Using AR to boot CDs

[Gravis]

so i was thinking about the action replay device, that it can actually execute it's own code and is called before anything is done with the CD. then i wondered, could an AR card act as a loader for saturn games? doing this would mean loading the code directly from the CD and being executed. basically, it would tell the saturn, "you are here --> CD" which would completely bypass the whole "is this a 'real' game or a homebrew/copy" verification process.

well, that's the theory anyway.

so, knowledgeable saturn people, could it be done?

 

[ExCyber]

It can't be done if the CD has a standard Saturn header, as the CD block will refuse to read most of the disc until the ring check is done. AFAIK, it's an open question as to whether it could load a game from a disc with a deliberately modified header.

 

[Gravis]

the CD block will refuse to read most of the disc until the ring check is done.

so my question for that is, can one communicate with the CD block and perhaps tell it the check is complete?

 

[ExCyber]

so my question for that is, can one communicate with the CD block and perhaps tell it the check is complete?

There's no known way to do that, and I don't know of any plausible reason that such a mechanism would be included. There might be some sort of more general debug mode that could be used to get around it, but if such a mode exists code to activate it was probably only ever in the possession of Sega, Hitachi, and/or Yamaha. Something might turn up if the CD block firmware is dumped (apparently on Guru's to-do list), but until then we probably won't know.

 

[Gravis]

There's no known way to do that, and I don't know of any plausible reason that such a mechanism would be included. There might be some sort of more general debug mode that could be used to get around it, but if such a mode exists code to activate it was probably only ever in the possession of Sega, Hitachi, and/or Yamaha. Something might turn up if the CD block firmware is dumped (apparently on Guru's to-do list), but until then we probably won't know.

i find the possibility of a debug mode to be unlikely. it sounds like the best course of action would be to replace the firmware on the CD block with a modified version of the existing one. i think you could get away with a single JMP (to go around the code) or some NOPs and possibly BRK (replacing the pass/fail break condition with always pass).

ripping the firmware sounds very interesting.

 

[ExCyber]

it sounds like the best course of action would be to replace the firmware on the CD block with a modified version of the existing one.

The firmware is in ROM inside the CD block SH-1, which is why it hasn't been dumped yet. There is a mode on the presumed standard-part-number equivalent (Sega got special part numbers for the SH chips used in the Saturn) to boot from external memory, but I don't remember what that does to the memory map; the existing firmware might not work in that configuration.

 

[Gravis]

Sega got special part numbers for the SH chips used in the Saturn

sounds like it's time to buy a bunch of SH-1s and see which chip it really is.

 

[ExCyber]

sounds like it's time to buy a bunch of SH-1s and see which chip it really is.

There weren't too many variations around at the time. If memory serves, it's generally assumed that the SH-2s are SH7604, and that the SH-1 is an SH7034.

 

[slinga]

Well you can flash the AR and the AR (like the MPEG card) gets code execution first. I guess if you can find the right device control to issue to the CD-ROM it would work, assuming that there is in fact a command you can issue. If there's not your out of luck.