MetalliC
Champion
lol, it is because I've spent quite many time when RE'ing earlier Maxell's reader for VF4/Dino/Love&Berry, mostly in software way (no logs or card dumps), analyzing game code and set data in emulator, so I know this thing quite well.I tell you what! You're the key to unlocking every mystery I come across in these card reader emulator projects!
reader in ID4 looks like natural evolution of previous one - 8byte SN# and password, 8x 16bit counters instead of 4x 8bit, etc but in general it is same thing, which works using same basic principle and commands.
so the key is - research for understanding how things works, but not just blindly supply games with some void/unk data bytes to make them happy

in short, if you have command like 6D byte0 byte1 - write bytes in reversed order (byte1 byte0), then convert to binary form, position of pair of set bits will be "offset", ieI'm curious though how you read the CMD variable and get the address from it? Like how does C0 translate to x30-x31, 30 translates to x32-x33, etc?
6D 00 C0 -> C0 00 -> 11000000 00000000 = counter # 0 (ie offset 30h)
6D 00 03 -> 03 00 -> 00000011 00000000 = counter # 3 (ie offset 36h)
6D 03 00 -> 00 03 -> 00000000 00000011 = counter # 7 (ie offset 3Eh)
Code:
0 1 2 3 4 5 6 7
xxxxxxxx xxxxxxxx