NAOMI security PIC: Difference between revisions
From pcbotaku
Jump to navigationJump to search
Created page with "boot sequence, normal GD-ROM: 7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 4.028ms 7b7f8587 ..." |
No edit summary |
||
| (15 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
[[category:Hardware]] | |||
[[category:Naomi]] | |||
==PIC Settings== | |||
[[PIC16F628A]] is pin and binary compatible with original security pic's, PIC16C621A/PIC16C622A . | |||
*HS Osc for oscillator setting | |||
*VDD=3.3V | |||
*clkin pin 16 is fed 4.0MHz from PCB | |||
==Tranfering data== | |||
used pins: | |||
*RB0 = bitA | |||
*RB1 = bitB | |||
*RB2 = bitC | |||
*RB3 = clock | |||
A byte is transferred in 3 clock cycles like this: | |||
CYCLE 3 CYCLE2 CYBLE1 | |||
PARITY|BITB|BITA | BITC|BITB|BITA| BITC|BITB|BITA | |||
==Logic analyzer dump== | |||
The following is the output from a program I wrote to decode the traffic between the PIC and the Naomi. The encryption algorithm is pretty well documented in the mame source. | |||
[[image:LA-securitypic.png]] | |||
boot sequence, normal GD-ROM: | boot sequence, normal GD-ROM: | ||
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms | 7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms | ||
| Line 27: | Line 55: | ||
a3d482b8 833bde67 " ; g" 37544553 545f4f4b "7TEST_OK" 180203.656ms | a3d482b8 833bde67 " ; g" 37544553 545f4f4b "7TEST_OK" 180203.656ms | ||
Boot sequence, WCCF | Boot sequence, WCCF - a game loaded via network, only difference is 1 bit in the answer to kaijyo: | ||
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms | 7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms | ||
| Line 47: | Line 75: | ||
f1b46298 636abc7f " b cj " 61746573 74706963 "atestpic" 60055.508ms | f1b46298 636abc7f " b cj " 61746573 74706963 "atestpic" 60055.508ms | ||
a3d482b8 833bde67 " ; g" 37544553 545f4f4b "7TEST_OK" 60059.488ms | a3d482b8 833bde67 " ; g" 37544553 545f4f4b "7TEST_OK" 60059.488ms | ||
"netboot pic", with "network" answer to kaijyo! and a key of all zeroes: | |||
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms | |||
c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 4.029ms | |||
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 29.037ms | |||
c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 33.067ms | |||
bc7b59a4 b391c276 " {Y v" 2177590e 391e3b69 "!wY 9 ;i" 33.581ms | |||
f662284d 3c586acf " b(M<Xj " 3044494d 4d494430 "0DIMMID0" 37.303ms | |||
e46e56af 80b3dd64 " nV d" 22581b2f 312c315f ""X /1,1_" 37.810ms | |||
a1c4869a 9a516ad4 " Qj " 3144494d 4d494431 "1DIMMID1" 41.576ms | |||
af6e833c 1eaedd6a " n < j" 233a442f 312c315f "#:D/1,1_" 42.078ms | |||
a0c4869a 9a51e7ce " Q " 3244494d 4d494432 "2DIMMID2" 45.803ms | |||
d1bd82ae 904be759 " K Y" 414b4559 434f4445 "AKEYCODE" 46.304ms | |||
9f883f65 4f9aa39c " ?eO " 33'''000000 00000000''' "3 " 50.103ms | |||
d09d628e 706bc779 " b pk y" 426b6579 636f6465 "Bkeycode" 50.605ms | |||
a6883f65 4f9aa39c " ?eO " 34'''000000 00000000''' "4 " 54.449ms | |||
e7a7667f 666b84d3 " f fk " 6b61696a 796f213f "kaijyo!?" 59.315ms | |||
98b83c96 4c4ea39d " < LN " 3a701f71 1f4c00'''01''' ":p q L " 63.435ms | |||
==Disassembly of a security PIC== | |||
[http://pastebin.com/Wn33TXMk Taken from MAME] | |||
==References== | |||
http://debugmo.de/2008/05/pah-security/ | |||
http://www.ultimate-console.fr/=-Sega-naomi-1-/-2-=/=-G%C3%A9n%C3%A9rale-=/=-La-S%C3%A9curit%C3%A9-des-GDRoms-Naomi-=.html - great writeup in French | |||
http://mamedev.org/source/src/mame/drivers/naomi.c.html | |||
http://guru.mameworld.info/naomi/index.html | |||
Latest revision as of 19:45, 14 September 2011
PIC Settings[edit]
PIC16F628A is pin and binary compatible with original security pic's, PIC16C621A/PIC16C622A .
- HS Osc for oscillator setting
- VDD=3.3V
- clkin pin 16 is fed 4.0MHz from PCB
Tranfering data[edit]
used pins:
- RB0 = bitA
- RB1 = bitB
- RB2 = bitC
- RB3 = clock
A byte is transferred in 3 clock cycles like this:
CYCLE 3 CYCLE2 CYBLE1 PARITY|BITB|BITA | BITC|BITB|BITA| BITC|BITB|BITA
Logic analyzer dump[edit]
The following is the output from a program I wrote to decode the traffic between the PIC and the Naomi. The encryption algorithm is pretty well documented in the mame source.
Error creating thumbnail: Unable to save thumbnail to destination
boot sequence, normal GD-ROM:
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 4.028ms
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 6.745ms
c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 10.773ms
bc7b59a4 b391c276 " {Y v" 2177590e 391e3b69 "!wY 9 ;i" 11.299ms
f662284d 3c586acf " b(M<Xj " 3044494d 4d494430 "0DIMMID0" 15.021ms
e46e56af 80b3dd64 " nV d" 22581b2f 312c315f ""X /1,1_" 15.532ms
a1c4869a 9a516ad4 " Qj " 3144494d 4d494431 "1DIMMID1" 19.298ms
af6e833c 1eaedd6a " n < j" 233a442f 312c315f "#:D/1,1_" 19.811ms
a0c4869a 9a51e7ce " Q " 3244494d 4d494432 "2DIMMID2" 23.537ms
cf775091 6176c5cc " wP av " 43317374 72646630 "C1strdf0" 24.045ms
a5c680ae 3d58dc62 " =X b" 35424359 2e42494e "5BCY.BIN" 27.937ms
d6775091 6176c5cd " wP av " 44317374 72646631 "D1strdf1" 28.447ms
a4883f65 4f9aa39c " ?eO " 36000000 00000000 "6 " 32.384ms
d1bd82ae 904be759 " K Y" 414b4559 434f4445 "AKEYCODE" 32.895ms
9fb9ce7a 49fc9a17 " zI " 334ff16d 1a9e0bfb "3O m " 36.693ms
d09d628e 706bc779 " b pk y" 426b6579 636f6465 "Bkeycode" 37.203ms
a63b3f65 4f9aa39c " ;?eO " 34cd0000 00000000 "4 " 41.048ms
e7a7667f 666b84d3 " f fk " 6b61696a 796f213f "kaijyo!?" 41.558ms
98b83c96 4c9aa39c " < L " 3a701f71 1f000000 ":p q " 45.679ms
f1b46298 636abc7f " b cj " 61746573 74706963 "atestpic" 60070.309ms
a3d482b8 833bde67 " ; g" 37544553 545f4f4b "7TEST_OK" 60074.289ms
f1b46298 636abc7f " b cj " 61746573 74706963 "atestpic" 120102.305ms
a3d482b8 833bde67 " ; g" 37544553 545f4f4b "7TEST_OK" 120106.289ms
f1b46298 636abc7f " b cj " 61746573 74706963 "atestpic" 180199.688ms
a3d482b8 833bde67 " ; g" 37544553 545f4f4b "7TEST_OK" 180203.656ms
Boot sequence, WCCF - a game loaded via network, only difference is 1 bit in the answer to kaijyo:
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 4.029ms
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 4.615ms
c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 8.643ms
bc7b59a4 b391c276 " {Y v" 2177590e 391e3b69 "!wY 9 ;i" 9.162ms
f662284d 3c586acf " b(M<Xj " 3044494d 4d494430 "0DIMMID0" 12.884ms
e46e56af 80b3dd64 " nV d" 22581b2f 312c315f ""X /1,1_" 13.394ms
a1c4869a 9a516ad4 " Qj " 3144494d 4d494431 "1DIMMID1" 17.161ms
af6e833c 1eaedd6a " n < j" 233a442f 312c315f "#:D/1,1_" 17.668ms
a0c4869a 9a51e7ce " Q " 3244494d 4d494432 "2DIMMID2" 21.393ms
d1bd82ae 904be759 " K Y" 414b4559 434f4445 "AKEYCODE" 21.900ms
9f0a0a02 d209a75f " _" 339ecde5 85910443 "3 C" 25.699ms
d09d628e 706bc779 " b pk y" 426b6579 636f6465 "Bkeycode" 26.207ms
a6cb3f65 4f9aa39c " ?eO " 345d0000 00000000 "4] " 30.050ms
e7a7667f 666b84d3 " f fk " 6b61696a 796f213f "kaijyo!?" 34.923ms
98b83c96 4c9aa39d " < L " 3a701f71 1f000001 ":p q " 39.043ms
f1b46298 636abc7f " b cj " 61746573 74706963 "atestpic" 60055.508ms
a3d482b8 833bde67 " ; g" 37544553 545f4f4b "7TEST_OK" 60059.488ms
"netboot pic", with "network" answer to kaijyo! and a key of all zeroes:
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 4.029ms
7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 29.037ms
c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 33.067ms
bc7b59a4 b391c276 " {Y v" 2177590e 391e3b69 "!wY 9 ;i" 33.581ms
f662284d 3c586acf " b(M<Xj " 3044494d 4d494430 "0DIMMID0" 37.303ms
e46e56af 80b3dd64 " nV d" 22581b2f 312c315f ""X /1,1_" 37.810ms
a1c4869a 9a516ad4 " Qj " 3144494d 4d494431 "1DIMMID1" 41.576ms
af6e833c 1eaedd6a " n < j" 233a442f 312c315f "#:D/1,1_" 42.078ms
a0c4869a 9a51e7ce " Q " 3244494d 4d494432 "2DIMMID2" 45.803ms
d1bd82ae 904be759 " K Y" 414b4559 434f4445 "AKEYCODE" 46.304ms
9f883f65 4f9aa39c " ?eO " 33000000 00000000 "3 " 50.103ms
d09d628e 706bc779 " b pk y" 426b6579 636f6465 "Bkeycode" 50.605ms
a6883f65 4f9aa39c " ?eO " 34000000 00000000 "4 " 54.449ms
e7a7667f 666b84d3 " f fk " 6b61696a 796f213f "kaijyo!?" 59.315ms
98b83c96 4c4ea39d " < LN " 3a701f71 1f4c0001 ":p q L " 63.435ms
Disassembly of a security PIC[edit]
References[edit]
http://debugmo.de/2008/05/pah-security/
http://www.ultimate-console.fr/=-Sega-naomi-1-/-2-=/=-G%C3%A9n%C3%A9rale-=/=-La-S%C3%A9curit%C3%A9-des-GDRoms-Naomi-=.html - great writeup in French
