Hooked up ds1204, but haven't found what it checks for yet. Change PATCH_PROTECTION to 0 in tmaster.c and VERBOSE_LEVEL to 2 in ds1204.c then look for "-> command" in error.log to find the subsequent read from the dq pin for reading the identification and secure memory. For tm4k the first two bytes of the nvram need to be  0x00, 0xa0. From scratch you'll need to play a game before it will complain about the protection, but after that it will complain on every boot. It tries five different contents for the compare register at various points during the bootup, this may be for obfuscation as the real chip will return random results if the key is wrong. If the keys are available it might be easier to dump them than figure out exactly what it wants. [smf]