NP, as promised (a long time ago), here's a fix for kof10th
It was difficult to figure this out because the program code for it
is protected (xored) and swapped in dynamically (in the 0xe0000 range),
and it isn't a usual type of write that bootleg authors do, it sets an
address range, then moves a byte into an offset in the address range (simply).
After I realized that the code for this was in this range (thanks to Raz!),
I looked at where it was coming from (thanks again to Raz!). I then took
a nop (4e71) and xored it by the correct values (again, Raz!) to make it
work correctly as the game was ran.
/*
000e0022 6100 0042 BSR B_66
000e0026 47f9 0010 fd00 LEA A_0010fd00,A3
000e002C 177c 0080 0082 MOVE.B #0x0080,(D_0082,A3)
000e0032 0c2b 0080 0082 CMP.B #0x80,(D_0082,A3)
000e0038 66f2 BNE B_2c
*/
*((unsigned short*)(Neo68KROM + 0x053162c)) = 0x7425; // MOVE.B (xored NOP)
//*((unsigned short*)(Neo68KROM + 0x0531632)) = 0x98AA; // CMP.B (xored NOP)
//*((unsigned short*)(Neo68KROM + 0x0531638)) = 0x4E09; // BNE (xored NOP)
/*
000e003A 177c 0001 0083 MOVE.B #0x0001,(D_0083,A3)
000e0040 0c2b 0001 0083 CMP.B #0x1,(D_0083,A3)
000e0046 66f2 BNE B_3a
*/
*((unsigned short*)(Neo68KROM + 0x053163A)) = 0x8084; // MOVE.B (xored NOP)
//*((unsigned short*)(Neo68KROM + 0x0531640)) = 0xBE38; // CMP.B (xored NOP)
//*((unsigned short*)(Neo68KROM + 0x0531646)) = 0x7925; // BNE (xored NOP)
/*
// Do these need to be patched as well??
000e0048 177c 0000 008c MOVE.B #0x0000,(D_008c,A3)
000e004E 0c2b 0000 008c CMP.B #0x0,(D_008c,A3)
000e0054 66f2 BNE B_48
000e0056 177c 0003 008f MOVE.B #0x0003,(D_008f,A3)
000e005C 0c2b 0003 008f CMP.B #0x3,(D_008f,A3)
000e0062 66f2 BNE B_56
000e0064 4e75 RTS
*/
The only lines of code you really need are these two.
The rest above are just for informational purposes.
Also, these patches DO NOT make the game fail the UNIBIOS crc check.
// FBA
*((unsigned short*)(Neo68KROM + 0x053162C)) = 0x7425; // Fix System
*((unsigned short*)(Neo68KROM + 0x053163A)) = 0x8084; // Fix Region
// MAME
((UINT16*)src)[0x053162C/2] = 0x7425; // Fix System
((UINT16*)src)[0x053163A/2] = 0x8084; // Fix Region