A tad bit confused...

I'm no expert on this by far, and this has most in likely been asked before, or pointed out. And most in likely it's been answered reasonably. But one thing I've noticed about Saturn and DC discs are that they both have the ring that has the SEGA logo and says produced under liscensed by SEGA Enterprised LTD. Of course the Saturn has it on the outer edge of the CD and the DC has it on the out edge of the GD data on the disc. And by all accounts we know that the copy protection on Saturn is in that outer ring. And I think it would be safe to assume that the GD-Rom's copy protection is in the ring also.

Now.. we've managed to be able to bypass the DC copy protection and we have self-bootable programs and games. But we have found no way to bypass the Saturn's copy protection without a mod chip. How is that so? There's probably a simple answer, but until I know this will continue to bug me.
Originally posted by Mr. Moustache@Jan. 25 2003, 1:00 am

Now.. we've managed to be able to bypass the DC copy protection and we have self-bootable programs and games.

Whatever actual copy protection (other than the GD-ROM format) the Dreamcast has hasn't really been bypassed, as the DC BIOS supports directly booting CDs with a specific layout. As to whether the Saturn has some similar functionality hidden within it, that's anyone's guess. You have access to the same tools and documentation as the rest of us, why not to find it yourself?

And yes, this has been discussed many times before.
hmm.. interesting, well, that answers my question and creates some more. I do have all the tools available to me, but I'm just starting to learn how to use them. But it gives me something to work towards.
the DC only boots games without mod cause of a bug in its loader for the MIL cd format (karaoke cds with a data track). Saturn has nothing like that and hence won't boot cdrs without mod.
Originally posted by Arakon@Jan. 25 2003, 12:05 pm

the DC only boots games without mod cause of a bug in its loader for the MIL cd format (karaoke cds with a data track).

Can you please explain this a little further, Arakon? I've heard of the MIL format and I know about the DC MIL boot method, but they aren't really Karaoke CDs. AFAIK, they (MILs) are simply Sega's way of adding a bonus format. People produce music CDs, and put a data track at the end that can only be read by the Dreamcast because of DC executables (the scrambled ones). I don't quite see how any bug in the loader fits into this, the format is laid out like that. MIL CDs play fine in audio CD players, the data track is simply ignored, unless you put it in a DC.

Had I only bought that Kita E. mil CD back in 1999.
My guess is that the CD reader interface on Dreamcast simply provides no reasonable way to tell the difference between GD and CD formats. The MIL-CD theory seems flawed because of the way Sega "fixed" the problem in newer Dreamcasts (by not booting from Audio/Data session layouts but continuing to boot from Data/Data).

That being said, Dreamcast is not Saturn, and the protection schemes for the two are not really comparable. A solution to one does not translate to the other. What I can recall about Saturn's protection scheme:

- The system BIOS does not have direct control of the process. It does not process the ring signature itself, and needs not - strictly speaking - even know that it exists. The system BIOS can control when the check happens, but the CD is unreadable without performing it. Thus, a BIOS patch/replacement/bypass cannot negate the protection (which is why you don't see AR clones offering this feature).

- The actual check seems to be performed by the CD reader's microcontroller (a Hitachi H8 in most models).

- The read protection disabled by a successful check seems to be controlled by components on the mainboard, most likely the CD block SH-1, but possibly the YGR-019.

- The patents on the protection suggest that the ring signature being checked is the 'TRADEMARK "SEGA"' Sega logo.

- The same patents suggest that the ring signature is encoded with EFM, the standard channel formatting for compact disc. This does not mean, however, that it is recorded as any type of standard sector.

- On Saturn discs the unused area between the end of disc indicated by the TOC and the ring is relevant to the process - it has some property that's crucial to the tracking/seeking process that differs from the unused area on a CD-R. This area may be filled with dummy data of some kind, perhaps Mode 0 sectors.

- The main obstacle to further investigation of the scheme is the need for a CD reader that can be suitably controlled - it needs to be able to both ignore the TOC and provide detailed information on what is being read; most CD readers are (not surprisingly) not up to the task.
doesn't clone cd or some variant over ride that and scan the entire disk for data? if it could skip the lack of data at the end of the readable data wouldn't it be able to extract the ring data?
The software can't tell the CD ROM to do things it can't. The security ring and the empty space before it are both refused by normal CD-ROMs, in hardware level.
Can a program like Blindwrite copy the protection ring? It claims to make 1:1 copies of a lot of copy-protected CDs....
No, Blindwrite makes copies of games with protection on subchannel data or other methods where protection is mixed between the data of the game. That is not the case of the Saturn ring.
Also, raw copiers such as CloneCD will only copy the part of the CD that is actually indicated as holding data by the TOC, so if the TOC says there's, say, 3 tracks with a total of 200MB raw data, then that's all CloneCD will read and copy. It would never even try to read the rest of the CD (the blank area).
CloneCD, Blindwrite, and any other "magic" CD software is still using the SCSI command set to talk to the drive, and is therefore limited by the drive's firmware. The main reason they can get around PC protections is that the developers of PC protections only have complete control of the mastering end of the process; there's a fairly weak limit as to what they can do without rendering the disc incompatible with a bunch of CD drives. Sega, Sony, Microsoft et. al. do not have this problem, because they control both the mastering and the CD reader and can engineer them to be compatible with each other without worrying about being compatible with anything else.
I only got one Saturn game, and no Saturn,

but after checking the CD, I think I've found something that might be part of the key to the protection used on these discs...

There's this ONE file that's on the disc that doesn't quite fit in...


1: It has no extension (like the rest of the files)

2: The file is named CDDA1 (like CD-DA as a Compact Disc Digital Audio, and 1 propably stands for track 1)

3: Following nr.2, this CD has 2 tracks, 1 data,' and one audio!

4: Usualy, when a CD refers to it's audio tracks, it's in the form of a file named "TrackXX.CDA" (X=0-9)

5: The snatch is ofcourse that the 1,16mb file doesn't have the correct size for a 8min audio track, but then again, the 8min audio track is exactly 8min and completely silent... So then again, it could sorta fit... (But then again, a .CDA file only symbolizes the track, and isn't the track, a .CDA file is usualy only a few bytes or something...)

6: I'd like to compare this weird audio track with the PSX standard audio tracks... A lot of psx games has a empty audio track at the end (usualy something like 2-5min long)

I think that this might be part of it all...

So in order to work, everything has to be perfect...

Also, as for the copyright ring on the outer ring of the cd... this gives the cd a max capacity of aproximatly... 600mb?

So... we're now down to... 68min's or something?

But, at the point of 60-65mins, there's this weird ring in the empty data section, this ring sorta looks like the rings found on a Laserlock protected cd...

This also seems to be part of this...

Darn, actualy, I don't know a thing about Saturn stuff...

But that's atleast my words (at the moment...)

Oh, almost forgot to mention a few other things too:

The game I got is "Robotica" (US/NTSC)

And also, I think I saw something about a program in a magazine a few months ago...

It was a program used for extracting data from "broken cd"...

(I'd guess it basicly just read the CD from inner ring to outer ring, and completely ignoring toc and everything...)

Hmm... Dunno if it real works that way... I guess you actualy need to make a special hardware that just reads from inner to outer to make working copies...
Originally posted by Arakon@Jan. 25 2003, 12:05 pm

the DC only boots games without mod cause of a bug in its loader for the MIL cd format (karaoke cds with a data track). Saturn has nothing like that and hence won't boot cdrs without mod.

Later DCs couldn't play MIL CDs, and yet pirates still have self-booting games for them. Something about the old MIL-CD trick being an audio/data CD, and the newer pirated stuff being data/data. But the same ideas are used in DC homebrew, which is cool. It sucks that what helped kill DC also allowed for it to develop such a big homebrew scene. If I had to choose, it would be anti-piracy over possible homebrew dev.
The reason PSX games have empty audio or data at the end is because the PSX lens assembly is a chunk of shit and has a very hard time reading where the disk ends if the game is under 30MB. This is why people started adding files like CDROM:/ZZZZZZZZ.ZZZ/Z.NULL that contains nothing but 30-300MB of 0x00's in it. If you've ever done any PSX homebrew work you'd see what i mean witht he PSX having serious problems with small data amounts.

Adding a blank audio track to the end is pretty much the same thing.
Originally posted by Carnivol@Feb. 01 2003, 6:42 pm

There's this ONE file that's on the disc that doesn't quite fit in...


Hate to disappoint you, but this CDDA1 has nothing to do with the copyright ring. It's simply a pointer from the ISO9660 filesystem (in track 1) to whatever audio track there is. Some games use this, some don't.

What surprises me a little, though, is that your audio track would be 8 minutes of silence. Did you actually play it in an audio CD player? Is your Robotica game an original or a backup? (I would ASSUME original...
hey DBOY, I'm into PSX devving as well but I never noticed anything of that kind... but then I run everything using caetla. The only thing that REALLY pisses me off is the absence of VRAM in the CPU address space, now there's a real mistake by sony imho.