MDG_breakCdblk, Happy 30th year of NA Sega Saturn

[Mr_Da_Greatest]

Just wanted to wish everyone a Happy 30th North American release of the Sega Saturn.

Credits to the greats before me.
Antime
vbt
cafealpha
jhl
cyberwarriorx
Rockin'B
XL2

I do not know all the copyright rules about posting code from "official" Sega Libraries.
So I will not be posting the whole code but instructions on how to find it.
I have not seen this before but if this has been posted please give credit where it is due.
If not please make sure to give proper credit.
Now will this code automagically unlock the Cdblock... probably not because you need to be able to run code before all the security checks.
I believe this is used by DEMO DEMO.
I also believe this answers the question that the Cdblock is unlocked before doing a TOC check.

You will need some understanding on binutils and potentially some ld (linker) but here is the gist of it.

-1) Sorry I am windows based

0) There are multiple versions of this file in SBL and SGL so be careful that the linked files are from the same library

1) First you use ar to find all the object files in say a library like a SYSTEM library for the saturn.
In that file there will be 2 .o files sys_exit.o and another file.

2) Then you use ar with these modifiers below to extract out the other file. (*** is what you figure out)

sh-elf-ar -t "***SYS.A"
sh-elf-ar -x -o -v "***SYS.A" sys_***.o

3) Optional: Then you can use nm to determine all the functions in the extracted other file

nm -a -l -n -s <filename>

4) Then you can use Objdump to see all the code of the extracted .o file.

sh-coff-objdump -D --all-headers -b binary -m sh2 -S -s -t -r --start-address=0X00 "sys***.o" > sys***_o_objdump.txt

(You can remove the -b binary and -m sh2 if the file can be detected)

5) Optional: If you really want to make portable code out of this you can use the ld to link to all the libraries that are associated with this file
ld.exe -r -o ***CDC_ld2 ***CDC.A --whole-archive ***CDC.A (This is a different example of making PIC code)
This is just an example and should be used with all libraries that link to that file.
It links to just below 32kb.

6) In terms of usage. I could potential see this being put into an IP.BIN that has E0 = 0x8000 (32kb) into it.
After 0xe00 security 1, being able to jump and execute this. The only problem is this has to be relative so all the jmp have to be changed to branches.
Also it might be easier to just call the functions from the bios since the bios has all "00-FF" CDblock functions.

Hope to spur some discussion and discoveries in the near future.

MDG

 

[Mr_Da_Greatest]

Can anyone help with what kind of code we can post on here from the sega libraries without getting into "trouble"?

Sorry for the subterfuge in the previous post.

The .o file is sys_chk.o:

Here is a breakdown of the symbols.

sys_chk.o:
<_SYS_CheckTrack>:
<_doCheckTrack>:
<_getTocInfo>:
<_breakCdblk>:
<_waitNoBusy>:
<_cmpTrackToc>:
<_getTocFad>:
<_seekTrack>:
<_seekStart>:
<_seekEnd>:
<_isSeekEnd>:
<_isHirqOn>:
<_waitHirqDfl>:
<_waitHirqTmout>:
<_getPeriSts>:
<_getDrvSts>:
<_getCdStat>:
<_chkDrvSts>:

With off course the <_breakCdblk>: the one of most interest.

I think this does prove that before the TOC can be checked the CD block is "broken".

The saturn disk check and jump to multiplayer appears to happen before AIP control on real saturn hardware 0x06002f00.
#define SYS_EXECDMP (**(volatile void(**)(void))0x600026C) -> 0x0000186C --> 0x00000424 --> 0x060002DC (r7 HCDM)
#define SYS_CDINIT1(i) ((**(void(**)(int))0x60002dc)(i)) --> 0x00002650

The goal/ask is there a way, other than a cartridge or jhl exploit, to run code before the jmp to multiplayer.
The code could be a modified version of the <_breakCdblk> to not be called by <_getTocInfo>, and not default to <_CDC_TgetToc> after break.

This object code is used by Demo Demo along with sys_exit.o so it does work.

Thanks for your assistance/discussion.

MDG

 

[slinga]

You mind posting decompilation via Ghidra?

 

[Mr_Da_Greatest]

Hi @slinga,

Thanks for 12 snakes, 480p mode and backup library.

Unfortunately, I do not use Ghidra.

I am slowly understanding the bios system using binutils (not even gdb) with Yabause 9.14 and mednafen.

With some help the disassembly and comments from srg320, Saturn_hw/CDB at main · srg320/Saturn_hw, Saturn CD Block ROM dumped again.
There are a lot of differences between the "mpr bios" file and the one above on github.

Ironically your the next comment in that thread.

Would the disassembly (objdump) of sys_chk.o from SBL6.0 without linking be sufficient?

 

[Mr_Da_Greatest]

I apologize on SBL6.01 it is SEGA_SYS.A.

On SGL it is LIBSYS.A.