Worth noting that on a machine that uses CDB106 and a 20pin drive (CDB106 normally always uses 21pin drives), pin 87 of the SH1 is jumpered to +5V instead of ground. The documents list this pin as the least significant bit of the Port C data register. Anyone bothered to look into what the CDB firmware does with those registers?
Saturn CD Block ROM dumped again.
- Thread starter Waterfuell
- Start date
Worth noting that on a machine that uses CDB106 and a 20pin drive (CDB106 normally always uses 21pin drives), pin 87 of the SH1 is jumpered to +5V instead of ground. The documents list this pin as the least significant bit of the Port C data register. Anyone bothered to look into what the CDB firmware does with those registers?
You can see it on this picture.
Attachments
I was refering that in schematic Ive post must take into account the comm line dosnt appears.
The schematic you has post is good too for get an idea how CDB is intercomected.
My research is based on CDB105 and unfinished, so i cant help, the only that i can say about port C is that pin PC6 is config as analog input AN6 in pin 94
Are you still working on this? Any progress? I'm interested in making my own ODE because hardly anybody can afford the prices they charge and we can control microcontrollers with python now so I thought I would give it a shot. I've ordered a few Saturn's to use for testing and will probably start getting my hands dirty with the project at the start of the new year. Essentially my goal is to get a cheap ODE on the market for everybody.
The project is halt, looks like ROM has been reverse engineered other times before, and people say there is no more to extract.
The theorical feature that should be interesting to find is the way to load SH1 encrypted code from an autorized cd, but RE all the ROM requires lot of job for something that doesnt arouse much interest.
At this moment Im also working on a open source ODE, ive talked about it whith other users in discord, not so deep, bu you can take a look if interested.
I saw that it had been reversed before but I thought the information was still not fully publicly available.
Sent you a message on discord.
slinga
Established Member
@Waterfuell ,
I've started looking at the SH-1 ROM (cdb105.bin) and the YGR ROM (ygr022.bin). Using Yabause 0.9.15 I am able to set breakpoints within the SH-1. Do you know if it's possible to debug the YGR as well?
Edit: Actually it looksl ike ygr022.bin is just a variant of the cdb105.bin.
I've started looking at the SH-1 ROM (cdb105.bin) and the YGR ROM (ygr022.bin). Using Yabause 0.9.15 I am able to set breakpoints within the SH-1. Do you know if it's possible to debug the YGR as well?
Edit: Actually it looksl ike ygr022.bin is just a variant of the cdb105.bin.
Last edited:
As I comented to you in discord ygr is just lsi + sh1 join togeter in a single chip.
LSI is just hardware, imagine it like an non programable cpld or fpga, just logic, for glue all together.
I couldnt debug in yabause, in linux didnt work for me, I did a prety simple and slow sh1 emulator in python.
Last edited:
fafling
Gear Supporter
CDB105 and CDB106 are the markings on SH1 when it's separated from OCU (marked YGR019A or YGR019B), as the service manual labels this component.
OCU is an external bus controller for the SH1, it plays a bit the same role as does SCU (minus the DSP) for the SH2s. As @Waterfuell said on Discord, it contains the CD block registers described in System Library User's Manual.
YGR022 is an integration of OCU and SH1. As such, it contains the 64 KB ROM of SH1. It first appears on revision VA6 of the Saturn motherboard. There are pictures of the different motherboards on the 2nd half of this page : [Sega] Saturn – Différencier les versions
OCU is an external bus controller for the SH1, it plays a bit the same role as does SCU (minus the DSP) for the SH2s. As @Waterfuell said on Discord, it contains the CD block registers described in System Library User's Manual.
YGR022 is an integration of OCU and SH1. As such, it contains the 64 KB ROM of SH1. It first appears on revision VA6 of the Saturn motherboard. There are pictures of the different motherboards on the 2nd half of this page : [Sega] Saturn – Différencier les versions
slinga
Established Member
I can verify SH-1 debugging in Linux with Yabause 0.9.15 works. I can set code breakpoints within the SH-1 ROM and it hits. Memory breakpoints do not appear to work however.
Where are you get?? Prebuilt, or compiled yourself??
slinga
Established Member
Compiled. I think form here: Yabause » Download
There is no easy way for dump ROM, at least that I knew.
But ROMs has been leaked, if you are interested.
I know it's out, but not all versions are dumped. CDB104 wasn't dumped last time I checked and it behaves differently in some instances. There are also older versions on devkits, at least one which does not have the copy protection implemented. Would be nice to get those dumped. I was always hoping the Satiator could do that due to the way it hooks up to the SH1.
Unless someone find the way to load sh1 from cd or mpeg port and share the code, we only can hope jhdl someday add ROM dumping support to satiator.
I partially disassembled CDB105 for the purpose of development and debugging the Saturn FPGA core. Maybe it will be useful to someone.
github.com
Saturn_hw/CDB at main · srg320/Saturn_hw
Contribute to srg320/Saturn_hw development by creating an account on GitHub.
github.com
slinga
Established Member
I partially disassembled CDB105 for the purpose of development and debugging the Saturn FPGA core. Maybe it will be useful to someone.
Saturn_hw/CDB at main · srg320/Saturn_hw
Contribute to srg320/Saturn_hw development by creating an account on GitHub.
Thank you for sharing. I've been working my way through CDB105 as well and your notes will save me a ton of time.
Have you looked at the strings in the CDB ROMs? There's only a few, and a couple stand out: "Hitachi" and "PublicKeyCipher." Given its proximity to a bunch of bit shifting and XOR instructions, I would not be surprised if this was used in the process to decrypt and load SH1 code from the VCD port. I have yet to do much more reverse-engineering beyond that, but I've seen no mention of these strings online whatsoeve...
