Ripping GDR's

If you know where the information is held, I could possibly get the author of the app to implement GD-R dumping. Failing that, I have a build of httpd that dumps individual sector ranges, as long as you know what sectors need to be dumped you can probably dump it with that build; I'm sure he will have no problem with me sharing that build if I ask him.

 

I have no clue where the info is at, FamilyGuy might be able to help with that

I'd be very interested in the httpd build though, can you upload it? It might negate the need for trap discs!

 

You can still ask groepaz (http://www.hitmen-console.org/) or skywalker (don't know if he's still around under another nickname), but unfortunately, I don't have the schematics.
It's sad to see such a device disappearing from the web, as it's way better than anything else made for the DC...

 

@ MARK:
This http hack seems really cool, but our problem was the fact that the Dreamcast don't actually recognize the gd-r as a gd-rom, but a a low-density normal cd-rom. This makes it impossible to rip using standard BBA trick (and this http trick should not work either because the "problem" is from the toc on the disc itself[not security area])

Therefore, what we do is to trick a pc or a dc with swap to obtain the ip.bin & toc layout of it so we can see the lba of everytracks, then I create a trap disc, with the same structure that the gd-r actually got(but that the Dreamcast can't see) then using the BBA App Dot50Cal got he can easily rip all the tracks.

This trap disc could possibly be used with the http hack too and maybe the dc-load serial/ip but I can't/didn't test it on these, but the main idea is to mimic the toc of a real gd-rom(1st track low-density then the righ lba for everytracks) and to swap it with the actual gd-r.

@darcagn: The track info is held is the ip.bin, I always extract from 45000 to 46000 and the whole toc is in it, sometimes only ip.bin don't works(god only know why) I've made a autoexecuting bat file that actually can get this info out of a ip.bin : http://dcemulation.com/phpBB/viewtopic.php?f=40&t=92844 It's based on an already existing program, but I couldn't find the original author to give him credits, i only enchanced it to be user-friendly.

@Dot50Cal: I hope you'll finally get youi damn card

@everybody: My psu still is brok and the other isn't arrived yet because it's a holyday here in Québec (the holiday is the "St-Jean") and they don't ship in holydays.

I think the easier way to rip a gd-r would be using a ltd-165h dvd-rom drive and swap trick on a computer, but for that you actually need this specific drive (wich I got).

Thank you all and congratulation if you read my whole post (damn long)


-=FamilyGuy=-

 

to put some light on all this : there were a lot of different ways to dump gdroms, when scene started ppl used either oficial devkits, a swap trick with on a hitachi modded drive with a fake toc cd inside or a serial cable as me (i was lucky enought to have the tools that resumed the data if the copy failed, cause it was 20 hours to rip a full disc with the serial port) and no, i cant share these utils cause never were public and a friend of mine is the developer.

Cheers

 

The absence of the security area is the problem, as the TOC on all discs, including GD-ROMs, does not include the high-density portion. When the Dreamcast finds the security ring, then I assume it decides to use the IP.BIN info instead of the disc's CD-ROM TOC.

IGNORE THIS POST, read post below.

Here is the version that can read specific sectors. To dump a sector range, change the track and session parameters to the sector range.

http://192.168.1.13/track46000.raw?session45000[...]

That command will dump a file that is the contents of sectors 45000 through 46000

http://dumpcast.thekickback.com/httpd-ack-20070624.zip

Great news, guys! I told ack about all of this, and he wrote up a special version for you. NOTE that this is not tested at all on a real GD-R, as ack doesn't own one and neither do I.

http://dumpcast.thekickback.com/httpd-ack-gdr-test.zip

1. Start Dreamcast with lid removed. Hold down the lid switch.
2. Boot up dc-load-ip and load the elf file from your PC.
3. Once httpd-ack-gdr-test is loaded, release the lid switch and insert a retail GD-ROM disc.
4. Hold down the Dreamcast's lid switch, being careful not to break it. Let the disc spin up and be authenticated (listen for the beep).
6. Load http://DREAMCASTIPADDRESS/cdrom_spin_down and the disc will stop spinning in your Dreamcast.
5. Keeping the lid switch held down, swap for your GD-R.
6. Load up http://DREAMCASTIPADDRESS/ and you should see the session 2 TOC properly read from the IP.BIN. Happy dumping!

EDIT: It's bugged, wait for a new release tomorrow.
.:00·42·22:. «@ack» hrm
.:00·42·37:. «@ack» now that i think about it that version is going to be bugged for the actual dump
.:00·43·11:. «@ack» it still reads the cached toc when getting sector info when sending a track
.:00·43·18:. «@ack» i will fix it tomorrw
.:00·44·09:. «@ack» the toc list should still be right tho
.:00·44·17:. «@ack» so they can atleast verify
.:00·44·46:. «@ack» they could also do the sector range dump with the provided start/end sectors

 

Well, I don't know exactly how ack does the app to rip gd-rs, but he must be warned that the ip.bin (45000) will be further than the end of the TOC of the inserted disc. He simply needs to keep that in mind. Up-to-date, Dot50Cal&Me technique is the only one "I know" to works to rip gd-rs with cdda with a RETAIL Dreamcast, and only a BBA.

Good luck on your http thing !

ps: Just reveived my PSU !

-=FamilyGuy=-

 

Read the instructions--it's based on a swap trick.

You insert a GD-ROM, tell the application to spin down the disc, swap with the lid switch still held, then tell the application you've swapped and it reads the IP.BIN and offers you downloads of all tracks, including CDDA.

This is for a retail Dreamcast unit and BBA.

Here is the fixed build that should be fine for dumping.

http://dumpcast.thekickback.com/httpd-ack-gdr-test2.zip
(EDIT: I've tested it now. Only bug so far is that you will get the swap-disc's GDI file if you grab disc.gdi, not the real disc's GDI file. fix coming soon)
(EDIT 2: Oh, and you have to use a disc with the same layout as your target disc for it to work properly. more on this later)
(EDIT 3: Here is the fixed version that makes correct GDI files: http://dumpcast.thekickback.com/httpd-ack-gdr-test3.zip )

When are you going to be back in #segakatana?

 

So a trap disc is still needed, which means we're back to FamilyGuy's method basically... right?

 

Pretty much yeah ...

But if anyone can create an hypothetic program that read the ip.bin, finds the toc of the cd, then fake the drive to think this TOC is the one of the disc in the drive, it'd work without a trap disc, using BBA or Serial and dc-load.

It'd be like:
1- Load dc-tool
2- Insert any retail gd-rom
3- Run "recognize disc TOC"
4- Swap for the BETA
5- Run "read and input cd toc"
6- rip using dreamrip or equivalent

But it migh be actually a pain in the a*s to input a faked TOC in the Gd-Drive that's why I use a trap disc instead of trying to create an almost impossible program.


-=FamilyGuy=-

[EDIT] This actually migh be possible using the "reset" trick, infos about it are documented in some sega confidential docs, and it's the base to the systemdisc and the utopia boot disc. How it works is that it input infos in a certain memory region, them perform a "special" software reset that keeps the memory infos ok, then boot according to the infos, it migh be used to boot a backup, a gd-r, or *MAYBE* to create a program that'd read a toc, input it in memory, then soft-reset...

Ps: Specualtions...

 

If you can direct me to said documents I can look into adding it to httpd-ack.

-ack

 

I think the trick is called "SPI SOFT RESET" it reboot as a power-on reset but the DRV bit remains unchanged, look in your own library for more info because I don't think I can post confidential docs here...

And here's where I first heared about it :

http://www.boob.co.uk/docs/quest.htm

Thank you!

 

The "Reset Trick" being referenced in dopefish's docs has nothing to do with resetting the Dreamcast, it's about re-enabling the GD-ROM drive. When the Dreamcast boots in MIL-CD mode, it does two things differently than booting in GD-ROM mode: it locks the GD-ROM drive and it performs the descramble function on the binary. Custom software, such as stuff built with KOS or Ronin, the Utopia boot Loader, and the GameShark CDX are held on the disc scrambled and they use a trick (syscall GDROM_RESET maybe?) when they execute to re-enable the GD-ROM drive. On the other hand, pirate discs using Katana have a special function to the IP.BIN added by pirate groups: a re-scrambling function (based on Marcus Comstedt's scramble.c) and the GD-ROM unlocking code. It is required to do this in the IP.BIN because Katana binaries don't have the unlocking code and they are held in the disc normally, not scrambled (thus the Dreamcast descrambles a normal binary, creating bad data in RAM, but the IP.BIN code rescrambles the code back before execution).

(and to answer your question on IRC, yes I am |darc|)

 

darcagn: do you know if someone ever disassembled the code that unlock the drive and scramble the binary back? It is stored in the bootstrap2 offset, right?

 

Marcus Comstedt posted the disassembly on the DCHelp boards a few months ago:
http://dchelp.dcemulation.com/phpbb/viewtopic.php?p=2459#2459

Yes, it is the last thing in the IP.BIN so I assume it is in the second bootstrap.

 

Very nice read! Thanks for pointing the url. So, maybe, it's possible to boot a katana game using a ip.bin created by Marcus's makeip just scrambling the 1st_read.bin.

 

It wouldn't work because the IP.BIN also unlocks the drive. The 1ST_READ.BIN would start execution then crash soon because it has no access to the game disc.

 

I was just wondering; when you use a system disc 2.. it is possible to swap beta's withouth further using the systemdisc, untill you reboot the Dreamcast. So maybe it is more easy to rip GD-R's when you have a systemdisc2?

So somehow the information of the systemdisc2 remains in the Dreamcast; untill you power-cycle the system.

 

If you mean replacing the SD2 where a retail would be to get the TOC, no that doesnt work.

Anyway to give an update, Ill be getting an SCART cable instead (VGA capturing didnt work out as planned) so the guide should be done in a little while.

 

I think he means inserting the SD2, booting the GD-R, returning to the Dreamcast menu, inserting a dumping program, and dump the GD-R as if it were a GD-ROM.