===== Panasonic FZ-1 (md5: f47264dd47fe30f73ab3c010015c155b) =====

^Function Address^Description|
|0x0301_4F49|The [[documentation:encryption:opera:encryption_keys|application key N value]]|
|0x0301_4F8D|The [[documentation:encryption:opera:encryption_keys|3DO key N value]]|

===== Panasonic FZ-10 (md5: 51f2f43ae2f3508a14d9f56597e2d3ce) =====

^Function Address^Description|
|0x0300_0028|The very first thing done at startup is read from ''0x0318_0000'' 4 times. Each read it ''ANDs'' with ''0x1'' then ''ADDs'' it to the previous read (having been initialized with ''0x0''). It then compares that to ''0xA''. Meaning it's looking for a sequence of values with ''1, 0, 1, 0''. 3DOEssence suspects that address is a diagnostic port and that pattern triggers a test routine.|
|0x0300_02C4|Writes 0x2A to MADAM memory config register 0x0330_0004. \\  \\ Writes 0x0017_8906 to MADAM address 0x0330_000C. Not clear what that value means or what that location represents. The location appears only to ever be written to and function 0x0302_17a8 also writes the same value. \\  \\ It then iterates over a list of tuples of config register values and total RAM values. Uses function 0x0300_039C to check size values against the actual RAM. \\  \\ ''03000370 1A 10 DCB 0x1A, 0x10 '' \\ ''03000372 19 10 DCB 0x19, 0x10 '' \\ ''03000374 52 0A DCB 0x52, 0x0A '' \\ ''03000376 51 09 DCB 0x51, 0x09 '' \\ ''03000378 4A 07 DCB 0x4A, 0x07 '' \\ ''0300037A 32 07 DCB 0x32, 0x07 '' \\ ''0300037C 49 06 DCB 0x49, 0x06 '' \\ ''0300037E 31 06 DCB 0x31, 0x06 '' \\ ''03000380 42 06 DCB 0x42, 0x06 '' \\ ''03000382 12 06 DCB 0x12, 0x06 '' \\ ''03000384 41 05 DCB 0x41, 0x05 '' \\ ''03000386 11 05 DCB 0x11, 0x05 '' \\ ''03000388 2A 04 DCB 0x2A, 0x04 '' \\ ''0300038A 22 03 DCB 0x22, 0x03 '' \\ ''0300038C 0A 03 DCB 0x0A, 0x03 '' \\ ''0300038E 29 03 DCB 0x29, 0x03 '' \\ ''03000390 21 02 DCB 0x21, 0x02 '' \\ ''03000392 09 02 DCB 0x09, 0x02 '' \\ ''03000394 02 02 DCB 0x02, 0x02 '' \\ ''03000396 01 01 DCB 0x01, 0x01 '' \\ ''03000398 00 00 DCB 0x00, 0x00'' |
|0x0300_039C|Appears to be for confirming the size of the DRAM. Every 0x0010_0000 bytes it writes the address and the inverse address to address + 1. It then loops again looking for those values in the addresses. If any check fails it returns 0. Otherwise will return 1 if it gets past the range provided.|
|0x0300_0518|DRAM / VRAM calculation function based on the value of MADAM register at 0x0330_0004. \\  \\ Bank 1 is represented by bits 4 and 3 where 00 = 0MB; 01 = 1MB; 10 = 4MB; 11 = 16MB. \\ Bank 2 is represented by bits 6 and 5 where 00 = 0MB; 01 = 1MB; 10 = 4MB; 11 = 4MB. \\ Bits 2, 1, and 0 are used to subtract from the total DRAM if bank 1 = 16MB. \\  \\ Total DRAM is Bank 1 + Bank 2 if Bank 1 != 16MB. If Bank 1 == 16MB then total DRAM is Bank 1 - Bits210 in MB. \\  \\ More details can be found on the [[documentation:hardware:opera:memory_configurations|3DO Memory Configuration page]].|
|0x0300_1240|Waits for CLIO VCNT (0x0340_0034) to be greater than 10 and less than 13.|
|0x0300_1268|Waits for CLIO VCNT (0x0340_0034) to equal 4.|
|0x0302_438C|ROM select. \\ CLIO address 0x0340_0084|
|0x0302_43B4|Not sure what's going on here. It's use the PBUS DMA to seemingly transfer from two ROM addresses. But the ROM should be readonly.|

===== Panasonic FZ-10E ANVIL (md5: a48e6746bd7edec0f40cff078f0bb19f) =====

^Address^Description|
|0x0300_003c|''adr pc,0x6000044'' \\  \\ It appears that ANVIL systems might mirror the original ROM location of 0x0300_0000 at 0x0600_0000. The only reference to the latter's range is at the very beginning of the ROM which unconditionally jumps to 0x0600_00044. \\  \\ Besides keeping this ROM from running on non-ANVIL hardware it is unclear why it would do this.|

===== Shootout At Old Tucson (md5: 8970fc987ab89a7f64da9f8a8c4333ff) =====

^Address^Description|
|0x0300_0628|Checks MADAM version. Yet to investigate what the return value represents.|
|0x0300_1a20|???|
|0x0301_4d30|"Copyright 1993 The 3DO Company\nAll Rights Reserved."|
|0x0301_4e49|CDROM bootcode decryption key? \\  \\ c0764797b8bec8972a0ed8c90a8c334dd049add0222c09d20be0a79e338910bcae422060906ae0221de3f3fc747ccf98aecc85d6edc52d93d5b7396776160525|
|0x0301_4e8d|ccddb7d60984a4a7ff6841eaf1b4df8edd26bd315ca72681058de12f477a5a5b84d4f2e32dd48bdb8b4a04176c8f96d5b194c270a30593a9ea4032d0038cae2d|
|0x0301_4ed1|key1 \\  \\ ad287d637758301f0f8870d580d8ea8e9f341def627eb2667773c8232065f915102f92dbaddd0a606cf01e0d04a49da029ac06918800edff08c187d2b2e8ebb9|
|0x0301_4f15|3DO key \\  \\ b19462b00d8d6e1ec909ab385e06fe034bfd282e9ffdc584838c15f12593dd1e3a8b5626f1b9d0ed0c384ef6c5d14512bd72ddb85b44080e0472c03d0afc4c97|
|0x0301_4f59|key2 \\  \\ b87c524a7d0a0739b48dc4713ff3dcbf6cc0015dd4f35859fab3bde4c6594de675c161d7c32df25f426f8adc60f07853eaac8f59be969b9eb69b51b80764590b|
|0x0301_5088|"\nThis WHOLLY ODD collection of code brought to you by:\n\nDale \"You mean my house burned down last month and I never noticed?\" Luck\n-=RJ=- \"Hey, I never approved those messages!\" Mical\nJoe \"You were asleep at the time\" Pillow\nDave \"Strictly corect\" Platt\nBryce \"Angel of death\" \"Nesbitl\" Nesbitt\nStephen \"Not Stephan\" Landrum\nAndy \"I miss my Cats\" Finkel\nChris \"Whaddya mean you took it out?\" McFall\nDrew \"Don't touch my toys\" Shell\nMr. Pockets\nNerf™ brand weapons\nPhil \"I can't hear you\" Burk\nStan \"I thought you were done\" Shepard\nSteve \"That !@%$#& drive\" Hayes\nBill Long\nBarry Solomon\n\nAnd all those who were not in the building at 2am when the cops\nshowed up…\n"|