"Crack the SEGA Saturn copy protection" contest

[Quakester2000]

Originally posted by Drenholm@Sat, 2005-04-09 @ 04:09 PM

Guess we're stuck with the disc swap, then! Ah well. However, I wonder what was so special about Quakester2000's drive which allowed it to read outside the TOC without outside help?

This is presuming I understand a post he made at CD Freaks correctly.

[post=132700]Quoted post[/post]​

Does no one else have a BenQ 1620 with firmware B7T9 out there to test it on, with CDRWIN 3.9 K-E Demo it will rip but it seems no data will come off the disc. I dont understand i made a rip with data and now i cant seem to make any rip of any data. It will rip but no data will be in the file except a few characters.

 

[kortex]

Hi! i need an iso of the system disc for sega saturn, now i'm trying some things if i will get the system disc, maybe good news, if anyone have an iso of the system disc, please send me it to my email (the files in *.rar plz) email edited!

 

[Borisz]

Originally posted by kortex@Sun, 2005-04-10 @ 08:16 AM

Hi! i need an iso of the system disc for sega saturn, now i'm trying some things if i will get the system disc, maybe good news, if anyone have an iso of the system disc, please send me it to my email (the files in *.rar plz) kortexx@gmail.com

[post=132739]Quoted post[/post]​

it was already posted in the forums, even in this very topic. Use the search button or something.

Anyway, we have the security track ripped, so now we should figure out how to burn it.

 

[kortex]

BAD NEWS!

i had investigated with the saturn cd drive, and i have more information:

first, if we want burn a boot disc (using system disc + security track), we will need a 74min disc, why? Because the saturn drive ONLY CHECK the security track when the medium is of 74min. I put a backup in 80min disc in the saturn drive and i saw that it only reads the game's track, it doesn't go to the final of the disc for check the security track, but when i put a backup in 74min., the saturn drive reads the toc and immediately it goes to the final of the disc for check the security ring.

The problems is that nowadays i can't buy 74min discs because in the shops only sell minicds (8cm) and 80min discs.

Then we only can break the saturn protection with a modchip !!

I tried to cut a disc that i burned with the security track (full cd in mode 2 2352 with my dump of the ring in the correct lba) and put it with other disc (system disc) that i cut it too but how i said in lines up the saturn doesn't go to the final for check the magic code (i used 80min cds), if i will use 74min cds now i will have a perfect boot disc

No more comments by the moment.

 

[mrkotfw]

how exactly do we know if the ring data is actually correct? could it be that there is more to it?

 

[Quakester2000]

Originally posted by kortex@Sun, 2005-04-10 @ 07:36 PM

BAD NEWS!

The security track when the medium is of 74min. I put a backup in 80min disc in the saturn drive and i saw that it only reads the game's track, i

[post=132749]Quoted post[/post]​

It shouldnt matter as length of the cd is specified in the TOC, i have a Nights Into Dreams backup here its burnt on a 80min CDR and the drive still tries to read the Security track off. Either the disc you had burnt had the wrong region code or wasnt in the correct format for the saturn. What we need is a few modified saturns to support CDRW so that it would be easier and cheaper to test.

 

[kortex]

Originally posted by Piratero@Sun, 2005-04-10 @ 10:32 PM

how exactly do we know if the ring data is actually correct? could it be that there is more to it?

[post=132750]Quoted post[/post]​

Well, when i dumped the security ring (2 years ago), i used cdrwin, this has an option for see the sectors, when i swap my fake 80min cd for the saturn game i saw the ring and the sectors are equivalent to my dump and i used some cd/dvd drivers, different games and differente programs (nero-->view track, and cdrwin).

 

[kortex]

Originally posted by Quakester2000@Mon, 2005-04-11 @ 12:19 AM

It shouldnt matter as length of the cd is specified in the TOC, i have a Nights Into Dreams backup here its burnt on a 80min CDR and the drive still tries to read the Security track off. Either the disc you had burnt had the wrong region code or wasnt in the correct format for the saturn. What we need is a few modified saturns to support CDRW so that it would be easier and cheaper to test.

[post=132753]Quoted post[/post]​

Hi, i tried to some CDR (Verbatim, TDK, Intenso and Bulkpack), all burned with different speed, with my original game (sega rally and chritsmas night) and the saturn open (without the black case) and i saw that the saturn length didn't go to the final for check the security track with never 80min CDR.

 

[ExCyber]

I have also seen my Saturn try to read the ring on 80-minute media. Plus, I have no idea how Saturn would even recognize 80-minute media aside from an ATIP scan, and if it could do that then it could just reject CD-R altogether.

Well, when i dumped the security ring (2 years ago), i used cdrwin

How did you get cdrwin to dump the ring, and what did you see between the data track and the security ring?

 

[Quakester2000]

Originally posted by ExCyber@Mon, 2005-04-11 @ 03:56 PM

I have also seen my Saturn try to read the ring on 80-minute media. Plus, I have no idea how Saturn would even recognize 80-minute media aside from an ATIP scan, and if it could do that then it could just reject CD-R altogether.

How did you get cdrwin to dump the ring, and what did you see between the data track and the security ring?

[post=132768]Quoted post[/post]​

He used CDRWIN with sector dump and disc swap to dump it. The data has already been posted there are various versions dumped with different programs.

 

[kortex]

well, it's very rare, with some backups (in 80min cdr and with 74min) the saturn go to back for read the ring, and with other backups the lenght only go to a few milimeters more than the final lba, i make a copy of my segarally with discjuggler and i write it in raw mode and check the ring, but my other copy don't check it, and the pandemonium directly don't check the same with the system disc, very rare. i will try to again. Ahh, between the data and the ring there is nothing, the disc is empty and gave me error.

EDIT: I saw again what the saturn do, and the backups (74min or 80min) never check the security ring, i used my original sega rally, nights and backups of their, and when the saturn go to the final for check the security track, i turned off the console and i write to the drive where the lenght was. I think the saturn check some between the tracks.

 

[Quakester2000]

Originally posted by kortex@Mon, 2005-04-11 @ 06:37 PM

EDIT: I saw again what the saturn do, and the backups (74min or 80min) never check the security ring, i used my original sega rally, nights and backups of their, and when the saturn go to the final for check the security track, i turned off the console and i write to the drive where the lenght was. I think the saturn check some between the tracks.

[post=132772]Quoted post[/post]​

Are you sure you burned the discs correctly,and in the correct format. Remember I think it may have to be burnt in two DAO sessions. One Session game, second session outside ring.

 

[kortex]

Originally posted by Quakester2000@Tue, 2005-04-12 @ 01:37 PM

Are you sure you burned the discs correctly,and in the correct format. Remember I think it may have to be burnt in two DAO sessions. One Session game, second session outside ring.

[post=132799]Quoted post[/post]​

Please Quakester2000, open your sega saturn (without the plastic case), and put a original game,turn on it and when the lenght go to the final for check the ring, turn off it and in the black plastic of the drive, write a signal together the lenght position, now make a backup (RAW DAO) of your game, and put it in the saturn drive, turn on it, and when the lenght move to the final, turn off and now see if the position is the same as the original game. Ahh, if you have a game how pandemonium (only 70mb), directly the lenght don't go to the final, it only move a few milimeters back the last track.

Please, try it and say me your results. thx.

Other thing, then you say that i must copy my game in 2 session how the dreamcast games, it's correct? for example, if i use cdrwin (make an iso *.bin *.cue), the copy is bad (one session, with data and the audio tracks)? but if i always had burnt my games using cdrwin and i can play with them perfectly (swapping).

 

[Quakester2000]

I cant think why you can get your saturn to check for security ring on 80 min cdr but any backup game i have written to a 80 min cdr always checks for security ring.

The saturn has no way of knowing what type of cd it is anyway, even most modern CDreaders cant read the ATIP data off a CDR, so they can tell if the difference between CDR 74 or 80, they just go by what the TOC tells them.

 

[Quakester2000]

Originally posted by kortex@Wed, 2005-04-13 @ 11:13 AM

Other thing, then you say that i must copy my game in 2 session how the dreamcast games, it's correct? for example, if i use cdrwin (make an iso *.bin *.cue), the copy is bad (one session, with data and the audio tracks)? but if i always had burnt my games using cdrwin and i can play with them perfectly (swapping).

[post=132828]Quoted post[/post]​

I mean burn the game in two sessions. You can burn game data audio and data in DAO mode close that session (not finalize) then open another DAO session and burn ring data, this is also known as Session at Once.

Also on both orginal and backup games on my saturn the laser always goes to the same place as shown in the picture. I cant understand why yours has a problem Kortex.

 

[ExCyber]

Ahh, if you have a game how pandemonium (only 70mb), directly the lenght don't go to the final, it only move a few milimeters back the last track.

Yeah, I think the Saturn discs have some kind of dummy channel between the data track and the ring, and the drive seems to lose tracking without that when trying to seek to the ring. Try filling up the disc by adding a long audio track, and you should see much different behavior...

 

[Quakester2000]

Originally posted by ExCyber@Wed, 2005-04-13 @ 04:55 PM

Yeah, I think the Saturn discs have some kind of dummy channel between the data track and the ring, and the drive seems to lose tracking without that when trying to seek to the ring. Try filling up the disc by adding a long audio track, and you should see much different behavior...

[post=132837]Quoted post[/post]​

But when you put in a backup game it still goes to the outside so i doubt this is the problem.

Anyway Kortex what software are you using to burn the disc and what type of burn Disc at Once / Track at Once etc.

IMPORTANT

I have also found something else you cant just copy data off the cd onto your hard drive and rip the music tracks as mp3 and burn them back. It seems there is some important data stored in sectors 1-21. Of course if you do a 1:1 copy it works fine and copies these important sectors.

If you just make a data / audio cd it doesnt work, of course this is the best way of making the bootable saturn cd as it means you can write the data / audio in a disc in Disc at once. Then open up another session to write the security ring.

 

[ExCyber]

But when you put in a backup game it still goes to the outside so i doubt this is the problem.

It tries to go to the ring as long as the disc you initially inserted has a Saturn header (see below), but it only actually succeeds if either there is an original disc inserted, or the CD-R is basically full. Otherwise it will stop at the end of the session and spin up the drive in a rather unsettling way, presumably trying to reaquire the channel. At least, this is the behavior I see on my Saturn.

It seems there is some important data stored in sectors 1-21. Of course if you do a 1:1 copy it works fine and copies these important sectors.

It's the first 16 sectors (sectors 0-15). That's the ISO 9660 bootstrap area, which is used by Sega for a disc header and bootstrap code (this is known as an "IP.BIN", after the conventional Sega filename for an image of that area). The content of this area is not specified by the ISO 9660 standard, it is basically intended as a reserved area for proprietary use. Still, its existence is specified by ISO 9660, so any good CD mastering software will have an option buried somewhere to insert a bootstrap image. This area also contains the region code, which is why you (generally) can't swap to play foreign discs, only CD-Rs.

Also, I'm hearing that the Saturn BIOS may not play nice with multisession discs; I don't have the details, but the guy who's telling me this knows where to find this thread if he wants to post about it.

 

[Raster]

Originally posted by Quakester2000@Wed, 2005-04-13 @ 12:24 PM

I have also found something else you cant just copy data off the cd onto your hard drive and rip the music tracks as mp3 and burn them back. It seems there is some important data stored in sectors 1-21. Of course if you do a 1:1 copy it works fine and copies these important sectors.

There's a Sega 'signature' block in the first few sectors (Can't remember exactly how many, I would have to consult some old stuff.)

Also, for some reason many PC tools push the first 'directory' or data block out to $B800, whereas many Saturn disks start at $A000. (The values represent locations in an ISO image. I think these values are correct). The Build CD tool from Psy-Q is the only way I know to create the correct layout.

 

[Quakester2000]

Originally posted by Raster@Thu, 2005-04-14 @ 03:35 AM

There's a Sega 'signature' block in the first few sectors (Can't remember exactly how many, I would have to consult some old stuff.)

Also, for some reason many PC tools push the first 'directory' or data block out to $B800, whereas many Saturn disks start at $A000. (The values represent locations in an ISO image. I think these values are correct). The Build CD tool from Psy-Q is the only way I know to create the correct layout.

[post=132861]Quoted post[/post]​

Im betting Kortex hasnt done a 1:1 copy but dumped the data off the CD with something like windows and burned it back. If that bootstrap area does not exist the saturn will not check the disc and it wont even try to boot it as its not a valid saturn cd.

As for Multisession, if you burn 2 x DAO sessions say burn 1 session then burn another session later the saturn will not be able to see the second session as only PC drives can read double sessions along with some new audio cd players.

-------

Also where can you get this saturn CD build tool as it will be required. You cannot rip a cd then burn it back as an unfinialized DAO it always finalzies itself (with nero anyways) and you dont want that.