I have lately been creating unprotected sets for the capcom CPS1 system protected by suicide battery. You remember Parasol stars on amiga with its 17 or 18 checksums ?
A game like Slam masters use 67 checksums which are XORing the tile layer bit enable/disable, with indirect use in registers....
It looks like a sort of hardware copylock, with hardware chip CPS-B adress modifications.
I have done also Three Wonders Euro phoenix set and also the japanese release, wonder 3 Jap. This one alone needs 350 modifications in the code.
btw, the tile layer enable disable is very simple and very complex, and is based on a word : for instance, a single Move #$12C0, D0 and move D0, $800160 (this value can change from game to game protected by the battery), displays no layers.
the activation is done by using bits : a game like slam masters use bit 2 (0x0004) for layer 0, bit 3 (0x0008) for layer 1 and bit 4 (0x0010) for layer 2.
to display layer 0 it's like 12C0+04=12C4 $12C4 is the word when pushed in the address register $80016a (control video register). for layer 1, $12C8 and layer 2 $12D0. You can there mix the values, like displaying layer 0 and 1 or 1 and 2 or 0,1,2 all together. $12DC display all the layers at the same time.
what i have discovered is that the CPS-1 games are games coded with a specialized tool to gain some development time, and made of clever and very clean ASM routines, all tight together by a C linker.
I have done Warriors of fate ETC latest revision, slam masters ETC, three wonders, king of dragons ETC (both releases, only the latest has still a missed checksum, i must clear that out), both JAP releases, The punisher ETC, Captain commando, etc etc.....
I'm actually fighting with quiz and dragons, which has also checksums to defeat
And also capcom world 2 jap.
Muscle Bomber Duo ETC and Varth Japan are in the pipe too