Old 26-03-2005   #1
CD Freaks Rookie
 
Join Date: Nov 2004
Posts: 43
Sega Saturn copy protection

Hiya,

While I am certainly no authority on either the internal workings of the Sega Saturn or the nitty-gritty details of CD encoding, I am very interested in the topic of the Saturn's copy protection (a ring on the outer edge of the disc which until now has been considered impossible to reproduce).

Over at SegaXtreme's forums, there is a discussion going on about said protection. One member claims that he has intercepted the data which the Saturn mod chip sends to the CD controller in order to allow copied discs (and as such, those without the security ring) to boot. There is data up which apparently represents the data which the mod chip sends.

I am just posting this topic to ask that anyone who can possiblly offer information or assistance in investigating the protection and potential methods of determining and/or circumventing it, takes a read through the topic. It is long, but it would be great if somebody from here could offer some help - I know that a lot of you certainly know your stuff!

The address of the topic is http://forums.segaxtreme.net/index.php?showtopic=15520. Thank you in advance for any help - both from this technically-inferior fan and the SegaXtreme community!
Drenholm is offline   Reply With Quote
Old 27-03-2005   #2
Copy Protection Detective
 
kalas's Avatar
 
Join Date: Feb 2004
Location: riot hq
Posts: 2,451
Re: Sega Saturn copy protection

I think you might be looking for this thread Drenholm Copy Protections SEGA SATURN .
kalas is offline   Reply With Quote
Old 27-03-2005   #3
CD Freaks Rookie
 
Join Date: Nov 2004
Posts: 43
Re: Sega Saturn copy protection

Thanks for the link; I have briefly read that topic before. What I meant was that a member at SegaXtreme claims to have the security code itself, or at least some semblance of it. I hoped that there may be people here who could do something along the lines of confirming the accuracy of the code he intercepted from the modchip or reporting any past experiences they have had.

I can't say whether his report of his own 'reading' of the security code is correct or not, or whether the subsequent debate on that same topic about burning the code will produce anything or not. I was just hoping that somebody here might be able to further help the discussion along!

Thanks again.
Drenholm is offline   Reply With Quote
Old 28-03-2005   #4
New on Forum
 
Join Date: Mar 2005
Posts: 2
Re: Sega Saturn copy protection

To make it a bit easier:

Quote:
Originally Posted by Pinchy,Mon, 2005-03-21 @ 11:51 AM
there might be a chance in hell for you guys
Ive always wondered what the data if any was out there and from snooping the CD data bus it seems to be just mode 2 sector data with a repeating pattern that results in the same EFM pattern that gives it that 'barcode' look.

This is what the modchip does is insert this fake sector data when it tells the pickup sled to move out there.

heres some data:
Code:
actaul "ring" data from a game:
0000:  00 FF FF FF-FF FF FF FF-FF FF FF 00-71 C0 71 62  ............q.qb
0010:  00 28 28 1E-80 08 48 06-59 59 59 59-59 59 59 59  .((...H.YYYYYYYY
0020:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0030:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0040:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0050:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0060:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0070:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
...
00B0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
00C0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
00D0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
00E0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
00F0:  59 59 59 59-59 59 59 59-59 59 59 59-59 59 59 59  YYYYYYYYYYYYYYYY
0100:  59 59 59 59-59 59 59 59-59 59 59 59-72 DD E5 99  YYYYYYYYYYYYr...

descrambled:
0000:  00 FF FF FF-FF FF FF FF-FF FF FF 00-70 40 71 02  ............p@q.
0010:  00 00 28 00-00 00 28 00-F1 5B A7 D8-D9 39 39 71  ..(...(..[...99q
0020:  71 47 C7 D1-31 3F F7 F3-A5 26 58 B9-59 11 59 6F  qG..1?...&X.Y.Yo
0030:  D9 4F B9 57-91 5D 0F DA-27 B8 B9 11-11 6F EF CF  .O.W.]..'....o..
0040:  AF B7 9F 95-0B 8C A4 C6-58 F1 59 27-D9 79 39 41  ........X.Y'.y9A
0050:  71 53 C7 DE-71 3B C7 F0-F1 27 A7 F9-19 21 69 7B  qS..q;...'...!i{
0060:  CD 40 F6 13-A5 6E 58 8F-D9 07 B9 61-11 4B EF D4  .@...nX....a.K..
0070:  EF BC EF 92-6F 8E 0F 87-E7 81 29 03-FD 62 62 0A  ....o.....)..bb.
0080:  0A 24 A4 B8-D8 D1 39 3F-F1 73 A7 C6-59 31 59 77  .$....9?.s..Y1Yw
...
0050:  79 52 01 5E-23 DB FA 78-E0 81 2B 83-FC C2 62 72  yR.^#..x..+...br
0060:  0A 06 24 A1-78 DB C1 38-F3 F1 26 67-F9 49 21 55  ..$.x..8..&g.I!U
0070:  7B DC 80 FA-43 A0 92 5B-8E 18 C7 E9-31 2D 77 FE  {...C..[....1-w.
0080:  05 23 E0 BA-6B 90 8C CF-86 77 81 45-03 D0 A2 7F  .#..k....w.E...⌂
0090:  9A 03 88 A2-45 1A 10 A8-AF 9D 1F 8A-00 00 00 00  ....E...........

start of modchip data:
0000:  00 FF FF FF-FF FF FF FF-FF FF FF 00-71 82 02 62  ............q..b
0010:  00 28 28 1E-80 08 48 06-A0 66 A0 66-A8 59 A8 59  .((...H..f.f.Y.Y
0020:  A8 59 A8 59-A8 59 A8 59-A8 59 A8 59-A8 59 A8 59  .Y.Y.Y.Y.Y.Y.Y.Y
.... repeats, ends with:
0020:  A8 59 A8 59-A8 59 A8 59-A8 59 A8 59-A8 59 A8 59  .Y.Y.Y.Y.Y.Y.Y.Y
0030:  A8 59 A8 59-A8 59 A8 59-A8 59 A8 59-72 DD E5 99  .Y.Y.Y.Y.Y.Yr...
descrambled:
0000:  00 FF FF FF-FF FF FF FF-FF FF FF 00-70 02 02 02  ............p...
0010:  00 00 28 00-00 00 28 00-08 64 5E E7-28 39 C8 71  ..(...(..d^.(9.q
0020:  80 47 36 D1-C0 3F 06 F3-54 26 A9 B9-A8 11 A8 6F  .G6..?..T&.....o
ive noticed that the modchip generates some default MSF times where it will start at 70:02:00 and increment the count until the saturn doesnt request any more.

Im willing to take a gander that you could probably take some game image and tack on some mode 2 sectors in the format above till it reaches out to 80:00:00 or how ever far you can get
it to cover the edge
where the sled stops and have it pass the the ring check.

Im not going to try to burn some CD's myself but ill provide the info of the data thats out there. I just wanted to add some hard data to thread bucket since some cd burning expert out there might make some use of it.

take note of the scrambled and descrambled differnce, seem that all CD drives do the actual scrambling of data mode 1,2 type sectors internally to the drive. i.e. when you read it descrambles it and when you write it scrambles it internally. the ecma docs describe the algorithm.

Ive figured out a lot of how the modchip works and the protocol.Ill see if i can dig up the old homebrew modchip thread or make a new one and put some more info there.
[snapback]139999[/snapback]
Quote:
Originally Posted by Pinchy,Wed, 2005-03-23 @ 11:19 AM
It shouldnt require new fimrware. the problem is software. From what im reading you can do the trick with clonecd by creating a custom .ccd format or whatever it is they use, but im not keen on drag and drop pushbutton windows garbage.

When doing DAO the software reads the bin/iso/cue sheet and determines what data to put in the subchannel on the TOC/lead-in and writes it. The problem im having is that I can add the necessary sector data to the file and burn it, the saturn will read it just fine, it just that it seems to check the length of track data and if its runs out to where the ring data is then it calls it unsuitable.

It would be nice if the cue sheet would support a toc section, have one set of rules to govern the track layout and another to say what you want the TOC to have.

It seems the protection relies on fact that most all drives rely on the toc to know where data is and what format. If for example the toc says the last track ends at 55minutes then it simply wont let you try to seek out farther than that. The saturn cd DSP allows you to control the stepper motor directly and move anywhere.

Theres one last check I want to try and if anyone else is interested is to take any saturn image and pad it out with all zero's to about 75minutes (or 80 if you have some of that media) and see if the drive reports unsuitable or if it does the constant reseeking like it does when you burn it otherwise.

When I take any normally bunred game and try to run it with no modchip it will spin and spin trying its damndest to read some valid data out there at the edge.Then it will give up and report it as only an audio cd. But Ive gotten it to the point where it will seek and return immediately and say unsuitable for this system so I think im making some progress. If by simply putting all zero data out there (blank audio with no data mode sector information) it returns saying unsuitable or audio only then it will confirm a suspicion i have of some extra checks it might be doing internallly.

So yea I lied , i am willing to burn some coasters, it was just too tempting with 4 in the can im going to put efforts toward a tool for the job. cdrdao modifications look tempting but not very rewarding.
[snapback]140082[/snapback]
Quote:
Originally Posted by Pinchy,Fri, 2005-03-25 @ 07:06 AM
Quote:
Originally Posted by ExCyber,Thu, 2005-03-24 @ 04:51 PM
I tried this a couple years ago, more or less. I'm not sure exactly what you mean, but it did not lose tracking (= spin up way too fast) as it does with most games, it acts pretty sanely and the pickup kicks around on the outside for a while, presumably trying to read the signature. After a little while it eventually popped up with "Game disc unsuitable for this system"). This is from memory so details may be wrong...
[snapback]140156[/snapback]
Interesting. You say it spent some time seeking out there but not too long? and you sure it came back and said unsuitable or just listed the tracks (calling it audio instead).

From what ive burned with the 0x59 data it seeks and returns immediately to center then seeks out again and returns again. all this happens in like less than 5 seconds. I havent tried doing the ox59 0xA8 in a sector yet. this is what the modchip produces and know im pretty sure i know why.

Ive observed from the actaul game ring that the sector would contain some 0xA8 and 0x59 data mixed. sort of like a dirty sector as compared to the the pure 0x59 sectors that you mostly see. im sure you have noticed the sega string imprinted in the ring and its comes from the 0xA8 and 0x59 data, thats how you can produce the image that is there from the 2 EFM patterns.

Like i said before, 0xA8 and 0x59 are in a sense 'opposite' efm patterns. im not going to pull the emf table out again... on second thought just to clarify::

10000000000100 $59 EFM
01001001001001 $A8 EFM
and you all know a 1 signifies a change in the pit surface. So one will produce little pit change and the other a lot making it very visible to the naked eye.

so they use these bytes in the sector to draw the image/text whatever.Im sure as a judge on this!

Since the data will be the same for all rings trying to do a byte by byte comparison would be too expensive for the console so they just look fir sine A8 and 59 data and this is what the modchip does by producing a sector with pure alternating a8 59 data. the saturn sees this and is happy.

The saturn im sure also checks to make sure the header data and MSF data jives.
just to clarify:
00 FF FF FF-FF FF FF FF-FF FF FF 00
is the sync header for all mode 0,1,2 data sector followed by 3 bytes MSF and 1 byte mode type (0,1,2) then followed by payload data.

bytes 12 through 2352 are then scrambled with a XOR key. It would do you all a world of good to read the ECMA130 docs since a lot of people seem to talk nonsense on CD technology, im certainly no expert but the stuff aint rocket science either.

Again, if we can burn a disc with this appropriate mode2 sector data at the end without that information in the toc then youll have your bootable CD.

What would be kewl is actaully be able to recreate the sega logo, which is certainly possible but with these high speed drives dont know how accurate they can maintain pit length to be any good

On a side note, calculating a position on a CD requires some moderatly heavy duty math from what I hear since its a spiral and you know the sector length will fixed length due to CLV but I digress.

Over
[snapback]140180[/snapback]

Quote:
Originally Posted by Pinchy,Sat, 2005-03-26 @ 05:58 AM
Yea I did some looking around and its all true. This is exactly how that old yamaha burner T@2 works. Its really more of a software thing then a speciality of the burner. I think that drive might actaully provide some extra fine control of its scanning velocity than other drives but the real trick is the calculation of the sector data.

calculating the position on the spiral is one thing but the other is that audio bytes in one sector are not stored consecutively but are interleaved and can be as far away as IIRC 108 frames or as much as 2 sectors. They have some detailed discussions on cdfreaks forums about the layout of audio data. Anyways just thinking about how to make the algorithm will simply make yer head explode.

Im waiting of some cd burning experts to come forward about how to burn this disc. I want some verification as to what controls the TOC data when a disc is burned DAO method. Im pretty sure its controlled or can be controlled from software.

I took a look at some audio discs laying around and saw some had watermarks in the TOC area since toc doesnt contain audio data only subcode, looks like they draw some text same way as mentioned. interesting.
[snapback]140223[/snapback]

I hope I got most of the relevant info. It's annoying that the SegaXtreme forums don't allow quotes within quotes.

EDIT: Reading those italics hurt.
Untamed is offline   Reply With Quote
Old 28-03-2005   #5
CD Freaks Rookie
 
Join Date: Nov 2004
Posts: 43
Re: Sega Saturn copy protection

Thank you very much, Untamed - I should have done that sooner myself.

Hope Untamed's info helps!
Drenholm is offline   Reply With Quote
Old 29-03-2005   #6
New on Forum
 
Join Date: Mar 2005
Posts: 2
Re: Sega Saturn copy protection

Bump. I guess not.

Dren, I registered at three forums (ASSEMblerGames, SegaXtreme, and this one) just to do this. :P
Untamed is offline   Reply With Quote
Old 29-03-2005   #7
CD Freaks Rookie
 
Join Date: Nov 2004
Posts: 43
Re: Sega Saturn copy protection

It's a shame, huh? However, there has already been considerably activity at the SegaXtreme topic, so I'd advice you to keep a look out.
Drenholm is offline   Reply With Quote
Old 29-03-2005   #8
CD Freaks Rookie
 
Join Date: Nov 2004
Posts: 43
Re: Sega Saturn copy protection

I think these features of Truman's tool could prove interesting, at the very least:

Quote:
This version adds an additional feature: the ability to specify starting position (expressed in LBA) when writing data to CD. It will allow you to tell the writer to start writing the lead-in at any position you specify. This will allow you to skip a portion of blank space at the beginning of the CDR/W. Example, if you specify -200, then you will end up with a blank gap where the lead-in should normally be - in other words the lead-in and all data following are shifted ahead.
Quote:
Added a skip sector position file support in the 'Image To CD' area. The file is a text file with a list of starting sector and length to skip for the blank areas you wish to be on the CD (this means no EMF data is written in those areas). The format is as follows:

starting sector in LBA unit,skip length

Example file skip.ssp:

100,150
200,10
300,50

The first line means don't write anything at sector position 100 for 150 sectors. The second line means don't write anything at sector position 200 for 10 sectors.
I have yet to read further about this tool, but it seems very interesting and well made. Thanks, Truman!

Edit: Missed out the T from the word This in the first quote

Last edited by Drenholm; 29-03-2005 at 14:03. Reason: Missed out the T from the word This in the first quote
Drenholm is offline   Reply With Quote
Old 04-04-2005   #9
New on Forum
 
Join Date: Aug 2004
Posts: 12
Re: Sega Saturn copy protection

Wow! There is still some activity in this topic! I thought that saturn fans have already forgoten this topic...
A big thanx to untamed and drenholm! Keep up the good work !
It's a shame but I can't help you guys... because of a very simple reason : I have a lack of knowlege in this thing...
Cikotils is offline   Reply With Quote
Old 07-04-2005   #10
CD Freaks Member
 
Join Date: Oct 2002
Posts: 107
Re: Sega Saturn copy protection

Normally the carts that let you play games from another region allow you to boot games off of CD-Rs. I know mine claimed to do it however I have never tried.
__________________
sXe
RaMDaY is offline   Reply With Quote
Old 23-09-2007   #11
New on Forum
 
Join Date: Sep 2007
Posts: 1
Re: Sega Saturn copy protection

Ok sure this post is 2 years old or whatever... but its 4am and i'll help ya out.

Sega Saturn is the easiest mod ever to play burned games... burn the discs on nero (i forget the exact method)... it doesnt copy the "ring" as i dont think that is possible... BUT... on the lid of your SS there is a rod that pushes a button when the lid is closed... basically mod this button so its pushed down all the time

your sega will think the lid is closed even when its open.

Put in a normal cd to boot... the disc will spin real fast then slow down... when you see it slow down.. take it out and put your burned one in. There ya go... playing a burned game with no mod chip or soldering..

When it spins fast its reading the security ring, swap ur disc and ur good to go.
tuxy is offline   Reply With Quote
Old 07-01-2009   #12
New on Forum
 
Join Date: Apr 2007
Posts: 6
Re: Sega Saturn copy protection

wow, i'm sorry but you're dumb, because everyone in this thread would have known that. also this thread is about not having to swap the discs, etc.
it's about being able to recreate the information of the ring at the edge of the disc, so that we can all play without having to swap (as swapping discs can cause laser wearout).
Vorde is offline   Reply With Quote
Reply


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Copy Protections SEGA SATURN Quakester2000 CD, DVD and Blu-ray Writers 442 02-07-2014 18:43
SEGA Dreamcast 'GD-ROM': Really just an old GigaRec-style thing + Saturn protection? adam917 CD, DVD and Blu-ray Writers 6 20-04-2007 02:27
Cracking Sega Saturn Copy Protection VitalFrag Copy Protection 0 13-03-2006 20:49
Copy Protections SEGA SATURN - Soundcard & IDE Drenholm CD, DVD and Blu-ray Writers 12 08-04-2005 17:35


All times are GMT +2. The time now is 12:42.
Top