http://www.gamekult.com/blog/jimmy1...4dd-f-zero-x-usa-boot-avec-expansion-kit.html
http://www.gamekult.com/blog/jimmy130/202338/zonage-usa-du-64dd-code-assembleur.html
Rough English translation from French
(really awesome blog, researchs on Beta versions of Zelda 64 and the various dumps including the undumped iQue version -and an iQue Chinese version of Majora Mask was planned but cancelled-, what resolutions did the GC use to render at internally, etc)
Nintendo planned two regions for the 64DD: Japan and US. The regional lock works by reading the value in an address (0x9FF00) in the IPLRom (the 3D animation with Mario's head that loads when the 64DD is booted without a disk). Japanese combo games (a term he uses to refer to Zelda OOT, F-Zero X, and Mario Party 1) expect that value to be 0xC3, US ones expect it to be 0x04. Otherwise it jumps to an infinite loop and the game enters a soft-lock.
The region lock makes it so that US combo games can't boot with a JP 64DD drive, and also JP combo games wouldn't boot either on the unreleased US 64DD drive.
To make F-Zero X US work with 64DD, he tried to kill the infinite loop (that triggers once the region check fails), then he found out there are TWO region tests in the ROM, one for the JP version and one for US one. He repointed to the JP test and the game... worked.
F-Zero X USA, ROM address 0x83ED0
replace : 1000 FFFF with 1000 FF5E
Began by inserting a wrong/corrupt disk in the 64DD
> Error message "bad disk"
Inserted the Expansion Kit disk
The missing menu graphics, and the game crashing when attempting to begin a race or load the track editor, are due to the Expansion Kit trying to load the data from the addresses used in the JP F-Zero X.
Zelda OOT 1.0 USA, rom uncompressed 64Mo
adresse rom : 0xB96B0A
replace : 1000FFFF by 1000FDBF
Mario Party USA
adresse rom : 0x82A98
replace : 1000FFFF with 1000 FF73
What about PAL games?
Trying to do the same process in F-Zero X PAL:
Doesn't boot with the 64DD and Ram Pack.
Doing the region lock bypass method as above: no error messages, no disk reading. Has the US region coding: hinting at it being a modified version based on the US rom.
Mario Party is a special case.
The PAL version was directly translated from the JP one and no 64DD options were stripped out, meaning it behaves exactly like the Japanese copy, being compatible with the Japanese 64DD, reading the disk, displaying error messages (in English, French and German). Internally, it has a Japanese 64DD regional code.
Ocarina of Time PAL though: Doesn't recognize the 64DD at all. All of its functionality was removed from PAL versions.
The technical details about the 64DD region locking, and the functionnality being removed from Zelda OoT PAL (Ura Zelda, unreleased) and F-Zero X PAL (Expansion Kit, released in Japan) leads the author to the conclusion that Nintendo NEVER intended to sell the 64DD in Europe.
He also shared stuff from Zoinkity (of Animal Crossing N64 and Wonder Project J2's English projects fame):
Pocket Monsters Stadium (64DD support=
One really neat one is in a 1-time only test to see if a retail 64DD is attached. It does a couple error tests for drive status and the like, and then does an anti-piracy check! If you don't have a retail IPL it will likely fail.
It reads 0x9FF00 from the IPL, which in the retail will read C3DBFE61. Of that, it tests if the upper byte is 0xC3. If so, it then 'detects' the 64DD and will, from that point onward, look for it, read its status, etc. Otherwise, it acts like it isn't there.
Via GS codes you can force it to believe the 64DD passed that test. This sort of thing works with Nemu, but others might die when doing the register access and others might not allow codes to change ASM.
8104CB64 1000 passes first error test
8104CC50 5000 passes second error test
8104CCAA 0000 device detected
8104CCEA 0000 kill inf. loop when 9FF00 from IPL isn't C3------
8104CCFC 0321 mult against 0xC3, not invalid value; result should be DFB807A9; 5FAF995D at 80086E00
Zoinkity
/end quote