I've modified halrin's svcboot cx code a little, it's now low-ram (only 0x800 bytes [2kb] of ram is needed for decryption),
and the code is very short. Also, it will work for cthd2003, matrimbl, and svcboot
DoPerm(0); // cthd2003, matrimbl
DoPerm(1); // svcboot
void DoPerm(int g) // 0 - cthd2003, 1 - svcboot
{
unsigned int idx[2][ 0x10 ] = {
{0,1,2,3,3,4,4,5,0,1,2,3,3,4,4,5}, // cthd2003
{0,1,0,1,2,3,2,3,3,4,3,4,4,5,4,5}, // svcboot
};
unsigned int tbl[ 6 ][ 4 ] = {
{ 3, 0, 1, 2 },
{ 2, 3, 0, 1 },
{ 1, 2, 3, 0 },
{ 0, 1, 2, 3 },
{ 3, 2, 1, 0 },
{ 3, 0, 2, 1 },
};
unsigned char dst[0x800];
for(int i = 0; i < 0x8000; i++)
{
for(int j = 0; j < 16; j++)
{
unsigned int *b = tbl[ idx[g][(i>>(5-g))&0xF] ];
int ofst = BITSWAP08(j, 7, 6, 5, 4, b[3], b[2], b[1], b[0] );
memcpy( dst + j * 0x80, NeoSpriteROM + (i * 0x800) + ofst * 0x80, 0x80 );
}
memcpy (NeoSpriteROM + i * 0x800, dst, 0x800);
}
}