Naomi CF boot - Revision history

Invzim at 20:38, 1 August 2013

2013-08-01T20:38:44Z

← Older revision		Revision as of 20:38, 1 August 2013
Line 13:		Line 13:

	===Step 1 - get the seed key===		===Step 1 - get the seed key===
	All ATA devices have a 512 byte structure that contains among other things, a 20 byte serial number represented in ASCII. The 3rd and 4th to the last ASCII characters, in hex, is used as the seed in this protection scheme/maze (offset 0x24 and 0x25 in the 512 byte block). Since the block is defined as 16bit words, the ascii characters are for some reason swapped, ABCDEFGH would be stored as BADCFEHG. Smartctl, part of the [http://sourceforge.net/projects/smartmontools/ S.M.A.R.T. Monitoring Tools] can read the serial number. It comes with all Linux distributions, and is also available for Windows. In the example below, 0x3037 is the seed key we're looking for.		All ATA devices have a 512 byte structure that contains among other things, a 20 byte serial number represented in ASCII. The 3rd and 4th to the last ASCII characters, in hex, is used as the seed in this protection scheme/maze (offset 0x24 and 0x25 in the 512 byte block, or in desimal - offset 36 & 37). Since the block is defined as 16bit words, the ascii characters are for some reason swapped, ABCDEFGH would be stored as BADCFEHG. Smartctl, part of the [http://sourceforge.net/projects/smartmontools/ S.M.A.R.T. Monitoring Tools] can read the serial number. It comes with all Linux distributions, and is also available for Windows. In the example below, 0x3037 is the seed key we're looking for.

			This number, is also what you need to input into various tools that prepare the CF card for you.

	====Get part of serial number with smartctl====		====Get part of serial number with smartctl====

Invzim: /* References */

2011-08-12T18:25:54Z

References

← Older revision		Revision as of 18:25, 12 August 2011
Line 90:		Line 90:
	http://averstak.tripod.com/fatdox/bootsec.htm		http://averstak.tripod.com/fatdox/bootsec.htm

	[http://notinmame.blogspot.com/2011/04/happy-easter.html\| 4.02 Firmware]		[http://notinmame.blogspot.com/2011/04/happy-easter.html 4.02 Firmware]

Mr.pink: /* References */

2011-07-31T09:05:03Z

References

← Older revision		Revision as of 09:05, 31 July 2011
Line 89:		Line 89:

	http://averstak.tripod.com/fatdox/bootsec.htm		http://averstak.tripod.com/fatdox/bootsec.htm

			[http://notinmame.blogspot.com/2011/04/happy-easter.html\| 4.02 Firmware]

Invzim: /* References */

2011-05-06T13:08:32Z

References

← Older revision		Revision as of 13:08, 6 May 2011
Line 87:		Line 87:
	==References==		==References==
	http://www.compuphase.com/mbr_fat.htm		http://www.compuphase.com/mbr_fat.htm

			http://averstak.tripod.com/fatdox/bootsec.htm

Invzim at 22:48, 5 May 2011

2011-05-05T22:48:07Z

← Older revision		Revision as of 22:48, 5 May 2011
Line 85:		Line 85:
	#This value must match the 32-bit dword stored at offset 0x38 in sector 0x1D7.		#This value must match the 32-bit dword stored at offset 0x38 in sector 0x1D7.
	#The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.]		#The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.]
			==References==
			http://www.compuphase.com/mbr_fat.htm

Mind9 at 03:34, 29 April 2011

2011-04-29T03:34:53Z

← Older revision		Revision as of 03:34, 29 April 2011
Line 83:		Line 83:
	#Use the same two bytes of the serial number as above as a word, but this time add 0x19.		#Use the same two bytes of the serial number as above as a word, but this time add 0x19.
	#Go to that sector, compute a sum of 32-bit dwords, accumulating in a 32-bit dword.		#Go to that sector, compute a sum of 32-bit dwords, accumulating in a 32-bit dword.
	#This value ~~(byteswapped)~~ must match the 32-bit dword stored at offset 0x38 in sector 0x1D7.		#This value must match the 32-bit dword stored at offset 0x38 in sector 0x1D7.
	#The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.]		#The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.]

Mr.pink: Simplified and clarified getting the serial, removed flaky winxp method

2011-04-25T11:01:04Z

Simplified and clarified getting the serial, removed flaky winxp method

@@ Line 13: / Line 13: @@
 ===Step 1 - get the seed key===
-All ATA devices have a 512 byte structure that contains among other things, a 20 byte serial number represented in ASCII.  The 3rd and 4th to the last ASCII characters, in hex, is used as the seed in this protection scheme/maze (offset 0x24 and 0x25 in the 512 byte block).  This is to prevent CF cards from simply being copied.  You can use out-of-the-box utilities in Linux to get this data, but the CF card has to be attached to an actual IDE bus - USB card readers don't support this. In the example below, this seed key is 0x3037 (or ASCII "07").
+All ATA devices have a 512 byte structure that contains among other things, a 20 byte serial number represented in ASCII.  The 3rd and 4th to the last ASCII characters, in hex, is used as the seed in this protection scheme/maze (offset 0x24 and 0x25 in the 512 byte block).  Since the block is defined as 16bit words, the ascii characters are for some reason swapped, ABCDEFGH would be stored as BADCFEHG.  Smartctl, part of the [http://sourceforge.net/projects/smartmontools/ S.M.A.R.T. Monitoring Tools] can read the serial number.  It comes with all Linux distributions, and is also available for Windows.  In the example below, 0x3037 is the seed key we're looking for.
 ====Get part of serial number with smartctl====
@@ Line 29: / Line 29: @@
 -015: 5a 04 ef 03 00 00 10 00 00 00 00 02 3f 00 0f 00 |Z...........?...|
 -031: 10 7d 00 00 31 30 36 31 30 46 39 30 32 43 41 30 |.}..10610F902CA0|
--047: 30 30 30 '''30 37''' 30 36 36 01 00 01 00 04 00 55 59 |000'''07'''066......UY|
+-047: 30 30 30 30 '''37 30''' 36 36 01 00 01 00 04 00 55 59 |0000'''70'''66......UY|
 -063: 4e 41 30 31 36 32 31 35 4d 32 20 42 4b 43 20 53 |NA016215M2 BKC S|
 -079: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |                |
@@ Line 72: / Line 72: @@
   SMART support is: Ambiguous - ATA IDENTIFY DEVICE words 82-83 don't show if SMART supported.
   A mandatory SMART command failed: exiting. To continue, add one or more '-T permissive' options.
 ----

Mr.pink: /* Step 1 - get the magic key */

2011-04-24T22:05:44Z

Step 1 - get the magic key

← Older revision		Revision as of 22:05, 24 April 2011
Line 12:		Line 12:
	For the Naomi, a version of the firmware that bypasses the check for Hagiwara Sys-Com cards exists. This version is "hacked", as the upgrade says 4.02, but the serial port output still reports the version to be gcxb-2.0.0 v4.01/v4.00 on start up.		For the Naomi, a version of the firmware that bypasses the check for Hagiwara Sys-Com cards exists. This version is "hacked", as the upgrade says 4.02, but the serial port output still reports the version to be gcxb-2.0.0 v4.01/v4.00 on start up.

	===Step 1 - get the ~~magic~~ key===		===Step 1 - get the seed key===
	All ATA devices have a 512 byte structure that contains among other things, a 20 byte serial number represented in ASCII. The 3rd and 4th to the last ASCII characters, in hex, is used as the seed in this protection scheme/maze (offset 0x24 and 0x25 in the 512 byte block). This is to prevent CF cards from simply being copied. You can use out-of-the-box utilities in Linux to get this data, but the CF card has to be attached to an actual IDE bus - USB card readers don't support this. In the example below, this seed key is 0x3037 (or ASCII "07").		All ATA devices have a 512 byte structure that contains among other things, a 20 byte serial number represented in ASCII. The 3rd and 4th to the last ASCII characters, in hex, is used as the seed in this protection scheme/maze (offset 0x24 and 0x25 in the 512 byte block). This is to prevent CF cards from simply being copied. You can use out-of-the-box utilities in Linux to get this data, but the CF card has to be attached to an actual IDE bus - USB card readers don't support this. In the example below, this seed key is 0x3037 (or ASCII "07").

	====Get part of serial number with smartctl====		====Get part of serial number with smartctl====
Line 108:		Line 108:
	0000 0000 0000 0000 0000 0000 0000 0000		0000 0000 0000 0000 0000 0000 0000 0000
	0000 0000 0000 0000 0000 0000 0000 0000		0000 0000 0000 0000 0000 0000 0000 0000

			====Get part of the serial number with Windows XP====
			A bit finicky, in "device manager->disk drives->choose CF card->properties->Details->Removal Relations", the serial number is shown between the hashes, byteswapped. Just copy it out to notepad:

			STORAGE\Volume\1&30a96598&0&_??_IDE#Disk512MB_CKS_______________________________YUAN1026
			#31303631304639303243413030303030'''3730'''3636#
			{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

			byteswap it, and you will end up with with '''0x3037'''.

	----		----

Mr.pink at 21:06, 24 April 2011

2011-04-24T21:06:20Z

@@ Line 12: / Line 12: @@
 For the Naomi, a version of the firmware that bypasses the check for Hagiwara Sys-Com cards exists.  This version is "hacked", as the upgrade says 4.02, but the serial port output still reports the version to be gcxb-2.0.0 v4.01/v4.00 on start up.
 ===Step 1 - get the magic key===
 All ATA devices have a 512 byte structure that contains among other things, a 20 byte serial number represented in ASCII.  The 3rd and 4th to the last  ASCII characters, in hex, is used as the seed in this protection scheme/maze (offset 0x24 and 0x25 in the 512 byte block).  This is to prevent CF cards from simply being copied.  You can use out-of-the-box utilities in Linux to get this data, but the CF card has to be attached to an actual IDE bus - USB card readers don't support this. In the example below, this seed key is 0x3037 (or ASCII "07").
@@ Line 121: / Line 108: @@
 0000 0000 0000 0000 0000 0000 0000
 0000 0000 0000 0000 0000 0000 0000

Mr.pink at 21:05, 24 April 2011

2011-04-24T21:05:26Z

@@ Line 15: / Line 15: @@
 ----
-The following is copy/pasted with minor modifications from an unknown source.
+The following started out as something copy/pasted (see document history), and expanded with detail as investigation ensued.
 #Read ATA IDENTIFY DEVICE data.
@@ Line 25: / Line 25: @@
 #This value (byteswapped) must match the 32-bit dword stored at offset 0x38 in sector 0x1D7.
 #The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.]