Originally posted by ExCyber@Mon, 2005-03-14 @ 03:19 AM
You've never played with the Saturn's built-in CD player, have you? 😉
Nope, I've never had a Saturn (though I do plan on buying one once my financial situation improves). I presume that the player shows some kind of effect that corresponds to the audio signal? The Sega CD does that too (though in a very limited fasion, VU meters), but all the decoding work is still done by the CD hardware itself. I would assume the Saturn handles it in a similar fashion. Or does the Saturn support audio effects in the CD player? In such a case I would imagine that the audio data would be fed directly into the audio DSP rather than routed through the SH-2s. Regardless, even if the SH-2s can do digital audio extraction it still would seem to be a poorer avenue of exploitation given that the SH-1 probably distinguishes between audio and data tracks and would not allow for the same method used to read audio data for regular data.
Although it is unclear what method the VCD card uses to allow for unlocking the drive, I see several possibilities that may be exploitable.
1) The SH-1 distinguishes between Mode 1 and Mode 2 discs and only requires Mode 1 disks to be authenticated.
2) The code on the VCD Card mask ROM is for the SH-2(s) and has some magical code sequence that tells the SH-1 to skip the security check (this seems unlikely as it puts a large hole in the copy protection)
3) The mask ROM is for the SH-1. This wouldn't directly give us an avenue of exploitation, but would give us a way to get code running on the SH-1 which could potentially allow us to dump it's internal ROM which could be further analyzed for possible exploits.
The only dead-end possibility I can think of is that the VCD card shorts some pins together that make the SH-1 skip the security check; however, this seems unlikely as well since it would be an even bigger security hole than 2. Of course, I could be missing some possibility that would lead us to a similar dead-end.
Anyway, I'll do a little RE on the VCD ROM and that boot CD rip to see if I can find anything interesting sometime this week.