"Crack the SEGA Saturn copy protection" contest

[Pinchy]

Originally posted by ExCyber@Thu, 2005-03-24 @ 07:51 PM

I tried this a couple years ago, more or less. I'm not sure exactly what you mean, but it did not lose tracking (= spin up way too fast) as it does with most games, it acts pretty sanely and the pickup kicks around on the outside for a while, presumably trying to read the signature. After a little while it eventually popped up with "Game disc unsuitable for this system"). This is from memory so details may be wrong...

[post=132081]Quoted post[/post]​

Interesting. You say it spent some time seeking out there but not too long? and you sure it came back and said unsuitable or just listed the tracks (calling it audio instead).

From what ive burned with the 0x59 data it seeks and returns immediately to center then seeks out again and returns again. all this happens in like less than 5 seconds. I havent tried doing the ox59 0xA8 in a sector yet. this is what the modchip produces and know im pretty sure i know why.

Ive observed from the actaul game ring that the sector would contain some 0xA8 and 0x59 data mixed. sort of like a dirty sector as compared to the the pure 0x59 sectors that you mostly see. im sure you have noticed the sega string imprinted in the ring and its comes from the 0xA8 and 0x59 data, thats how you can produce the image that is there from the 2 EFM patterns.

Like i said before, 0xA8 and 0x59 are in a sense 'opposite' efm patterns. im not going to pull the emf table out again... on second thought just to clarify::

10000000000100 $59 EFM

01001001001001 $A8 EFM

and you all know a 1 signifies a change in the pit surface. So one will produce little pit change and the other a lot making it very visible to the naked eye.

so they use these bytes in the sector to draw the image/text whatever.Im sure as a judge on this!

Since the data will be the same for all rings trying to do a byte by byte comparison would be too expensive for the console so they just look fir sine A8 and 59 data and this is what the modchip does by producing a sector with pure alternating a8 59 data. the saturn sees this and is happy.

The saturn im sure also checks to make sure the header data and MSF data jives.

just to clarify:

00 FF FF FF-FF FF FF FF-FF FF FF 00

is the sync header for all mode 0,1,2 data sector followed by 3 bytes MSF and 1 byte mode type (0,1,2) then followed by payload data.

bytes 12 through 2352 are then scrambled with a XOR key. It would do you all a world of good to read the ECMA130 docs since a lot of people seem to talk nonsense on CD technology, im certainly no expert but the stuff aint rocket science either.

Again, if we can burn a disc with this appropriate mode2 sector data at the end without that information in the toc then youll have your bootable CD.

What would be kewl is actaully be able to recreate the sega logo, which is certainly possible but with these high speed drives dont know how accurate they can maintain pit length to be any good😉

On a side note, calculating a position on a CD requires some moderatly heavy duty math from what I hear since its a spiral and you know the sector length will fixed length due to CLV but I digress.

Over

 

[ExCyber]

so they use these bytes in the sector to draw the image/text whatever.Im sure as a judge on this!

I've been about 95% sure of this ever since I read the patents, but people keep trying to tell me it's some kind of secondary optical/holographic sensor. Heh.

What would be kewl is actaully be able to recreate the sega logo, which is certainly possible

Also according to the patents, the whole point of the protection scheme is to make pirate/unauthorized manufacturers put a visible Sega logo on the disc so that they can be prosecuted under trademark dilution laws, so I guess Sega thought it was possible too...

 

[Pinchy]

Originally posted by ExCyber@Fri, 2005-03-25 @ 07:07 PM

I've been about 95% sure of this ever since I read the patents, but people keep trying to tell me it's some kind of secondary optical/holographic sensor. Heh.

Also according to the patents, the whole point of the protection scheme is to make pirate/unauthorized manufacturers put a visible Sega logo on the disc so that they can be prosecuted under trademark dilution laws, so I guess Sega thought it was possible too...

[post=132132]Quoted post[/post]​

Yea I did some looking around and its all true. This is exactly how that old yamaha burner T@2 works. Its really more of a software thing then a speciality of the burner. I think that drive might actaully provide some extra fine control of its scanning velocity than other drives but the real trick is the calculation of the sector data.

calculating the position on the spiral is one thing but the other is that audio bytes in one sector are not stored consecutively but are interleaved and can be as far away as IIRC 108 frames or as much as 2 sectors. They have some detailed discussions on cdfreaks forums about the layout of audio data. Anyways just thinking about how to make the algorithm will simply make yer head explode.

Im waiting of some cd burning experts to come forward about how to burn this disc. I want some verification as to what controls the TOC data when a disc is burned DAO method. Im pretty sure its controlled or can be controlled from software.

I took a look at some audio discs laying around and saw some had watermarks in the TOC area since toc doesnt contain audio data only subcode, looks like they draw some text same way as mentioned. interesting.

 

[Drenholm]

Damn, this is interesting!

Originally posted by mal@Fri, 2005-03-25 @ 12:29 AM

What makes you say that?

[post=132079]Quoted post[/post]​

Are there not two boot discs; one for Sega games and one for third-party games? Sorry if I jumped to conclusions there - I'd appreciate clarification. 🙂

 

[Runik]

Originally posted by Drenholm@Sat, 2005-03-26 @ 05:09 PM

Are there not two boot discs; one for Sega games and one for third-party games? Sorry if I jumped to conclusions there - I'd appreciate clarification. 🙂

[post=132151]Quoted post[/post]​

I think this only applies to boot discs, not to retail games 😉

 

[Drenholm]

Thanks for the reply, Runik, but if you're right, what would be the point of having two boot discs?

Do they insert code into the Saturn's memory which will subsequently check the publisher of the game on the CD-R and only boot it if it meets the necessary requirements? I'm confused! 🙁

On another note, I posted this thread at CDFreaks asking for any help. I don't think they quite 'got' what I meant... but what can ya do. 😉

 

[vbt]

Originally posted by Drenholm@Sun, 2005-03-27 @ 12:32 PM

Thanks for the reply, Runik, but if you're right, what would be the point of having two boot discs?

Do they insert code into the Saturn's memory which will subsequently check the publisher of the game on the CD-R and only boot it if it meets the necessary requirements?  I'm confused!  🙁

On another note, I posted this thread at CDFreaks asking for any help.  I don't think they quite 'got' what I meant... but what can ya do.  😉

[post=132185]Quoted post[/post]​

I will try the Truman's tool I own a plextor drive 🙂

EDIT : I get "invalid field in CDB"

It doesn't work with my ultraplex 40x scsi,it even doesn't read the data track

 

[Drenholm]

Sounds good! 🙂

Can I just say again that this is really interesting! 😀

Thanks again, Pinchy, for your detailed posts about the ring data.

 

[Drenholm]

That's unlucky, vbt. 🙁

A member at CDFreaks has quoted (in my topic) some of Pinchy and others' more important posts regarding the modchip data. I know, I should have done it myself..! *looks embarrassed* Hopefully the topic may generate some interest!

I'm sure everyone who is interested in this topic, but not technically minded, like myself, would say that we eagerly await any news on progress or technical information from Pinchy and anyone else who has it!

Thanks so much, guys, and best of luck. 🙂

 

[Quakester2000]

CDRWIN sounds like the best option to burn any type of discs that has custom TOC. With CUE sheet modifications you can do some weird and wonderful things.

 

[Quakester2000]

An intresting tool can be found here http://www.cdtool.pwp.blueyonder.co.uk/

It allows you to read any part of a cd past what the TOC sets, its a sector viewer of sorts, though how far it can read past the toc is very much CD/DVD drive dependent as some hardware wont allow it.

 

[Drenholm]

Cool, I didn't realise that program had been updated. 🙂

Edit: found some interesting things:

This version adds an additional feature: the ability to specify starting position (expressed in LBA) when writing data to CD. It will allow you to tell the writer to start writing the lead-in at any position you specify. This will allow you to skip a portion of blank space at the beginning of the CDR/W. Example, if you specify -200, then you will end up with a blank gap where the lead-in should normally be - in other words the lead-in and all data following are shifted ahead.

Added a skip sector position file support in the 'Image To CD' area. The file is a text file with a list of starting sector and length to skip for the blank areas you wish to be on the CD (this means no EMF data is written in those areas). The format is as follows:

starting sector in LBA unit,skip length

Example file skip.ssp:

100,150

200,10

300,50

The first line means don't write anything at sector position 100 for 150 sectors. The second line means don't write anything at sector position 200 for 10 sectors.

Could these possibly be of use in this situation?

*wants Plextor Premium*

 

[Quakester2000]

I have no idea if a cdwriter / dvd reader will be able to even read the outside track especially if its non standard in some way. Also im betting finding the position of the track would be hard.

 

[Runik]

Originally posted by Quakester2000@Wed, 2005-03-30 @ 12:06 AM

I have no idea if a cdwriter / dvd reader will be able to even read the outside track especially if its non standard in some way. Also im betting finding the position of the track would be hard.

[post=132281]Quoted post[/post]​

I've tried Daytona USA with both drives (a Plextor CD writer and a Pioneer DVD writer), and I couldn't access to the supposed track area.

The last readable sector is situated around 177888 IIRC, and nothing past that is readable : it returns a read error up to around 270000 (which is supposed to be the track position, after a quick calculation ...).

 

[Drenholm]

Check the last couple of pages of this topic, there may be some interesting posts there:

http://club.cdfreaks.com/showthread.php?t=59813

Also, there is yet another topic going on at the moment, at ASSEMblergames.com:

http://assemblergames.com/forums/showthread.php?t=4137

I think the amount of interest in this at the moment is promising! I hope something can be done - only wish I had enough knowledge to be of more use.

 

[Quakester2000]

Originally posted by Runik@Wed, 2005-03-30 @ 08:09 AM

I've tried Daytona USA with both drives (a Plextor CD writer and a Pioneer DVD writer), and I couldn't access to the supposed track area.

The last readable sector is situated around 177888 IIRC, and nothing past that is readable : it returns a read error up to around 270000 (which is supposed to be the track position, after a quick calculation ...)

[post=132305]Quoted post[/post]​

Possible Reasons

1🙂 I guess either your calculations were wrong

2🙂 Hardware doesnt support features

3🙂 Software doesnt work properly

4🙂 CD/DVD writer cant read the saturn sectors.

So its hard to say what we need is to figure out where the data exactly is on the cd and someone write an up to date sector viewer.

----------------------

Also someone was writing about how to write the outside track without being in the TOC well i dont think that is possible but does it really matter. Im guessing sega didnt put in a security feature that says dont boot cd that has track security track listed in the TOC as im guessing they didnt think anyone would figure it out.

 

[Quakester2000]

Someone posted an intresting post over at CDfreaks forums. Anyway he used a method shown over at www.chanka.org for trying to rip GD-ROMS. He also used that CDTOOL i posted a link to. From what i understand he uses the Swap Trick with a PC dvd drive and it will only work with LiteON dvd drives (Lite-on LTD-165H DVD-ROM /JLMS) It uses some of methods from here http://www.cdrom-guide.com/forums/showpost...634&postcount=5

----------------------------------

Hey guys hows it goin'. Well over at www.chanka.org (the homepage of the Dreamcast Emulator Chankast) there's a topic discussing ripping a GD-rom using an ordinary PC CD-rom drive. I didn't have much luck ripping my GD-Roms (my current swapping drive sucks) but the same method was the key to read all the way out to where that dreaded Saturn ring is. I tried it out and lo and behold i got data off from there (it's gotta be the protection what else could it be?!). Anyways what I did was open up my drive and left the naked tray and everything showing allowing me to physically swap discs. I burned one with an illegal TOC (Table of contents) that shows that it has over 1 gigabyte of Data Mode 2. I chose mode 2 since someone at sega xtreme mentioned something about that data being mode 2. Anyways I used Trumans Tool (amazing tool btw) to get out as far as I could until I could find something and I started getting something at sector 297683. So I made an image with Trumans Tool starting at sector 297683 and it went all the way out until sector 328348 which is exactly 72.9662 minutes (that's where it ends). I tested it on a Mortal Kombat II game. I did the same thing with the game Nights, and also Sonic Jam which gave the same results (always ended at 328348). But now the hard part is figuring it out how to burn it on a cdr. Because when I go to burn image to cd I click on "Specify Start pos (LBA)" and input 297683. I leave all the other options alone which results in the "Lead-in Format" option being at "assume audio CDDA (no scrambling), "Sector Skip method using" no skipping, and write speed max. When it burns on an already burned copy of Nights, it finishes succesfully but I notice the status reading all the way out to sector like 390000 which is way to far (when I extracted the data "protection" it only ends at 328348 so why is it that when I burn it, it's burning all the way out to 390000+? I know it aint that long so whats wrong?). When I do take out the cdr and look at it I notice that there is a ring burned on there and it does seem to be in the same spot as it would be on an original factory saturn game. But when I swap the cdr into my swapping drive and try to extract the ring from the cdr it doesn't read anything at sector 297683 like it would on the original nor will it read anything past that. So what did I do wrong when I tried burning the "protection" onto the cdr?

I forgot to mention that I made a .iso image (using CDRWIN and specifying secstart and end on) and I'm also trying to figure out how I could possibly make a multisession disc burning the game+ the protection where it should be (the protection should start at exactly 66.151777777777777777777777777778 according to the windows calculator). How could I specify the cue sheet to burn the protection at that position? Also how could I edit a .ccd (clone cd cue sheet or whatever you call it) to burn the protection at that position if aint possible with a cue-iso. It might give better results too concerning the fact that you can make a disc with an illegal TOC. Any help would be greatly appreciated

 

[Drenholm]

I saw that already, but didn't get round to quoting it. 🙂

 

[Quakester2000]

Originally posted by Drenholm@Fri, 2005-04-01 @ 09:44 AM

I saw that already, but didn't get round to quoting it. 🙂

[post=132387]Quoted post[/post]​

Discswapping could be a possible way of readding back the track, but it is dangerous and could damage your drive if you didnt know what you were doing.

 

[Drenholm]

http://club.cdfreaks.com/showthread.php?p=940563#post940563