myself using a brute forcer, this needs to be turned off so that the naomi loads it as plain text.
Now very happy with a working netbootable version of Manic Panic Ghosts!
Next task is to try and get hold of a real serial IO board for the game so that I can find out the protocol and try to HLE it so I can play the game!