This is a small update on the status of the breaking process.
I used the sygnal analyser without much luck, so before putting much of my time into something that I'm not sure if it will pay off, I contacted a colleague that has previous experience in the retro-engineering ICs and we'll try to decapp a couple of custom SH2 and find out how to reprogram them or at least narrow down the number of pins that are accessing the encryption module.
Regarding the support for SFIII-2nd I have tried to creat a new version of MAME that will just 'printf' each address (PC) that is being executed by the SH2 but I I can't get to have them all printed out.
For that reason and following Alex's propositionI'm asking for support of the experts around there to provide new C files that need to be changed in order to get printed all the addresses that are executed. An improved version should ideally generate a table that sets to one te value of an address if it was exectued, so we avoid getting laaaarge output files. This is not critical, as a little script in Notepad++ could do the job.
When we have a working C version, then I'll ask you to run it, send me the output files that you get, so I can integrate them all and put them in the latest version of the tool.
We'll (hopefully) set up an open code environment for this, so meanwhile please send your files via www.mediafire.com
Waiting for your feedback....