Trademark Security System
The Trademark Security System, or TMSS, was a feature Sega added in later revisions of the Mega Drive 1 and all Mega Drive 2 and 3 models that is an attempt at locking out unlicensed games. Even though TMSS wasn't added until late 1992/early 1993, the necessary code and requirements were in Sega's programmer documentation as far back as 1989. Some extremely early games neglected to complete all steps required by the TMSS, and were thus unable to run on newer board revisions.
TMSS works by simply requiring instances of the SEGA trademark to appear in various memory locations (see below). Should an unlicensed game appear on the market, Sega could exert its rights over the SEGA trademark and sue the developer for trademark infringement.
The legality of this system was challenged in the United States by Accolade in the court case SEGA vs. Accolade, which ruled in Accolade's favor. The verdict set a precedent that copyrights do not extend to non-expressive content in software that is required by another system to be present in order for that system to run the software. While the system was never challenged elsewhere, Sega did not enforce it after the Accolade case, and consequently several unlicensed game developers started popping up.
In order for software to run on a Mega Drive/Genesis with a TMSS built in, the software must do two things:
- have either the longword whose bytes represent ASCII string "SEGA" in big endian at ROM address $100 OR the five bytes " SEGA" at the same address — this is checked by the TMSS ROM and is the source of the "Produced By or Under License From Sega Enterprises Ltd." message.
- write a long word containing "SEGA" (all caps) to address $A14000 a short time after the Motorola 68000 resets. If the game fails to do this, the next VDP data port access will cause the 68000 to lock up — this is done by the I/O controller.
- The sample code in the official programmer documentation has this part skipped on boards that report themselves as revision 0; the effect of doing this write on a revision 0 board is undefined, although it does not seem to cause any harm.
The TMSS ROM uses various registers to control if the cartridge ROM is mapped on the bus versus the TMSS ROM. When bit 0 of $A14101 is set, the cartridge will be on the bus, while if it's cleared the TMSS will be on the bus. The TMSS itself is contained in a small 4 KB ROM inside the Mega Drive's IO controller.
When the machine boots, the TMSS will load a segment of code to main RAM, and then jump to it after switching the cartridge on the bus. This code performs the "SEGA" header check as described above, and if it is correct, it will continue to swap the TMSS ROM back on the bus, load art and palettes, and display the message. An idle loop is then ran until about 2.5 seconds elapse, after which case the cart is put back on the bus, the initial stack pointer is set from the vector table as well as the initial PC.
|Download TMSS Disassembly
File: TMSS_Disassembly.zip (140 KB) (info)