Open Bus-Based Emulator Detection -- Draft

    di
    ld a, [rIE]
    push af

    ld a, $08 ; Enable Mode 0
    ld [rSTAT], a
    ld a, $02
    ld [rIE], a ; Enable STAT int

    ld c, LOW(rHDMA1)
    ld a, $E0
    ld [c], a
    inc c
    ld [c], a ; From $E0E0 (uh oh, Nintendo says not to do that)
    inc c
    ld a, $88
    ld [c], a
    inc c
    xor a
    ld [c], a ; To $8800 (really anything is fine)
    inc c ; Leave C pointing to HDMA length

    xor a ; We need IF = 0 when HALT is hit
    ld [rIF], a
    ; There's a 1-cycle flaw here, but I dunno how to do better...
    halt
    ; Alright, we're perfectly synced with the PPU, and in Mode 0. What could go wrong, Mr. Emulator ?

    ; Normally, this should copy only one tile, but apparently this copies an extra one if started during HBlank
    ; Thus, moar evulz edge-case behavior >:D
    ld a, $80
    ld [c], a
    ; Insert appropriate delay (TODO : figure it out exactly, yummy cycle counting)
    ld hl, $FF75 ; Only bits 4-6 are writable
    ld [hl], $30 ; Now, $FF75 = $30 | $8F = $BF
    inc [hl] ; Puts $C0 on the data bus, and $C0 | $8F = $CF in $FF75
    ; Assume HDMA triggers here

    ; Check what was copied
    ld hl, $8800
    ld de, EmuDetectionPattern
    ld c, 16 * 2
.compare
    ld a, [de]
    inc de
    cp [hl]
    jr nz, .fail
    inc hl
    dec c
    jr nz, .compare

    ld b, SUCCESS
    db $11
.fail
    ld b, FAILURE

    ; Restore state
    pop af
    ld [rIE], a
    xor a
    ld [rIF], a
    ei