Copying a NPDP cart

You will need the dreaded Nintendo 'Wif' card to run the GW, there's no way round it, it won't run without it and it's unique to the NPDP program.

...I have all the Apps and Doc's used to write to an NPDP cart, and I know how to do it in practice, it's a piece of pi55!

...Trouble is I don't have any Wif cards kicking around, if I did, or when I do I'll send it to yer, purely to get your GW up and running.

...Mind you everything turns up in the end, fingers crossed.

 

I am still curious as to the outcome of ripping the laptop drive out of the cart and slapping it in a USB caddy. I doubt it has any weird FAT or anything. If you can get it all working, try taking the drive out of a cart and connecting it in your PC. Worst case cenario is the PC does not read it, or it (very very unlikely to) corrupts the data. As long as you can re-format the carts it should be fine.

 

I was sure that i already answered this somewhere, but i can't find it.

The harddisk is a usual IDE one, but a password is set. Luckily, it's quite easy to unlock them.

Then, the content is scrambled with a serial number, so you can't swap the harddisks between cartridges.

Details, including the default password, can be found in the other thread which is somewhere around here. Also the scrambling is not a big issue. Just make an image of the whole harddisk, and i can tell you (i.e. give you a tool) which creates 4 .gcm files out of the harddisk image. You could then burn them onto nr-discs or normal discs (when using with a gamecube modchip).

Assembler, can you make some pics of the DDHs, especially the boards? I never saw any and they are quite rare...

 

Here you go m8...

"I spent quite a lot of time reversing the firmware for the cartridges (as it already has been said: the clever part is in the cartridge, the console itself is a straight DVD-Interface brought to the special connector).

Basically they use a SH-3 CPU plus an FPGA (and some smaller stuff) to interface the DI ("disk (or dvd) interface") to the IDE hdd.

There's hardcoded support for 4 disc images, which are at different offsets. The data itself is crypted with a stupid algorithm (stupid because it's XOR with a 32bit fixed key, and there is a lot of zero in the first sector of every gamecube game...), which depends on the so-called "NPDP-ID". Oh, and the special constant 0xdeadbeef plays into this calculation as well for example, my XOR mask was d8 ae ca ad (now, nintendo, go and derive where i got my cartridge from!

The harddiscs are locked with a key depending on the NPDP-ID as well, so you can't just swap the drives from two different cartridges. However, the security level is set to "high" (vs. "highest"), and the master-password is "N-PDP Master Passwd", maybe byteswapped (depends on your view).

So it's easily possible to unlock the drives, and read/write the contents.

The disc itself reports with some bits set in the first 32bits of the "IDENTIFY"-response (whereas DVD-drives have 00 there..), and to access the data you first have to issue an "NPDP-ID"-command (yes, ascii , which will give you the string displayed when you switch on an npdp-console.

By the way, NPDP-Consoles have a special IPL (if anybody has a rip of the PAL one, i would be glad to get it , basically just to display the "this NPDP belong to..." in the beginning.

Then there are special commands (F0..F6) to do direct reads (reading absolute sectors), flashing the firmware, writing to it (these "NPDP Gang Writers" seem to use that interface - i have never seen them, though.).

I never managed to use these commands, as they seem to require some setup.

You can exchange the harddrive, but be careful, the Cartridge will lock them, so have an unlocking application ready. (please don't ask me for it as i wrote a special application for some embedded device having an IDE bus, as i didn't managed to do that with an USB-housing and i didn't wanted to have to reboot all the time

You can use a smaller harddrive (and thus using less than the 4 images) or a bigger one, but you can't use more than the 4. I looked at any way overriding this offset, but didn't suceed.


(don't worry, i of course swapped some bits in the key "

 

You'd still need some sort of user interface and a remote way to transfer between a PC and NPDP cart in system. I'd sure like a device that loads/dumps GCMs from/to a IDE hard drive

 

NPDP Cartridge Copy Protection!!
Do you still have that program that can create the 4 GCM images on
the NPDP Cartridge? Also about the protection, when you said in your post
you can just unlock them with the master password, are you talking about
then you will be able to Copy & Paste your GCM files to the HDD when it's hooked up to a computer? Please get back to me on this. Thanks again. Nintendo - OLD ENGINEER said you can put GCM files on the carts in his post along as you don't swap hard disk drives.

 

You can't just copy paste the files - you'd have to XOR them first (with the key).

Plus, you'd have to crack the write interface first.

 

So what your saying is the GCM files have to be cracked using a Hex Editior,
with the NPDP-ID Key? Where do you get the key from then? Also how do you crack the writer interface? Is that part of the GCM file protection?

 

I have no experimented with this since I do not have the hardware necessary to try it, but the answer is an old one in a new situation.

If you have the NPDP-GW and WIF, writing to a cart is easy enough (I would think). So, write an Image of PSO to the cart and use the exploit to stream one of the other three images to the PC? The only problems/questions about this idea would be

a) Do you have to write all 4 images to the NPDP cart at once or can you write one selectively and leave the others intact?

b) Does the GDEV (or GBOX, or NPDP console) allow you to switch from one image to the next while the system is running? I would assume yes to accomidate multi-disc games.

 

To answer in order...

PSO streaming from NPDP works a treat (fun fact: OE = Was the 1st person in the world to do this! h:

a) U can select what u want to write, and how much.

b) Yes, hence the PSO exploit is possible.

 

Old Engineer is it possible to write data to a cart without the Gang Writer?
Put the NPDP HDD in your computer then go to My Computer,
Double Click on the External HDD inside a USB Caddy, then Copy & Paste
the GCM images that you want. Topic Archive already gave out the
Master Password to unlock the drive in Windows itself. So I would say you can but what do you think? - Thanks again. Nintendo

 

According to one of the old topic archive threads above, and I quote...

"it's easily possible to unlock the drives, and read/write the contents"








...Personally I'd use the GW tho, hehe

 

Yes, it *is* possible to write to the drives, but you need to crack the interface first (i.e. the method GW uses to write to the carts), and nobody has done that to my knowledge.

Usually on a drive you have many many sectors without any data (normally filled 00s). In this case, even the zeroes would be XOR'd, so it should be as easy as finding large portions of a repeating 32-bit value (the key)

 

Unless theres some kind of header I'm forgetting about (dd image to hdd xor and check), it's as simple as hooking the exposed hdd to a pc, putting in the lock key on boot, concating the 1-4 gcms together, xoring your concated "image" (retrieve key from hdd)and dding to the hdd.

 

NPDP Cart Update - Crazy

Alright here's the deal I have installed a sector viewer on my WinXP HDD and view my NPDP HDD installed in my computer but the drive is locked.
Problem is if I unlock the drive all the sector are reset and all data lost.
Which to me doesn't make much that much difference because there are no games on either of my 2 NPDP Carts anyway. So from the above post from
(DRX) it's impossible to find the key in the first place after you format the drive. All sectors are erased back to normal before the NPDP gang writer writes to it. So how do you get the key then? There has to be someway to get the key from the drive being locked. DRX saids just look for an repeating 32bit value but the sectors are all turned back to normal if I unlock the drive. Anybody have any other ideas in mine. There has to be some way to write to theses carts without the Gang Writer. Topic Archive said he broke the XOR protection and found his key but even he can't write to the drives. So what is the point of the key anyway? Please reply thanks again.

Nintendo

PS Anybody willing to sell an Gang Writer, WiF Card? I don't need the cable or the software already own them. Will pay up to $400 - $1200.00 + shipping. Later Nintendo