Sega Saturn Copy Protection. Break it get $800

Calpis · Mar 15, 2005

I don't think you've seen the code. As far as I know, the only people with the modchip code are the factories producing them. I remembered why we have PSX PIC source now, it's because of a guy who reverse engineered (ended up making a functional clone) of the original mods and ported the code to the cheaper 12C508.

The code you have from Sega may be just a boot descriptor thing, not the security track (it's not a ring) As shown by Ricky's DIY system discs, the saturn doesn't use it's subcode for security as PSX does.

Untamed · Mar 27, 2005

Maybe this will help. From more recent posts on the SegaXtreme forum.
Pinchy said: ↑
there might be a chance in hell for you guys
Ive always wondered what the data if any was out there and from snooping the CD data bus it seems to be just mode 2 sector data with a repeating pattern that results in the same EFM pattern that gives it that 'barcode' look.

This is what the modchip does is insert this fake sector data when it tells the pickup sled to move out there.

heres some data:
Code:
actaul "ring" data from a game:
0000:  00 FF FF FF-FF FF FF FF-FF FF FF 00-71 C0 71 62  ............q.qb
0010:  00 28 28 1E-80 08 48 06-59 59 59 59-59 59 59 59  .((...H.YYYYYYYY
0020:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0030:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0040:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0050:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0060:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0070:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
...
00B0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
00C0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
00D0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
00E0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
00F0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0100:  59 59 59 59-59 59 59 59-59 59 59 59-72 DD E5 99  YYYYYYYYYYYYr...

descrambled:
0000:  00 FF FF FF-FF FF FF FF-FF FF FF 00-70 40 71 02  ............p@q.
0010:  00 00 28 00-00 00 28 00-F1 5B A7 D8-D9 39 39 71  ..(...(..[...99q
0020:  71 47 C7 D1-31 3F F7 F3-A5 26 58 B9-59 11 59 6F  qG..1?...&X.Y.Yo
0030:  D9 4F B9 57-91 5D 0F DA-27 B8 B9 11-11 6F EF CF  .O.W.]..'....o..
0040:  AF B7 9F 95-0B 8C A4 C6-58 F1 59 27-D9 79 39 41  ........X.Y'.y9A
0050:  71 53 C7 DE-71 3B C7 F0-F1 27 A7 F9-19 21 69 7B  qS..q;...'...!i{
0060:  CD 40 F6 13-A5 6E 58 8F-D9 07 B9 61-11 4B EF D4  .@...nX....a.K..
0070:  EF BC EF 92-6F 8E 0F 87-E7 81 29 03-FD 62 62 0A  ....o.....)..bb.
0080:  0A 24 A4 B8-D8 D1 39 3F-F1 73 A7 C6-59 31 59 77  .$....9?.s..Y1Yw
...
0050:  79 52 01 5E-23 DB FA 78-E0 81 2B 83-FC C2 62 72  yR.^#..x..+...br
0060:  0A 06 24 A1-78 DB C1 38-F3 F1 26 67-F9 49 21 55  ..$.x..8..&g.I!U
0070:  7B DC 80 FA-43 A0 92 5B-8E 18 C7 E9-31 2D 77 FE  {...C..[....1-w.
0080:  05 23 E0 BA-6B 90 8C CF-86 77 81 45-03 D0 A2 7F  .#..k....w.E...⌂
0090:  9A 03 88 A2-45 1A 10 A8-AF 9D 1F 8A-00 00 00 00  ....E...........

start of modchip data:
0000:  00 FF FF FF-FF FF FF FF-FF FF FF 00-71 82 02 62  ............q..b
0010:  00 28 28 1E-80 08 48 06-A0 66 A0 66-A8 59 A8 59  .((...H..f.f.Y.Y
0020:  A8 59 A8 59-A8 59 A8 59-A8 59 A8 59-A8 59 A8 59  .Y.Y.Y.Y.Y.Y.Y.Y
.... repeats, ends with:
0020:  A8 59 A8 59-A8 59 A8 59-A8 59 A8 59-A8 59 A8 59  .Y.Y.Y.Y.Y.Y.Y.Y
0030:  A8 59 A8 59-A8 59 A8 59-A8 59 A8 59-72 DD E5 99  .Y.Y.Y.Y.Y.Yr...
descrambled:
0000:  00 FF FF FF-FF FF FF FF-FF FF FF 00-70 02 02 02  ............p...
0010:  00 00 28 00-00 00 28 00-08 64 5E E7-28 39 C8 71  ..(...(..d^.(9.q
0020:  80 47 36 D1-C0 3F 06 F3-54 26 A9 B9-A8 11 A8 6F  .G6..?..T&.....o
ive noticed that the modchip generates some default MSF times where it will start at 70:02:00 and increment the count until the saturn doesnt request any more.

Im willing to take a gander that you could probably take some game image and tack on some mode 2 sectors in the format above till it reaches out to 80:00:00 or how ever far you can get
it to cover the edge
where the sled stops and have it pass the the ring check.

Im not going to try to burn some CD's myself but ill provide the info of the data thats out there. I just wanted to add some hard data to thread bucket since some cd burning expert out there might make some use of it.

take note of the scrambled and descrambled differnce, seem that all CD drives do the actual scrambling of data mode 1,2 type sectors internally to the drive. i.e. when you read it descrambles it and when you write it scrambles it internally. the ecma docs describe the algorithm.

Ive figured out a lot of how the modchip works and the protocol.Ill see if i can dig up the old homebrew modchip thread or make a new one and put some more info there.

[snapback]139999[/snapback]
Click to expand...
Pinchy said: ↑

It shouldnt require new fimrware. the problem is software. From what im reading you can do the trick with clonecd by creating a custom .ccd format or whatever it is they use, but im not keen on drag and drop pushbutton windows garbage.

When doing DAO the software reads the bin/iso/cue sheet and determines what data to put in the subchannel on the TOC/lead-in and writes it. The problem im having is that I can add the necessary sector data to the file and burn it, the saturn will read it just fine, it just that it seems to check the length of track data and if its runs out to where the ring data is then it calls it unsuitable.

It would be nice if the cue sheet would support a toc section, have one set of rules to govern the track layout and another to say what you want the TOC to have.

It seems the protection relies on fact that most all drives rely on the toc to know where data is and what format. If for example the toc says the last track ends at 55minutes then it simply wont let you try to seek out farther than that. The saturn cd DSP allows you to control the stepper motor directly and move anywhere.

Theres one last check I want to try and if anyone else is interested is to take any saturn image and pad it out with all zero's to about 75minutes (or 80 if you have some of that media) and see if the drive reports unsuitable or if it does the constant reseeking like it does when you burn it otherwise.

When I take any normally bunred game and try to run it with no modchip it will spin and spin trying its damndest to read some valid data out there at the edge.Then it will give up and report it as only an audio cd. But Ive gotten it to the point where it will seek and return immediately and say unsuitable for this system so I think im making some progress. If by simply putting all zero data out there (blank audio with no data mode sector information) it returns saying unsuitable or audio only then it will confirm a suspicion i have of some extra checks it might be doing internallly.

So yea I lied , i am willing to burn some coasters, it was just too tempting with 4 in the can im going to put efforts toward a tool for the job. cdrdao modifications look tempting but not very rewarding.

[snapback]140082[/snapback]
Click to expand...

Pinchy said: ↑

ExCyber said: ↑

I tried this a couple years ago, more or less. I'm not sure exactly what you mean, but it did not lose tracking (= spin up way too fast) as it does with most games, it acts pretty sanely and the pickup kicks around on the outside for a while, presumably trying to read the signature. After a little while it eventually popped up with "Game disc unsuitable for this system"). This is from memory so details may be wrong...

[snapback]140156[/snapback]
Click to expand...

Interesting. You say it spent some time seeking out there but not too long? and you sure it came back and said unsuitable or just listed the tracks (calling it audio instead).

From what ive burned with the 0x59 data it seeks and returns immediately to center then seeks out again and returns again. all this happens in like less than 5 seconds. I havent tried doing the ox59 0xA8 in a sector yet. this is what the modchip produces and know im pretty sure i know why.

Ive observed from the actaul game ring that the sector would contain some 0xA8 and 0x59 data mixed. sort of like a dirty sector as compared to the the pure 0x59 sectors that you mostly see. im sure you have noticed the sega string imprinted in the ring and its comes from the 0xA8 and 0x59 data, thats how you can produce the image that is there from the 2 EFM patterns.

Like i said before, 0xA8 and 0x59 are in a sense 'opposite' efm patterns. im not going to pull the emf table out again... on second thought just to clarify::

10000000000100 $59 EFM
01001001001001 $A8 EFM
and you all know a 1 signifies a change in the pit surface. So one will produce little pit change and the other a lot making it very visible to the naked eye.

so they use these bytes in the sector to draw the image/text whatever.Im sure as a judge on this!

Since the data will be the same for all rings trying to do a byte by byte comparison would be too expensive for the console so they just look fir sine A8 and 59 data and this is what the modchip does by producing a sector with pure alternating a8 59 data. the saturn sees this and is happy.

The saturn im sure also checks to make sure the header data and MSF data jives.
just to clarify:
00 FF FF FF-FF FF FF FF-FF FF FF 00
is the sync header for all mode 0,1,2 data sector followed by 3 bytes MSF and 1 byte mode type (0,1,2) then followed by payload data.

bytes 12 through 2352 are then scrambled with a XOR key. It would do you all a world of good to read the ECMA130 docs since a lot of people seem to talk nonsense on CD technology, im certainly no expert but the stuff aint rocket science either.

Again, if we can burn a disc with this appropriate mode2 sector data at the end without that information in the toc then youll have your bootable CD.

What would be kewl is actaully be able to recreate the sega logo, which is certainly possible but with these high speed drives dont know how accurate they can maintain pit length to be any good

On a side note, calculating a position on a CD requires some moderatly heavy duty math from what I hear since its a spiral and you know the sector length will fixed length due to CLV but I digress.

Over

[snapback]140180[/snapback]
Click to expand...

Pinchy said: ↑

Yea I did some looking around and its all true. This is exactly how that old yamaha burner T@2 works. Its really more of a software thing then a speciality of the burner. I think that drive might actaully provide some extra fine control of its scanning velocity than other drives but the real trick is the calculation of the sector data.

calculating the position on the spiral is one thing but the other is that audio bytes in one sector are not stored consecutively but are interleaved and can be as far away as IIRC 108 frames or as much as 2 sectors. They have some detailed discussions on cdfreaks forums about the layout of audio data. Anyways just thinking about how to make the algorithm will simply make yer head explode.

Im waiting of some cd burning experts to come forward about how to burn this disc. I want some verification as to what controls the TOC data when a disc is burned DAO method. Im pretty sure its controlled or can be controlled from software.

I took a look at some audio discs laying around and saw some had watermarks in the TOC area since toc doesnt contain audio data only subcode, looks like they draw some text same way as mentioned. interesting.

[snapback]140223[/snapback]
Click to expand...

I hope I got most of the relevant info. It's annoying that the SegaXtreme forums don't allow quotes within quotes.

Calpis · Mar 27, 2005

It's a great post, finally someone who knows how the mod works

Quakester2000 · Mar 31, 2005

Intresting post about disc swapping with a pc dvd drive and reading back. Sounds promising.

http://forums.segaxtreme.net/index.php?showtopic=15520&st=210#

Quakester2000 · Apr 4, 2005

Two people have now ripped the saturns security track with the disc swap method. Looks promising.

AntiPasta · Apr 4, 2005

w00t!

madhatter256 · Apr 4, 2005

Is the $800 USD curreny or 800 yen? Post the results AND the ways in making a security ring or have it where anybody doesn't need a modchip and properly burn CDRs.

Alchy · Apr 4, 2005

Just because they can now read the security ring doesn't mean they can burn it, much less convince the Saturn it's authentic

Good going nevertheless.

Quakester2000 · Apr 4, 2005

Alchy said:

Just because they can now read the security ring doesn't mean they can burn it, much less convince the Saturn it's authentic

Good going nevertheless.
Click to expand...

Thats where the stumbling block is currently residing how to burn it to the right location.

Segafreak_NL · Apr 4, 2005

madhatter256 said:

Is the $800 USD curreny or 800 yen? Post the results AND the ways in making a security ring or have it where anybody doesn't need a modchip and properly burn CDRs.
Click to expand...

LoL it's $800, 800 yen would be silly.

Quakester2000 · Apr 5, 2005

The saturn ring protection has been dumped i have a copy of it, it does have an intersting pattern but burning it back will the hard part.

kortex · Apr 5, 2005

Hi people! I ripped the sega saturn identification code (security track) one year ago, i used a 80 min cd mode 2 2352 and with hot swap (how i rip dc games using a cd drive), i though in make a multisession cd with the boot cd for sega saturn (system disc) and make a last session with the secury track's lba, but i was very busy i forgot try it.

Quakester2000 · Apr 5, 2005

kortex said:

Hi people! I ripped the sega saturn identification code (security track) one year ago, i used a 80 min cd mode 2 2352 and with hot swap (how i rip dc games using a cd drive), i though in make a multisession cd with the boot cd for sega saturn (system disc) and make a last session with the secury track's lba, but i was very busy i forgot try it.
Click to expand...

Any chance you can give a link / upload so i can compare data between the two.

kortex · Apr 5, 2005

Hi! sorry for not put the link, i forgot write it.

Here the files: url was remove, Quakester2000 i send you a pm with the url

Sorry if my english isn't good ahh the nfo file are in spanish, if you need help, i can traslate it to english, but basically i say that the start lba is 297633 (before cdrwin gave me error) and the final lba is 328350 because if you read more you find empty lbas, other thing that i wrote is that the method that maybe work is making a multisesion cd (mode 2) with the system disc (for boot copies) and the last sesion start in 297633 ( why?) and this sesion have the code, but maybe don't work (sure ), other thing that i wrote is the posibility for make a modchip (disassembling code and see how work). I hope that the my code will be useful.
Cheers

(if my code is useful... i want my part of the 800 $ hahaha)

Quakester2000 · Apr 5, 2005

kortex said:

(if my code is useful... i want my part of the 800 $ hahaha)
Click to expand...

Make sure you post your findings at sega extreme as the members on that board that are offering the reward.

kortex · Apr 6, 2005

Hi, sega extreme is offline and i cannot enter in the forum. I sent you a pm with some information
Cheers

Drenholm · Apr 6, 2005

Uploads of Pinchy's ring data dumps!

Go to gmail.com and enter the following details:

User name: drenholm.uploads
Password: Drenholm

RING_data.zip = Pinchy's main ring data read, not sure what format (says raw)
ring_data_sub.zip = Pinchy's subchannel data read, not sure if interleaved

Enjoy, and investigate to the full!

And don't use my uploads account for anything else - if you want a Gmail invite, simply ask me and I'll send you a proper one.

Zilog Jones · Apr 6, 2005

Haa haa, i knew someone would abuse Gmail eventually! Good work! :smt023

AntiPasta · Apr 6, 2005

Gmail-drive ring a bell? Mount your Gmail as filesystem in Linux

Quakester2000 · Apr 6, 2005

Drenholm said:

Uploads of Pinchy's ring data dumps!

Go to gmail.com and enter the following details:

User name: drenholm.uploads
Password: Drenholm

RING_data.zip = Pinchy's main ring data read, not sure what format (says raw)
ring_data_sub.zip = Pinchy's subchannel data read, not sure if interleaved

Enjoy, and investigate to the full!

And don't use my uploads account for anything else - if you want a Gmail invite, simply ask me and I'll send you a proper one.
Click to expand...

Dont forget it was created with Truemans tool so you can get the tool at

http://www.cdtool.pwp.blueyonder.co.uk/

Sega Saturn Copy Protection. Break it get $800

Calpis Champion of the Forum

Untamed Guest

Calpis Champion of the Forum

Quakester2000 Guest

Quakester2000 Guest

AntiPasta Guest

madhatter256 Illustrious Member

Alchy Illustrious Member

Quakester2000 Guest

Segafreak_NL v2.0 New and improved. Site supporter 2012-15

Quakester2000 Guest

kortex Rising Member

Quakester2000 Guest

kortex Rising Member

Quakester2000 Guest

kortex Rising Member

Drenholm Guest

Zilog Jones Familiar Face

AntiPasta Guest

Quakester2000 Guest

Share This Page

Sega Saturn Copy Protection. Break it get $800

Calpis Champion of the Forum

Untamed Guest

Calpis Champion of the Forum

Quakester2000 Guest

Quakester2000 Guest

AntiPasta Guest

madhatter256 Illustrious Member

Alchy Illustrious Member

Quakester2000 Guest

Segafreak_NL v2.0 New and improved. Site supporter 2012-15

Quakester2000 Guest

kortex Rising Member

Quakester2000 Guest

kortex Rising Member

Quakester2000 Guest

kortex Rising Member

Drenholm Guest

Zilog Jones Familiar Face

AntiPasta Guest

Quakester2000 Guest

Share This Page

Useful Searches