"Crack the SEGA Saturn copy protection" contest

Status
Not open for further replies.
Originally posted by croft@Sun, 2005-03-13 @ 12:11 PM

Hi Curtis,

Good point.

The security ring is a major hrdle for sending games out to people.

On a different note I am thinking of trying to get a normal saturn disk - cut the centre part out - then attach it to a cdr which has also been cut but still has the boot code on it.

I would guess that this has already been discussed on the forum etc.

It amazes me how this machine still has major hardware security after all this time?

Like others have said'the boot cd code must be exploited and permanently installed into the bios chip.

I guess this is essentially what the chips on the market are doing?

Will let you know findings from cut disks.

[post=131402]Quoted post[/post]​


I was actually thinking about trying this myself. If you get around to it before I do tell me if it works or not.
 
Originally posted by AntiPasta@Sun, 2005-03-13 @ 07:11 AM

I'm sorry but I disagree - the VCD card mainly served to play VCD's, and NOT as an addon for games.

[post=131392]Quoted post[/post]​


The sega dev manuals clearly say that when the VCD card is installed, the Saturn can mux the VCD stream onto the output picture in several ways, even with transparency, or move it around as a texture (like how some of the Sega Flash demo discs did with regular CPK streams, they were pasted on monitors on a huge ratotating 3d complex iirc).

So basically, yes, it was an addon too. A pity that so few games used it.
 
Originally posted by croft+Sun, 2005-03-13 @ 10:41 PM--><div class='quotetop'>QUOTE(croft @ Sun, 2005-03-13 @ 10:41 PM)</div><div class='quotemain'>Hi Mal,

Both Sega blanks are sealed and brand new.

They do have the security ring on them and the rest is blank.

[post=131390]Quoted post[/post]​

[/b]


If they're both sealed, how can you be sure that they have the security ring on them?

<!--QuoteBegin-croft
@Mon, 2005-03-14 @ 04:11 AM

On a different note I am thinking of trying to get a normal saturn disk - cut the centre part out - then attach it to a cdr which has also been cut but still has the boot code on it.

I would guess that this has already been discussed on the forum etc.
[post=131402]Quoted post[/post]​

[/quote]

I guess that you didn't see HI_Ricky's post concerning just that. :looney
 
Actually, there is an important distinction between playing audio CDs and playing VCDs. With an audio CD, the data is never touched by the SH-2s (or even the SH-1 for that matter). All the work of decoding and doing the D/A conversion is handled by the hardware on the CD board.

You've never played with the Saturn's built-in CD player, have you? ;)
 
croft, my intention wasn't to dispute the fact that you possess Saturn CD-Rs or indeed system discs. I just meant that such methods do not really 'crack' the copy protection given that the methods are only really available to those lucky people with system discs.

Also, what you appeared to have discovered was the swap trick. I'm not saying that your method (using the boot CD in addition) doesn't work - it just doesn't work for many. ;)

Sigh... resign myself to the swap trick, I guess... :(

By the way, is it system discs you have or copies of such?
 
Originally posted by Drenholm@Mon, 2005-03-14 @ 02:47 AM

croft, my intention wasn't to dispute the fact that you possess Saturn CD-Rs or indeed system discs. I just meant that such methods do not really 'crack' the copy protection given that the methods are only really available to those lucky people with system discs.

Also, what you appeared to have discovered was the swap trick. I'm not saying that your method (using the boot CD in addition) doesn't work - it just doesn't work for many. ;)

Sigh... resign myself to the swap trick, I guess... :(

By the way, is it system discs you have or copies of such?

[post=131482]Quoted post[/post]​


get the ring info very easy.

1. use any one game, cut 3.5" fit 3.5" cd-r, well some people don't know how to cut., ok, use name card size CD-R , it may little bit easy to cutting.

2. make a big toc size on 3.5" CD-R,(1GB or up to you)

3, use cd rip software by laser raw rip copy.

4, he he he....the code done on you hdd.

the code ready get, so it not hard burn back to CDR

good luck~
 
Since you're so sure that works you've obviously tried it yourself. So you could just share your information instead of wasting everyone's time.

That money isn't going to go anywhere, that's for sure.
 
Originally posted by ExCyber@Mon, 2005-03-14 @ 03:19 AM

You've never played with the Saturn's built-in CD player, have you? ;)


Nope, I've never had a Saturn (though I do plan on buying one once my financial situation improves). I presume that the player shows some kind of effect that corresponds to the audio signal? The Sega CD does that too (though in a very limited fasion, VU meters), but all the decoding work is still done by the CD hardware itself. I would assume the Saturn handles it in a similar fashion. Or does the Saturn support audio effects in the CD player? In such a case I would imagine that the audio data would be fed directly into the audio DSP rather than routed through the SH-2s. Regardless, even if the SH-2s can do digital audio extraction it still would seem to be a poorer avenue of exploitation given that the SH-1 probably distinguishes between audio and data tracks and would not allow for the same method used to read audio data for regular data.

Although it is unclear what method the VCD card uses to allow for unlocking the drive, I see several possibilities that may be exploitable.

1) The SH-1 distinguishes between Mode 1 and Mode 2 discs and only requires Mode 1 disks to be authenticated.

2) The code on the VCD Card mask ROM is for the SH-2(s) and has some magical code sequence that tells the SH-1 to skip the security check (this seems unlikely as it puts a large hole in the copy protection)

3) The mask ROM is for the SH-1. This wouldn't directly give us an avenue of exploitation, but would give us a way to get code running on the SH-1 which could potentially allow us to dump it's internal ROM which could be further analyzed for possible exploits.

The only dead-end possibility I can think of is that the VCD card shorts some pins together that make the SH-1 skip the security check; however, this seems unlikely as well since it would be an even bigger security hole than 2. Of course, I could be missing some possibility that would lead us to a similar dead-end.

Anyway, I'll do a little RE on the VCD ROM and that boot CD rip to see if I can find anything interesting sometime this week.
 
Originally posted by antime@Mon, 2005-03-14 @ 06:25 AM

Since you're so sure that works you've obviously tried it yourself. So you could just share your information instead of wasting everyone's time.

That money isn't going to go anywhere, that's for sure.

[post=131490]Quoted post[/post]​


the ring just CAV reading mode data, when you burn back just use CAV mode burner.

even some one come out the raw data,also need the CAV burner.
 
Originally posted by antime@Mon, 2005-03-14 @ 10:21 AM

So you haven't tried. Imagine my surprise.

[post=131498]Quoted post[/post]​


i have system disc KD01 and KD02 , so i not looking how to make cd-r with ring code,

with out talk boot cd-r, i also can use Mirage CD-emu to run game .

i ready tired cut disc put in cd-r, why i need provide all?? :huh

may be people don't like test us , just like wait the answer ?
 
Originally posted by Borisz@Sun, 2005-03-13 @ 05:57 PM

The sega dev manuals clearly say that when the VCD card is installed, the Saturn can mux the VCD stream onto the output picture in several ways, even with transparency, or move it around as a texture (like how some of the Sega Flash demo discs did with regular CPK streams, they were pasted on monitors on a huge ratotating 3d complex iirc).

So basically, yes, it was an addon too. A pity that so few games used it.

[post=131433]Quoted post[/post]​


ARGH! NO NO NO!

The Saturn dev manual says that you need the VCD card, yes. That would be the VIRTUAL CD card, not the video CD card. It is an ISA card that goes in a PC and emulates the CD drive, basically what the Mirage does.

Why is anyone bothering to copy the Saturn Boot CDs? Here is what they do:

Developer writes game.

Developer burns game to CD-R to test.

CD-R doesn't have ring - developer needs the Boot CD.

Boot CD has ring, so boots. Then asks for the CD-R.

CD-R boots.

Why copy that? It is ONLY a boot CD - much like say the dreamcast boot CD. Your CD-Rs won't boot without it (well, there's swap trick or mod chip). And yes, one is 3rd party and one is 1st party.

Saturn CD-Rs do NOT have an outer ring, AFAIK. How can someone who has a sealed one say it does? Can he see through plastic????

You seem to be missing the point that, past the fact that this seems like a cool thing to do, it helps piracy, and will have a detrimental effect on collectors.
 
yes vcd = virtual cd

inside dev saturn virtual cd board

ss-dev01.jpg


full look Saturn CartDev RevB with Mirage CD EMU

ss-emu.jpg


Virtual CD and CD switch

ss-vcd.jpg
 
Hi Ricky, that's not a Virtual CD board.

The Mirage is a replacement for the Virtual CD board. That is just an interface inside a Cross Saturn.

The Virtual CD board was made by JVC and is an ISA card. Mine is buried under a load of boxes so I can't photograph it, unfortunately.
 
Originally posted by retro@Mon, 2005-03-14 @ 12:41 PM

Hi Ricky, that's not a Virtual CD board.

The Mirage is a replacement for the Virtual CD board. That is just an interface inside a Cross Saturn.

The Virtual CD board was made by JVC and is an ISA card. Mine is buried under a load of boxes so I can't photograph it, unfortunately.

[post=131512]Quoted post[/post]​


oh...may be i miss somethink......

is it same as psy-q emu one ?
 
Originally posted by retro+Mon, 2005-03-14 @ 04:49 PM--><div class='quotetop'>QUOTE(retro @ Mon, 2005-03-14 @ 04:49 PM)</div><div class='quotemain'>Why copy that? It is ONLY a boot CD - much like say the dreamcast boot CD. Your CD-Rs won't boot without it (well, there's swap trick or mod chip).[/b]


From what I understand (and Imay be mistaken, I don't have a Saturn), under normal situations the SH-1 resets it's internal CD authentication status whenever the CD door is opened so in order to successfully do a disc swap one must trick the Saturn into thinking the door was never opened. This boot CD seems to get around that somehow. This alone doesn't allow us to achieve that holy grail of a self-booting CD-R on a Saturn (short of a mod-chip that is), but it could be useful in conjunction with some exploitable flaw (which may or may not exist) somehwere .

Originally posted by retro@

Saturn CD-Rs do NOT have an outer ring, AFAIK.

I have seen pictures of CD-Rs with an outer ring. Of course, they could have been fakes and even if they're not fakes they might be made by the pirates and not by Sega for developers.

<!--QuoteBegin-retro


You seem to be missing the point that, past the fact that this seems like a cool thing to do, it helps piracy, and will have a detrimental effect on collectors.

[/quote]

Piracy already happens. Considering the age of the system I don't think self-booting discs will have a huge impact on it. It will be a boon to the Saturn homebrew scene and I see that as the primary goal here.

I can't say I'm incredibly sympathetic to the collector's plight. Re-releases hurt collectors too and I rather like those. I buy old games too, but not in the hopes that their value will increase. I buy them to play them legitimately without having to pirate them and that can get rather expensive. Driving down the prices of rarer games just makes them more accessible to those that want to buy the games to play them. Of course, lower prices aren't good for the collector that is looking to make a buck or two off his hobby.
 
Originally posted by Yuffie@Mon, 2005-03-14 @ 10:54 AM

Can you send an iso???


i really hope you're not asking for isos. btw, there is a copy floating around the forums. make some good use of the search feature. :slap
 
Status
Not open for further replies.
Back
Top