KSkunk and I did that. You need to replace the encrypted boot with your own code. You also need to take into account the different ways that the Jaguar console and the JagCD boot.
I have two things that will help your investigation:
1) There's a "discussion" (more my rambling) over at JS2 in this thread:
http://www.jaguarsec...showtopic=11703 (not sure if you need an active account). Included in that thread is a tool (with source) that will patch a ROM file with my own encrypted boot which is similar to the one on Skunkboard, boots in a bit under 1s, and (the last version) works with both JagCD and Jaguar console.
2) I have my commented disassembly of the GPU boot code, including the encrypted block and comments on the JagCD mechanism here:
http://harmlesslion...._Boot_Diasm.htm
Do note that I disclaim that my commented disassembly is even remotely accurate. But it was a helpful reference for myself.
To put our new code into the cartridge encryption tool, we actually just used a hex editor and patched the binary, since it contains the code raw.
Be careful to test any new boot you make on both the console and the JagCD. They use a fairly different startup and you need to account for both. You'll understand if you read my notes above.
In case you can't see the JS2 thread, this is the code that my ROM patching tool uses (pre-encryption):
.gpu
.org $00F035AC
MOVEI #$00FFF000,R1 ; AND mask for address
MOVEI #$00000EEC,R2 ; Offset to chip control register
MOVEI #$03D0DEAD,R4 ; magic value for proceeding
MOVE PC,R0 ; get the PC to determine DSP or GPU
AND R1,R0 ; Mask out the relevant bits
STORE R4,(R0) ; write the code
SUB R2,R0 ; Get control register (G_CTRL or D_CTRL)
MOVEQ #0,R3 ; Clear R3 for code below
GAMEOVR:
JR GAMEOVR ; wait for it to take effect
STORE R3,(R0) ; stop the GPU/DSP
; Need an offset of $48 - this data is overwritten by the encrypt tool
; with the MD5 sum.
NOP
NOP
MOVEI #$0,R0
MOVEI #$0,R0
MOVEI #$0,R0
MOVEI #$0,R0
MOVEI #$0,R0
MOVEI #$0,R0
; JagCD entry point (same for now)
Main:
; There is a relocation at $4A that we can't touch
MOVEI #$0,R0 ; dummy value
; real boot starts here
MOVEI #$00FFF000,R1 ; AND mask for address
MOVEI #$0,R0 ; This movei is hacked by the encryption tool
MOVEI #$0,R0 ; This movei is hacked by the encryption tool
MOVEI #$00000EEC,R2 ; Offset to chip control register
MOVEI #$03D0DEAD,R4 ; magic value for proceeding
MOVE PC,R0 ; get the PC to determine DSP or GPU
AND R1,R0 ; Mask out the relevant bits
STORE R4,(R0) ; write the code
SUB R2,R0 ; Get control register (G_CTRL or D_CTRL)
MOVEQ #0,R3 ; Clear R3 for code below
GAMEOVR2:
JR GAMEOVR2 ; wait for it to take effect
STORE R3,(R0) ; stop the GPU/DSP
END