"Crack the SEGA Saturn copy protection" contest

Status
Not open for further replies.
As for burning graphics / different EFM patterns to a cd someone has been talking about this on the CDfreaks forum its an intresting read.

http://club.cdfreaks.com/showthread.php?t=129209

I considered this idea a couple of years ago - using different EFM patterns to generate a visible picture, perhaps introducing correctible errors to enhance the picture.

It really does work, to some extent. If you make a 30 minute wav file with AC silence at DC-offset 0x1515 (EFM encoding of 0x15 is 00000010000000) and a 30 minute wav file with AC silence at DC offset 0xA8A8 (EFM encoding of 0xA8 is 01001001001001), and burn them on a CD, you will see two distinct areas - The second track has a lot more land/pit transitions, and it does show.

 
I have found out that CloneCD can read back irregular EFM patterns and burn them back. With the correct hardware ((liteon burner like 48161h, 1633s etc)) according to Vexatious

----------------------------

A few test theories to try out.

---------------------------------

Im guessing if you did a discswap and read back the disc with cloneCD to image it could work but the problem is you would need some kind of modified CloneCD program or front loader as CloneCD reads back the TOC from the disc first from what i understand first, so discswapping would not work but there are ways round this.

You need a clone cd that would read back the Saturns discs TOC but also go to the outside of the disc to sector 333000. It would be intresting to try anyway. Also some CD/CDRW/DVD drives will not read outside the TOC if the disc is say 54 minutes it will not go to the outside of the 54 minutes because the drive reads the TOC back on loading the disc and stores it in internal memory.

A good way around this could be to burn a modified saturn disc with an illegal TOC that shows the size of the disc as 74 minutes and then disc swap with with a real saturn disc this would let the drive read through the dataless section. And all you would need to do is set CloneCD to ignore data errors or 1 retry.

I would not modify the game data itself to buffer the toc, but add an extra track to the outside of the disc a long audio track or data track, then again i dont know how CloneCD would interpret this. I dont know if CloneCD specifically stays to the TOC layout, so say it hit an audio track that doesnt exsist would it read that data back as audio or would it dump it as the disc has the data layed out.
 
heres a screwqy thought, is it possible to read the ring from the saturn itself, and then outputing the data via COMMSLINK or even to the screen to see what is there, something along the lines of how gamecube discs are read into the BBA adapter to make the images
 
Originally posted by knights0fdragon2@Fri, 2005-06-10 @ 10:57 PM

heres a screwqy thought, is it possible to read the ring from the saturn itself, and then outputing the data via COMMSLINK or even to the screen to see what is there, something along the lines of how gamecube discs are read into the BBA adapter to make the images

[post=135182]Quoted post[/post]​


Sounds plausible
 
Sounds plausible

Not really. The CD block is run by a "black box" microcontroller+ASIC combo; unless someone magically stumbles upon a CD block debug mode, the host program doesn't get access to the "raw" data...
 
Disc swap method sounds the most plausable, they used it to dump GDROMS so im guessing someone may figure out this way to do it. There just doesnt seem to be enough intrest to try and break the protection.
 
this thread got crazy long...but it seems to me the nintendo gamecube uses a similar copy protection to this. The GC games are pressed with a barcode that needs to be authenticated before playing a game, only the GC laser can read that barcode, standard drives can't. And the only way to bypass that is to either boot a memory card exploit and then a homebrew application which sends DEBUG commands to the drive which basically bypasses it, or using a modchip...This should make sense to some people anyway

Edit: You can actually see the barcode on a GC disc using a magnifier, anyone taken one to a saturn disc? I am figuring it's the same thing, the protection is just too similar.
 
I have heard from the pros that you can't unlock the cd-drive WITHOUT first authenticating. I think that's why there exists a swap disk for the Saturn.
 
Originally posted by slinga@Fri, 2005-08-26 @ 03:31 PM

I have heard from the pros that you can't unlock the cd-drive WITHOUT first authenticating. I think that's why there exists a swap disk for the Saturn.

[post=138787]Quoted post[/post]​


Im sure there is a way of uploading to the saturn via the Action Replay 5 in 1
 
I don't know much about this stuff, but I've been reading through this and I've been wondering, has anyone tried to make a data intercepter for the saturn's cd ribbon cable? Something that wouldn't interfere with the way the saturn works, but that could copy the data being sent through the cable and transmit it to a pc through a com port? It seems to me that something like this would let you see exactly what the saturn is looking for when it tries to read the copy protection.
 
Status
Not open for further replies.
Back
Top